This privacy policy describes how the Rencontres Internationales de la photographie d’Arles (“Les Rencontres d'Arles”) collects, processes and protects the information you provide, in accordance with the General Data Protection Regulation (GDPR) adopted by the European Parliament on 14 April 2016, and the French Data Protection Act of 6 January 1978 as amended.


Data controller
The personal data controller is:
Les Rencontres d'Arles
Responsable de traitement des données
34 rue du docteur Fanton
13200 Arles - France


Data Protection Officer
Les Rencontres d’Arles has a Data Protection Officer (DPO) whose contact details are as follows:
Les Rencontres d'Arles
Responsable de traitement des données
34 rue du docteur Fanton
13200 Arles - France


Personal data collected and processed
Les Rencontres d’Arles collects and processes all or part of the following data:
- Email address (User ID)
- Password
- Title
- First name
- Last name
- Date of birth
- Preferred language
- Postal addresses
- Telephone numbers
- Order history
- Claims
- Newsletter subscription
- IP address
- Disability type
- Browsing data on the website and the application
- Geolocation of the app (needed to allow the application to offer geolocation services and improve your visit to the festival).

When you create an account or place an order, you may choose to register as an individual or as a professional.

If you register as a professional, you will be asked for additional information, some of which is mandatory and allows you to activate all the associated features.
- Name of the organisation or company name
- Type of organisation
- Number of employees
- Position within the organisation

SOURCE OF DATA
The data comes from the recording of information:
- Entered when creating an account on Les Rencontres d’Arles website or application
- Entered when an order is placed online, on the application, by telephone, by mail or at the box offices
- Entered when subscribing to a newsletter
- Collected automatically via Google Analytics

MANDATORY DATA COLLECTION
Online, the mandatory nature of the data is indicated by an asterisk at the time it is collected.
- First and last names are mandatory for generating tickets, for issuing sales summaries and for identifying the beneficiaries of commercial offers,in particular those based on the age of the persons.
- The e-mail address is mandatory for the creation of the online account (login), as well as for the reception of the newsletter and access to electronic tickets
- The postal address is mandatory for the receipt of loyalty cards and physical tickets (non-electronic).

AUTOMATED DECISION MAKING
Some data may be processed automatically, in particular for:
- Eligibility for promotions or certain benefits
- Personalization of the online personal space

PERSONS CONCERNED
The data processing concerns:
- Any person who has created an online account on Les Rencontres d’Arles website or application. The person guarantees to be at least 15 years old when the account is created.
- Any person who has made a purchase on Les Rencontres d’Arles website or application, by telephone, by mail or at the box offices of Les Rencontres d’Arles.


Purposes of processing
Processing of personal data is intended for the following purposes:

1. THE FOLLOW-UP OF ORDERS AND IN PARTICULAR:
- Management of relations with festival goers and customers, which may include telephone calls
- Management of customer files, which includes technical operations such as uniformisation, enrichment and de-duplication
- Order management and after-sales service
- Management of payments, refunds and credit notes
- Ticketing and ticketing
- Waiting list management
- Creation of online accounts and management of their access
- Sending order-related information: events or exhibitions cancellation, change of time, change of programme, etc.
- Sponsorship management
- Management of unsettled ticket payments and litigation
- Management of claims

2. DEPENDING ON YOUR CHOICES, AND SUBJECT TO THE REGISTRATION OF YOUR AGREEMENT, THE DEVELOP-MENT OF MARKETING CAMPAIGNS SUCH AS:
- The sending of documents 
- The sending of communications relating to programming such as the announcement of future events, without this being an automated process.
- The sending of newsletters
- The promotion of related products in connection with your order: programmes, catering, etc.
- The carrying out of surveys
- The transfer of your details to cultural partners in order for you to benefit from offers from these partners

3. THE ELABORATION OF STATISTICS AND ATTENDANCE FIGURES, SUCH AS:
- The loyalty rate of spectators and visitors
- The average price
- The geographical origin of spectators and visitors
- Age of spectators and visitors

4. PERSONALIZATION OF THE WEBSITE OR APPLICATION CONTENT:
In this context, your data may be subject to automated processing or profiling in order for you to benefit from personalised advantages and personalised content on the website and the application.


Legal basis
The data processing carried out by Les Rencontres d'Arles is based on the following articles of the General Data Protection Regulation (GDPR):
- 6.1.a (consent) for marketing purposes
- 6.1.b (necessary for fulfilling a contract) for purposes relating to the processing and tracking of orders
- 6.1.e (mission of public interest) for statistical purposes related to the public survey mission on behalf of the Ministry of Culture


Recipients of personal data
The personal data collected is destined:

1. TO THE VARIOUS DEPARTMENTS OF LES RENCONTRES D’ARLES IN CHARGE OF PROCESSING AND IN PARTICULAR:
- Spectator experience
- Marketing
- Press
- Protocol
- Communication
- Accounting agency

2. TO SERVICE PROVIDERS ACTING AS SUBCONTRACTORS AS DEFINED BY THE RGPD ON BEHALF OF LES RENCONTRES D’ARLES WITHIN THE FRAMEWORK OF THE AFOREMENTIONED PURPOSES
- Art Book Magazine : service provider in charge of developing Les Rencontres d’Arles website and application
- Safran Solution : provider of Les Rencontres d’Arles IT ticketing solution
(LIST AS OF MAY 2024, SUBJECT TO CHANGE)

3. THIRD-PARTY PARTNERS
Subject to the registration of your agreement, the data may also be transmitted to third-party partners


Duration of storage
Personal data is kept for the time required to manage the commercial relationship and to compile statistics, intended in particular for the Ministry of Culture.
Personal data relating to bank cards is kept encrypted for 18 months by our payment service provider, in particular with the aim of facilitating reimbursements by crediting the bank card used for the purchase.


Deleting an account
After identification on www.rencontres-arles.com, you have the possibility of deleting your account. By choosing to delete your account, no claim can be made in case of loss or non-receipt of your tickets.


Security
Les Rencontres d’Arles has implemented technical and logistical measures to guarantee the protection of your data, and in particular:

DATA HOSTING LOCATIONS
Your data is stored:
- on Les Rencontres d’Arles internal servers located in France
- on the servers of the service provider Safran Solution. This service provider is contractually bound to comply strictly with the General Data Protection Regulation (GDPR) and in particular to implement everything necessary to secure and protect your data.

DATA PROTECTION MEASURES
To secure your data, Les Rencontres d’Arles and Safran Solution take all the necessary technical and operational measures, in particular access controls, the use of firewalls and current anti-virus software, SSL encryption and log files during manual changes to the databases. The monetary aspect (credit card transactions) is PCI DSS certified and audited once a year.
Passwords used by Les Rencontres d’Arles and Safran Solution must meet complexity requirements to be valid.
Physical access to data warehouses is strictly controlled by codes, tracking, alarms, badges and video surveillance.


Your rights
You may exercise your rights with the Data Protection Officer (DPO) and lodge a complaint, if necessary, with the Commission Nationale de l'Informatique et des Libertés (CNIL).
Identification will be required to exercise these rights. This identity document is:
- immediately deleted in the event that the Data Protection Officer is not legally competent or if the properly addressed request to the Officer did not require the transmission of an identity document;
- deleted 1 year after receipt of the request in other cases.
Under this procedure, data are kept for the calendar year of the request, plus five years.

1. EXERCISING YOUR RIGHTS WITH THE DPO
Les Rencontres d'Arles' Data Protection Officer (DPO) is your contact for any request to exercise your rights.

Contact us
BY E-MAIL: info@rencontres-arles.com
BY POST:
Les Rencontres d'Arles
Délégué à la protection des données
34 rue du docteur Fanton
13200 Arles France

You have the following rights in particular:  
- A right to information (articles 13 and 14 of the RGPD): you may exercise your right to information in order to know what personal data is processed by Les Rencontres d'Arles, for whom this information is intended, what are the purposes of the processing, how long your data is kept and what are your rights.
- A right of access (article 15 of the GDPR): you may exercise your right of access to obtain the personal data concerning you. In this case, you may be asked to provide proof of identity in order to verify its accuracy.
- A right of rectification (article 16 of the RGPD): if the personal data held is inaccurate, you may request that your information be updated.
- A right to deletion or "right to be forgotten" (Article 17 of the GDPR): you can request the deletion of your personal data.
- A right to processing restrictions (Article 18 of the GDPR): you have the right to request to restrict the processing of your personal data in accordance with the assumptions set out in Article 18 of the GDPR and to provide instructions on what to do with your data in the event of your death
- A right to data portability (article 20 of the GDPR): you may ask Les Rencontres d’Arles to return your data to you for transmission to a third party.
- A right to object (article 21 of the RGPD): you may object to your data being processed in accordance with the conditions set out in article 21 of the RGPD.

2. MAKING A COMPLAINT TO THE CNIL
You have the right to make a complaint to the Commission Nationale de l'Informatique et des Libertés (CNIL), in particular:
- If you believe, after contacting the DPO, that your rights regarding your data are not respected
- In the event of a violation of rights noted in the processing of your personal data

The Privacy Policy may be modified at any time by Les Rencontres d'Arles.