For many years, the Lyon Opera has processed and stored your data in accordance with applicable legal and regulatory requirements.
As part of this approach, the Lyon Opera has drawn up a Personal Data Protection Policy to provide all data subjects with clear, transparent and precise information about the data processing activities it carries out.
This policy helps you understand:
• what information we collect;
• why we collect it;
• how it is used;
• how long it is kept;
• who it is shared with;
• what your rights are and how to exercise them.

Whatever the sales or contact channel you use, the Lyon Opera is committed, in accordance with the European General Data Protection Regulation, to protecting your privacy by ensuring the personal data you provide remains confidential and secure.

The main principles of data protection are as follows:
• Transparency The Lyon Opera provides all the necessary information on the purpose and recipients of your collected data and on how to exercise your rights.
• Specified and legitimate purposes The Lyon Opera only collects data that is strictly necessary for the activities it carries out and the services it provides.
• Data minimisation Only data that is relevant and adequate in relation to the purposes pursued is collected.
• Confidentiality, integrity and security The Lyon Opera implements appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access.
• Data retention Data is kept only for as long as is necessary to achieve the purposes for which it was collected, unless a legal obligation requires otherwise.
• Respect for data subjects' rights Every individual has rights regarding their personal data and may exercise them at any time under the conditions described below.

2.1 Who is the data controller?
The data controller is: Opéra National de Lyon, 1 place de la Comédie, 69001 Lyon, France.

2.2 When do we collect your personal data?
Your personal data may be collected:
• when you browse the Lyon Opera website and online ticketing site;
• when you create a personal account on the Lyon Opera's online ticketing service, at the box office or by telephone;
• when you enter into a commercial relationship with the Lyon Opera (purchase of shows and/or services, order tracking, information relating to your purchases, etc.) and contact the Lyon Opera's sales department online, at the box office or by telephone;
• when you have a partnership relationship with the Lyon Opera, within the framework of service contracts or otherwise;
• when you submit a question through the "Contact us" forms on the website;
• when you contact the Lyon Opera online, by email or by telephone regarding the organisation of an event or to obtain information about offers dedicated to companies;
• when you purchase services reserved for companies;
• when you subscribe to our newsletters and/or information about our news/promotional offers;
• when you subscribe to our waiting lists;
• when you take part in an event organised by the Lyon Opera;
• when you register to receive the Lyon Opera's season programme;
• when you take part in competitions at the box office or online;
• when you share content or information relating to the Lyon Opera on social media;
• when you submit a request to exercise your rights.

2.3 What type of data is collected?
Declared personal data is the information you provide as part of your relationship with the Lyon Opera's services or partner theatres.
The personal data necessary for audience, partner or commercial relationships is indicated as "mandatory" by an asterisk on online collection forms or by the Lyon Opera's sales team, by telephone or at the box office.
Forms used to contact the Lyon Opera's various departments contain mandatory data required in order to reply to you and include a free-text field. You may provide other personal data about yourself in your message or as an attachment. Providing such personal data is voluntary. This data will only be processed in order to respond to your request. Your contact details may be used to reply to your message. Mandatory data, identified by an asterisk, is necessary to provide the requested service. Failure to provide it may prevent the creation of an account, the booking of a show or the provision of the service concerned.

Depending on your relationship with the Lyon Opera, we may collect the following data:
• Identification data: surname; first name; title; date of birth; language.
• Contact details: postal address; email address; landline or mobile telephone number.
• Ticketing-related data (relating to the amount, nature and frequency of purchases): bookings; subscriptions; loyalty programmes; purchase history; seating preferences; with your consent, data relating to seating requirements associated with a disability; bank details (encrypted), processed only by a secure payment service provider.
• Data relating to your interactions with the Lyon Opera: requests submitted to our services online, by email or by telephone; participation in satisfaction surveys; participation in competitions at the box office or online; registrations for events or visits; subscriptions to one or more of the Lyon Opera's newsletters, promotional offers and the mailing of the season programme.
• Browsing data (Lyon Opera website and online ticketing site): IP address; information relating to your device; data collected through cookies or other tracking technologies; activity history (account creation date, modification date)
• Recruitment-related data: CV/resume; cover letter.

In accordance with the law, the Lyon Opera does not under any circumstances collect special categories of personal data revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, personal genetic data, biometric data, or personal data concerning health, sexual activity or sexual orientation.
The Lyon Opera does not collect health data, except where an individual voluntarily provides information relating to a disability or specific needs in order to benefit from an adapted service, on the basis of explicit consent (Article 9.2(a) of the GDPR) and where necessary to provide a requested service. For example, in the case of a refund request, the Lyon Opera may receive and retain a medical certificate as supporting documentation.

2.4 Why does the Lyon Opera collect your data and for what purposes?

The purposes of the processing of personal data are as follows:
• Management of relationships with audiences, visitors and partners The Lyon Opera uses the Secutix 360° ticketing and customer relationship management solution to collect and process personal data relating to its audiences. This data is used in particular to:
• manage bookings, purchases, orders and payments;
• ensure the delivery of tickets and the provision of subscribed services;
• communicate with you about your orders, invoices, services and promotional offers;
• inform you of changes relating to shows (schedule changes, postponements, cancellations, etc.);
• manage loyalty programmes and the associated benefits;
• respond to your requests and manage your relationship with the Lyon Opera.

Legal basis(es):
Performance of a contract or taking steps at the request of the data subject prior to entering into a contract (Article 6.1(b) of the GDPR) for the management of orders, bookings, subscriptions and associated services;
Compliance with a legal obligation (Article 6.1(c) of the GDPR) where certain data must be retained or used for accounting, tax or complaints-management purposes;
Legitimate interests of the Lyon Opera (Article 6.1(f) of the GDPR) in order to ensure effective management of its relationships with customers, handle complaints and ensure the proper functioning of the institution's activities. Such processing is limited to the data necessary for these purposes.
• Information, communication and promotion of the Lyon Opera's activities In order to promote its shows, events and services, the Lyon Opera may use your personal data to:
• communicate information about its programme, activities and services;
• offer promotional offers, benefits or additional services;
• personalise certain communications based on your booking history, attendance history or interests, in order to send you content that may be of interest to you;
• carry out targeted online communication and advertising campaigns.

Legal basis(es):
Legitimate interests of the Lyon Opera (Article 6.1(f) of the GDPR) in informing individuals who have a relationship with the institution about its programme, services and cultural news, while respecting their expectations and their right to object to receiving such communications where provided for by applicable regulations;

Consent (Article 6.1(a) of the GDPR) where required by applicable regulations, in particular for certain electronic marketing activities or the use of certain advertising trackers.
• Audience analysis and improvement of services
The Lyon Opera also uses the data collected to gain a better understanding of its audiences, assess changes in their cultural practices and improve the services provided. This processing makes it possible in particular to:
• produce anonymous or aggregated statistics;
• analyse attendance and booking habits;
• measure audience satisfaction and loyalty;
• adapt the cultural offering and services to audience expectations.

For example, such analyses may concern the average number of shows attended per season; the audience and visitor retention rate; the average booking price; the geographical origin of audiences; or the distribution of audiences by age group. Where analyses cannot be carried out without the assistance of specialised service providers, only the data strictly necessary is transmitted. Where the purpose allows, data is anonymised or aggregated beforehand. Service providers act in accordance with the Lyon Opera's instructions, do not use the data for their own purposes and do not retain it for longer than necessary to perform their services.

Legal basis:
Legitimate interests of the Lyon Opera (Article 6.1(f) of the GDPR) in gaining a better understanding of audience attendance, assessing its cultural activities, adapting its offering and improving the quality of the services provided.
• Administrative and financial management
The Lyon Opera processes personal data as part of its administrative, accounting and financial management.
This data is used in particular to:
• manage accounting, invoicing and payments;
• manage relationships with suppliers, service providers, partners and institutional contacts;
• monitor contracts, agreements and commitments;
• comply with the administrative, accounting, tax and regulatory obligations applicable to the Lyon Opera;
• process requests submitted to the institution and ensure their follow-up.

Legal basis(es):
Performance of a contract or taking steps at the request of the data subject prior to entering into a contract (Article 6.1(b) of the GDPR);
Compliance with a legal obligation (Article 6.1(c) of the GDPR), in particular in accounting, tax and social-security matters;
Legitimate interests of the Lyon Opera (Article 6.1(f) of the GDPR) in ensuring the day-to-day operation of the institution, the administrative management of its activities and the management of its relationships with partners, suppliers and service providers.

• Recruitment management
As part of its recruitment procedures, the Lyon Opera collects and processes the personal data of job applicants.This data is used to:
• review applications and assess the suitability of candidates for the positions offered;
• organise interviews with candidates;
• create recruitment files;
• carry out the formalities required for recruitment when an application is successful;
• with the candidate's consent, retain certain applications in order to offer future opportunities matching their profile.

Legal basis(es):
Performance of pre-contractual measures taken at the request of the candidate (Article 6.1(b) of the GDPR);
Compliance with a legal obligation (Article 6.1(c) of the GDPR) where certain checks or formalities are required by law;
Legitimate interests of the Lyon Opera (Article 6.1(f) of the GDPR) in organising its recruitment procedures, assessing applications and selecting candidates whose profiles are suited to the positions to be filled, while respecting candidates' rights;
Consent (Article 6.1(a) of the GDPR), where required for retaining applications for future recruitment opportunities.

2.5 Who sees your personal data?
The data collected is accessible only to authorised personnel of the Lyon Opera as part of their duties. Depending on the circumstances, these individuals may belong to the audience development department, the human resources department, the accounting department, or the Data Protection Officer (DPO).
The Lyon Opera's service providers may also receive certain personal data that is strictly necessary to perform the services entrusted to them, including:
• Lyon Opéra Restauration (management of interval dinner reservations);
• the ticketing solution provider (Secutix);
• the secure payment service provider (Slimpay);
• the technical service provider responsible for the website (Rezo Zero);
• the audience analytics service provider (public procurement contract currently being renewed*).

These service providers are subject to strict contractual confidentiality and security obligations. The data is never sold to third parties.

2.6 How long is your personal data kept?
Personal data is retained for periods appropriate to each purpose. Examples include:
• Active customer account: retained for the duration of the customer relationship. Deleted 3 years after the last contact.
• Invoices and accounting data: retained for 10 years.
• Direct marketing: retained for 3 years after the last contact.
• Analytics cookies: retained for a maximum of 13 months.
• Unsuccessful applications: retained for up to two years after the last contact, unless the candidate objects.
• Data relating to litigation: retained for the duration of the proceedings, followed by statutory archiving determined by the nature of the litigation.
• Images from the video surveillance system and associated information (date, time, recording location): maximum of 1 month.

3.1 What is a cookie?
A cookie is a small text file placed on your device (computer, smartphone or tablet) when you visit a website. It may be used to remember certain information about your browsing activity in order to make the site easier to use, improve its performance or measure its audience.
The Lyon Opera uses cookies and similar technologies, such as web beacons, pixels and mobile device identifiers. In this policy, all these technologies are referred to as "cookies".
Cookies are either temporary (session cookies) or persistent. Session cookies are only active for the duration of your visit and are deleted when you close the browser. Persistent cookies remain on your terminal's hard drive when you leave the site and remain there until you manually delete them or the browser deletes them after a certain period of time.

3.2 What cookies do we use?
The Lyon Opera uses different categories of cookies and other tracking technologies to ensure the Lyon Operation of the website, measure its audience and, subject to your consent, conduct targeted communication activities.
• Strictly necessary cookies
These cookies are essential for the Lyon Operation of the website and cannot be disabled through our cookie management platform.
They are used in particular to ensure website security, remember your consent choices and ensure the proper functioning of essential features. These cookies do not require your prior consent.
• Audience measurement cookies
Subject to your consent, which can be configured and changed, we use audience measurement solutions to measure website traffic, produce browsing statistics, better understand browsing journeys and improve content and performance.
For this purpose, we use the Matomo Cloud tool. The data collected may include information relating to your browsing activity, such as pages viewed, browsing duration, device type and approximate location data.
• Advertising and marketing cookies
Subject to your consent, certain tools may place cookies in order to measure the effectiveness of our communication campaigns, offer content that may be of interest to you and limit the repetition of advertising messages.
The tools used on the website include in particular:
o The Trade Desk;
o Weborama;
o Meta Platforms (Facebook Pixel).
These partners may process the data collected in accordance with their own privacy and cookie policies.
• Embedded content provided by third parties
Certain pages of the website may incorporate content or services provided by third parties, such as Deezer or YouTube (videos, audio players, social media and broadcasting platforms).
Viewing this content may result in cookies being placed by the relevant providers, subject to your consent choices. We invite you to consult the privacy policies of these services for further information about the processing they carry out.

3.3 How long are cookies kept?
Cookies are retained for a limited period that varies depending on their nature and purpose.
In any event:
• session cookies are deleted when you close your browser;
• persistent cookies are retained for a maximum of thirteen months from the date they are placed on your device, unless you delete them earlier;
• your choices regarding consent to or refusal of cookies are retained for a maximum of six months.

3.4 How to manage and disable cookies?
Most browsers are set to accept cookies used on our websites. However, you can adjust these settings to disable cookies. The following links will explain how to adjust your browser's cookie settings:
• Firefox
• Internet Explorer
• Google Chrome
• Opera
• Safari on iOS
• Microsoft Edge

When you disable cookies, some graphics may not display correctly and you may not be able to use certain applications.

The Lyon Opera implements procedures for detecting, analysing and managing security incidents that may affect personal data.

4.1 Where is your data hosted?
Data is hosted:
• On the Lyon Opera's internal servers, located in France.
• On the servers of Secutix SA, using OCI (Oracle Cloud Infrastructure) services, whose servers are located in France. This service provider is contractually required to comply strictly with the General Data Protection Regulation (GDPR) and, in particular, to implement all measures necessary to secure and protect your data.

Secutix SA is certified to ISO/IEC 27001:2013 and PCI DSS standards.

4.2 What measures are in place to ensure data security?
The Lyon Opera implements appropriate technical and organisational measures, including access controls, user authentication, firewalls and antivirus software, SSL encryption and logs recording manual changes to databases.
The payment component (bank card transactions) is PCI DSS certified.
If a data breach occurs and is likely to result in a risk to the rights and freedoms of the individuals concerned, it will be notified to the competent supervisory authority and, where required by law, to the individuals concerned.

The Lyon Opera prioritises the hosting and processing of personal data within the European Union or the European Economic Area (EEA).
Ticketing and audience relationship data is notably processed by our technical service providers, including Secutix, whose hosting infrastructure is located in France on Oracle Cloud Infrastructure (OCI), as well as Kulturplanner, whose services are hosted in Amazon Web Services (AWS) data centres located in Germany.
However, certain subcontractors may transfer data to countries outside the EEA, such as the United States, in particular in connection with:
• the use of Meta Conversions API and Meta Platforms to measure the performance of our advertising campaigns on Facebook and Instagram;
• maintenance, technical support or security operations carried out by certain companies within the Amazon Web Services group.

Where such transfers take place, they are governed in accordance with the requirements of the General Data Protection Regulation (GDPR), in particular on the basis of:
• an adequacy decision adopted by the European Commission, such as the EU-U.S. Data Privacy Framework, where the recipient is certified under that framework;
• or, where applicable, the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures designed to ensure a level of protection equivalent to that provided within the European Union.

The Lyon Opera has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with applicable regulations and assisting data subjects in exercising their rights.

For any questions relating to the protection of personal data, you can contact us at the following email address: dpo@opera-lyon.com

Or by post:
Opéra National de Lyon
Data Protection Officer – Administrative and Financial Department
1 place de la Comédie
69001 Lyon
France

For any request relating to your personal data, you can contact the Data Protection Officer at the address indicated above. A response will be provided within a maximum period of one month.

7.1 What rights do you have?
You have the following rights:
• A right to information (articles 13 and 14 of the GDPR): you can exercise your right to information to find out what personal data is processed by the Lyon Opera, for whom this information is intended, what the purpose of processing it is, how long your data is kept and what your rights are.
• A right of access (article 15 of the GDPR): you can exercise your right of access to know the personal data concerning you. In this case, you may be asked to provide proof of your identity in order to verify its accuracy.
• A right to rectification (article 16 of the GDPR): if the personal data held is inaccurate, you may request that your information be updated.
• A right to erasure or "right to be forgotten" (article 17 of the GDPR): you can request the deletion of your personal data.
• A right to restriction of processing (article 18 of the GDPR): you have the right to request a restriction of the processing of your personal data under the conditions set out in Article 18 of the GDPR, and to provide for instructions regarding the retention, deletion or disclosure of personal data after death.• A right to data portability (article 20 of the GDPR): you can ask the Lyon Opera to give your data to you so that it can be transmitted to a third party. • A right to object (article 21 of the GDPR): you may object to your data being processed under the conditions set out in Article 21 of the GDPR

7.2 How to make a complaint to the CNIL?
You have the right to lodge a complaint with the French Data Protection Authority (CNIL), particularly:
• If you believe, after having contacted the data protection department, that your rights regarding your data are not being respected.
• If you believe that your rights have been infringed in connection with the processing of your personal data.

This policy may be amended to take account of changes in legislation, regulations, case law or technology. The date of the latest update is indicated at the beginning of this document.