General data protection policy
1. Introduction
As part of its activity, the Ministry of Culture collects and processes personal data about you.
The General Data Protection Regulation, known as «GDPR» (EU Regulation 2016/679 of 27 April 2016), reinforces the control exercised by citizens over their personal data.
It is in this context that the Ministry wishes to show you its commitment to the protection of your personal data, an essential vector of trust between the Ministry of Culture and its users.
Through this policy, the Ministry of Culture wishes to provide you with all the useful information on the protection of your personal data and the rights you have.
In particular, this policy aims to provide you with clear and transparent information about the data processing implemented to allow you to understand under what conditions your data is processed.
This policy also aims to facilitate your efforts to exercise your rights regarding your personal data with the Ministry of Culture by detailing each of them.
2. Fair and transparent collection of your data
In the interest of loyalty and transparency, the Ministry of Culture takes care to inform the persons concerned of each treatment it implements by mentions of information.
This data is collected fairly. Thus, no collection is carried out without the knowledge of the people and without them being informed.
3. Legitimate and proportionate use of your data
When the Ministry of Culture is required to process data, it does so for specific purposes: each data processing carried out pursues a legitimate, determined and explicit purpose.
For each of the treatments implemented, the Ministry undertakes to collect and use only adequate, relevant and limited data to what is necessary for the purposes for which they are processed.
The ministry ensures that the data is updated and implements processes to allow for the erasure or correction of inaccurate data.
4. The personal data we process
In the context of the processing of personal data whose purposes are presented to you in the Ministry’s Register of Processing, the Ministry collects and processes the following categories of data:
- Identification data of the data subjects such as your civility, your name and surname, your electronic, telephone and postal details.
- Data relating to the professional situation of the person concerned such as the profession or professional contact details.
- Economic and financial data.
- Recording of videoconferences and webinars organized by the department (video, content, message, dashboard and reports).
- Login data and log.
- Content of discussions with the Ministry.
5. Our processing of personal data
The personal data collected as part of the services offered by the Ministry of Culture are processed according to secure protocols and allow the Ministry to manage requests received in its computer applications.
For more information on each of the personal data processing implemented by the Ministry, you can consult the Register of processing activities of the Ministry of Culture.
6. Recipients of Data
To achieve the purposes described above and within the limits necessary for the pursuit of these purposes, the data collected by the Ministry of Culture may be transmitted to all or some of the following recipients:
- authorized persons of the departments concerned within the Ministry;
- any authorised third party intervening for the purposes of the missions entrusted to the Ministry of Culture;
- providers and subcontractors associated with the processing of your data;
- administrative or judicial authorities.
We ensure that only authorised persons have access to this data. The Ministry of Culture has a strict enabling policy that allows the data it processes to be transmitted only to those authorized to access it.
7. Transfers of your data
The Ministry of Culture may transfer personal data outside the European Union as part of the computer tools it uses for its activities.
These transfers can only be made after the Ministry has taken measures to secure them, for example by ensuring the conclusion of the standard clauses defined by the European Commission to regulate the flows.
As part of its development and to increase the availability of its agents, the department chose to use Microsoft Office 365 solutions, including messaging, videoconferencing, scheduling and cloud computing.
In this context, the data of these applications may be hosted within the European Union (excluding France) and the United States.
The authorised recipients of Microsoft will have access to the following categories of data: identification data, professional life data, economic and financial data, connection data, contact information that may be processed in connection with the use of the services provided by Microsoft.
This data is transferred to the authorized departments of Microsoft entities for mainly outsourcing, maintenance, support, administration, hosting and to meet the requests of the authorities legally entitled to know.
8. Data Security
The Ministry of Culture attaches particular importance to the security of personal data.
It has put in place technical and organizational measures adapted to the degree of sensitivity of this data, in order to ensure their integrity and confidentiality and to protect them against any malicious intrusion, any loss, alteration or disclosure to unauthorized third parties.
Nevertheless, the security and confidentiality of personal data is based on good practices and the vigilance of everyone on this data.
9. Outsourcing
When the Ministry of Culture uses a provider, it does not disclose personal data to the latter until it has obtained a commitment and guarantees on its ability to meet these security and confidentiality requirements.
We conclude with our subcontractors in compliance with our legal and regulatory obligations (Article 28 GDPR) contracts defining precisely the conditions and modalities of processing of personal data by the latter, in compliance with the regulation on the protection of personal data.
10. Cookies
We use different cookies on the site to measure the audience and integrate services to improve the interactivity of the site.
A «cookie» is a series of information, usually small and identified by a name, that can be transmitted to your browser by a website on which you connect. Your web browser will keep it for a certain period of time, and will send it back to the web server each time you reconnect to it.
Cookies have multiple uses: they can be used to remember your customer ID at a merchant site, the current content of your shopping cart, an identifier to trace your navigation for statistical or advertising purposes, etc.
The cookies placed on the website of the Ministry of Culture are subject to a cookies policy.
11. The rights recognized to you
The Ministry of Culture is particularly concerned about respecting the rights granted to you in the context of the data processing that it implements, to ensure fair and transparent processing taking into account the particular circumstances and context in which your personal data is processed.
11.1 Your right of access
As such, you have the confirmation that your personal data are or are not processed and when they are, you have the right to request a copy of your data and information concerning:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients as well as, if any, the international organisations to which the personal data has been or will be communicated, in particular recipients established in third countries;
- where possible, the intended retention period of personal data or, where this is not possible, the criteria used to determine that period;
- the existence of the right to request the controller to rectify or erase your personal data, the right to request a limitation of the processing of your personal data, the right to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- information on the source of the data when it is not collected directly from the data subjects;
- the existence of automated decision-making, including profiling, and in the latter case, useful information about the underlying logic, as well as the importance and expected consequences of such processing for the data subjects.
11.2 Your right to rectification of your data
You can ask us to rectify or complete your personal data if it is inaccurate, incomplete, ambiguous or outdated.
11.3 Your right to erasure of your data
You can ask us to delete your personal data if one of the following applies:
- Personal data are no longer required for the purposes for which it was collected or otherwise processed;
- you withdraw your prior consent;
- you object to the processing of your personal data where there is no compelling legitimate reason for the processing;
- the processing of personal data does not comply with the provisions of the applicable legislation and regulations.
Your attention is drawn to the fact that the right to erasure of data is not a general right and that it can only be granted if one of the reasons provided for in the applicable regulations is present.
Thus, if none of these reasons is present, the Ministry of Culture will not be able to respond favourably to your request; this will be the case if it is required to keep the data due to a legal or regulatory obligation or for the finding, the exercise or defence of legal rights.
11.4 Your right to restriction of data processing
You can request the limitation of the processing of your personal data in the cases provided for by the Data Protection Regulations.
11.5 Your right to object to data processing
You have the right to object at any time, for reasons relating to your particular situation, a processing of your personal data whose legal basis is the legitimate interest or the performance of a mission of public interest or falling within the exercise of the public authority of the Ministry of Culture.
In the event of exercising such a right of objection, we will ensure that we no longer process your personal data in the context of the processing concerned unless we can demonstrate that we may have legitimate and compelling grounds for maintaining such processing. These grounds must be superior to your interests and your rights and freedoms, or the processing must be justified for the establishment, exercise or defence of rights in court.
11.6 Your right to data portability
You have the right to the portability of your personal data, that is, the right to receive and request the transfer of this data from one controller to another. Please note that this is not a general right. Indeed, all the data of all the treatments are not portable and this right concerns only automated treatments excluding manual or paper treatments.
This right is limited to processing where the legal basis is your consent or the execution of pre-contractual measures or a contract.
This right does not include derived data or inferred data, which are personal data created by the Ministry of Culture.
The data on which this right may be exercised are as follows:
- only your personal data, which excludes anonymised personal data or data that does not concern you;
- the declarative personal data as well as the operational personal data mentioned above.
The right to portability may not infringe the rights and freedoms of third parties such as those protected by business secrecy.
You can request the portability of the data according to the procedure defined below, specifying whether you wish to receive them yourself or if it is technically possible for us, that we transmit them directly to another data controller.
In the latter case, you will make sure to tell us the exact name of this person, his contact details and the service or person who should be the recipient. In order to facilitate the exercise of this right, you must inform the recipient of your request to our services.
11.7 Your right to withdraw your consent
When the data processing that we implement is based on your consent, you can withdraw it at any time. We will then stop processing your personal data without questioning the previous transactions for which you have consented.
11.8 Your right to lodge a complaint
You have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy 75007 Paris, on French territory and this without prejudice to any other administrative or judicial recourse.
11.9 Your right to set post-mortem guidelines
You have the possibility to define specific guidelines for the storage, erasure and communication of your personal data after your death with our services according to the methods defined below. These specific guidelines will only concern the treatments implemented by us and will be limited to this perimeter alone.
You will also have the right to set general guidelines when that person has been designated by the executive branch.
11.10 How to exercise your rights
For any information or exercise of your rights on the processing of personal data managed by the Ministry, you can contact its Data Protection Officer (DPO):
- by this form ; or
- at the following e-mail address: delegue-protection-donnees@culture.gouv.fr; or
- by mail to the following address: 182 rue Saint Honoré, 75001 Paris
proving your identity by any means.
12. Amendment of this document
We invite you to regularly consult this policy on our website. It may be updated.
Partager la page