Courtesy translation — the French version prevails

Privacy policy

The Fondation Art Explora is the data controller; ARTERA (Art.Private.) acts as processor, on its behalf and on its instructions.

Retention periods

The data of buyers and of recipients of gifted tickets is kept for the entire duration of the operation, until the draw and the handing over of the prize, then archived for five years, the applicable limitation period, before being deleted. Accounting data and proofs of payment are kept for ten years, in accordance with legal obligations. The data of people who have subscribed to information about the operation is kept until they unsubscribe, and at the latest three years after the last contact.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent at any time. To exercise them, write to contact@artforeverychild.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

Cookies

For visitors, the site sets only one cookie: a language preference cookie (afec_lang), set only when you use the language button. It remembers the language you chose (French or English) for one year and contains no other data. This functional cookie is exempt from consent. The site does not set any audience-measurement cookie.

Gifts: the recipient’s data

When you give a ticket, you provide us with the recipient’s last name, first name, email address and, where applicable, phone number, together with your message. This data is used solely to deliver the ticket to the recipient and to inform them of their participation and of the draw result. Legal basis: performance of the contract concluded with the buyer for the benefit of the recipient, and the organiser’s legitimate interest in delivering the ticket (Article 6(1)(b) and (f) of the GDPR). By giving a ticket, you undertake to have informed the recipient of this processing. This data is kept for the same periods as those applying to buyers, as set out in this policy, and is then deleted. The recipient may exercise their rights under the conditions described above. The message is limited to 300 characters (plain text). The email to the recipient is sent on the date chosen by the buyer. The phone number, which is optional, is used only to contact the recipient if they win: it is visible only in the back office and is never passed to the court bailiff. This data is not used for marketing. The buyer’s private link is stored only as a hash and expires at the draw.

Partners

Organisations of the Art For Every Child operation.

Fondation Art Explora

Entity: Fondation Art Explora
Role: Organiser and beneficiary of the operation
Address: 9 place de la Madeleine, 75008 Paris
Website: artexplora.org
Privacy policy: Privacy policy of this site

Art.Private.

Entity: ARTERA (Art.Private.)
Role: Operational provider
Address: 2 avenue Frédéric Le Play, 75007 Paris
Website: artprivate.com
Privacy policy: PERSONAL DATA PROTECTION POLICY

Processors

Vercel Inc. — Hosting of the site and server functions

Service: hosting of the website and execution of server functions.

Location: server functions are executed in Paris, France (European Union). This location does not mean that all processing, technical logs and associated services are limited to France.

Address: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States.

Data protection contact: privacy@vercel.com

Transfer safeguards: any transfers outside the European Economic Area, in particular to the United States, are governed by Vercel’s data processing agreement (DPA), which incorporates the European Commission’s standard contractual clauses, as well as by the required supplementary measures. Vercel also states that it adheres to the EU–US Data Privacy Framework.

Privacy policy: https://vercel.com/legal/privacy-policy

Data processing agreement (DPA): https://vercel.com/legal/dpa

Neon — Database hosting

Service: hosting and management of the PostgreSQL database containing orders, tickets and proofs of consent.

Location: Frankfurt, Germany (European Union), AWS infrastructure, eu-central-1 region.

Registered office: Neon, LLC, 209 Orange Street, Wilmington, Delaware 19801, United States. Correspondence address: 2261 Market Street, STE 22601, San Francisco, CA 94114, United States.

Data protection contact: privacy@neon.tech

Transfer safeguards: the European location of the database does not rule out possible access or processing from countries outside the European Economic Area. These are governed by the applicable data processing agreement, in particular by the European Commission’s standard contractual clauses and the required supplementary measures. Databricks, Inc. and Neon, LLC are also covered by the group’s certification under the EU–US Data Privacy Framework.

Privacy policy: https://www.databricks.com/legal/privacynotice

Terms of service: https://neon.com/platform-terms

Brevo (formerly Sendinblue) — Email sending and contact management

Service: sending of transactional emails related to the operation (tickets, confirmations, registrations) and management of contact lists.

Address: Brevo SAS, 9-17 rue Salneuve, 75017 Paris, France. Paris RCS 498 019 298.

Data protection contact: dpo@brevo.com

Data location: Brevo states that it hosts its databases in the European Union, in France and Germany with OVH, and in Belgium with Google Cloud.

Safeguards: the data processing agreement (DPA) incorporated into Brevo’s terms of use governs the processing carried out on behalf of the customer. The European location of the databases does not rule out all access or transfers outside the European Economic Area. Any such transfers are governed by the safeguards provided for in this DPA and in Brevo’s list of sub-processors.

Privacy policy: https://www.brevo.com/fr/legal/privacypolicy/

Terms of use and data processing agreement: https://www.brevo.com/fr/legal/termsofuse/

Plausible Insights OÜ — Anonymised audience measurement

Service: anonymised audience measurement of the site (page views, origin of visits, steps of the purchase journey), without cookies and without personal data. The site does not set any audience-measurement cookie.

Data measured: the events sent contain no name, email address, phone number or order identifier (click on the ticket purchase button, order created, payment completed with its amount and number of tickets, ticket given).

Location: the measurement data is hosted and processed in the European Union (Germany).

Registered office: Plausible Insights OÜ, Tartu, Estonia.

Data protection contact: privacy@plausible.io

Privacy policy: https://plausible.io/privacy

Payments are processed by HelloAsso, which acts as controller of its own processing. HelloAsso privacy policy: https://info.helloasso.com/politique-de-confidentialite