The personal data controller is the Paris Opera 120 rue de Lyon 75576 PARIS Cedex 12.
Data Protection Officer
The Paris Opera has appointed a Data Protection Officer (DPO) whose contact details are as follows:
79 bis, avenue de l'Europe
Personal data collected and processed
The Paris Opera collects and processes all or part of the following data:
PasswordTitleFirst nameLast nameDate of birthPreferred languagePostal addresses
Telephone numbersOrder historyClaimsNewsletter subscriptionIP addressDisability typeBrowsing data on the website and the application
When you create an account or place an order, you may choose to register as an individual or as a professional.
If you register as a professional, you will be asked for additional information, some of which is mandatory and allows you to activate all the associated features.
- Name of the organisation or company name
- Type of organisation
- Number of employees
- Position within the organisation
Source of data
The data comes from the recording of information:
Entered when creating an account on the Paris Opera website or in an applicationEntered when an order is placed online, on the application, by telephone, by mail or at the box offices of our theatresEntered when subscribing to a newsletterCollected automatically via Google Analytics or the SITE (Selligent) module, when you use the website
Mandatory data collection
Online, the mandatory nature of the data is indicated by an asterisk at the time it is collected.First and last names are mandatory for generating tickets, for issuing sales summaries and for identifying the beneficiaries of commercial offers,in particular those based on the age of the persons.The e-mail address is mandatory for the creation of the online account (login), as well as for the reception of the newsletter and access to electronic ticketsThe postal address is mandatory for the receipt of loyalty cards and physical tickets (non-electronic).
Automated decision making
Some data may be processed automatically, in particular for:
Eligibility for promotions or certain benefitsPersonalization of the online personal space
The data processing concerns:
Any person who has created an online account on the Paris Opera website or through one of our applications.The person guarantees to be at least 15 years old when the account is created.Any person who has made a purchase on the Paris Opera website, via its applications, by telephone, by mail or at the box offices of the Paris Opera's theatres.
Purposes of processing
Processing of personal data is intended for the following purposes:
1. The follow-up of orders and in particular:
- Management of relations with spectators, visitors and customers, which may include telephone calls
- Management of customer files, which includes technical operations such as uniformisation, enrichment and de-duplication
- Order management and after-sales service
- Management of payments, refunds and credit notes
- Ticketing and ticketing
- Waiting list management (seat availability alerts)
- Creation of online accounts and management of their access
- Sending order-related information: performance cancellation, change of time, change of programme or cast, closure of the theatre, etc.
- Sponsorship management
- Management of unsettled ticket payments and litigation
- Management of claims
2. Depending on your choices, and subject to the registration of your agreement, the development of marketing campaigns such as:
- The sending of documents (brochures, subscriber or membership cards.)
- The sending of communications relating to programming such as the announcement of future events in connection with your order history, without this being an automated process.
- The sending of newsletters
- The creation and sending of promotional or loyalty offers. In this context, your data may be subject to automated processing or profiling in order to provide you with personalised benefits.
- The promotion of related products in connection with your order: programmes, catering, etc.
- The carrying out of surveys
- The transfer of your details to cultural partners in order for you to benefit from offers from these partners
3. The elaboration of statistics and attendance figures, such as:
- The average number of performances seen per season
- The loyalty rate of spectators and visitors
- The average price
- The geographical origin of spectators and visitors
- Age of spectators and visitors
- 4. Personalization of the website or application content
In this context, your data may be subject to automated processing or profiling in order for you to benefit from personalised advantages and personalised content on the website and the application.
The data processing carried out by the Paris Opera is based on the following articles of the General Data Protection Regulation (GDPR):
6.1.a (consent) for marketing purposes6.1.b (necessary for fulfilling a contract) for purposes relating to the processing and tracking of orders6.1.e (mission of public interest) for statistical purposes related to the public survey mission on behalf of the Ministry of Culture
Recipients of personal data
The personal data collected is destined:
1.To the various departments of the Paris Opera in charge of processing and in particular
2. To service providers acting as subcontractors as defined by the RGPD on behalf of the Paris Opera, within the framework of the aforementioned purposes (list as of May 2021, subject to change)
- Spectator experience
- Accounting agency
3. Third-party partners
- AROP: association for the promotion of the Paris Opera (sponsorship)
- Le Cercle Carpeaux: association supporting choreographic and lyrical art at the Paris Opera
- SecuTix: provider of the Paris Opera's IT ticketing solution
- Ingenico / Ogone: credit card payment provider
- KPC: provider of the Selligent marketing platform
- Selligent: publisher of the Paris Opera's marketing solution
- Comdata: call centre operator
- SPB: cancellation insurance provider
- Common Cents: service provider in charge of collecting donations
- Cultival: service provider in charge of tours of the Palais Garnier
- Arteum Services: service provider in charge of managing the theatres' shops and the online shop
- Mazarine: service provider in charge of developing the Paris Opera website and the Aria application
- TappTic: service provider in charge of developing the Paris Opera application
- Vimeo: service provider responsible for the online distribution of the Paris Opera's videos
Subject to the registration of your agreement, the data may also be transmitted to third-party partners
Transfer outside the EU/EEA
Personal data may be transmitted to SecuTix, a company established in Switzerland, which maintains and hosts the ticketing solution and acts as a subcontractor on behalf of the Paris Opera
The adequacy of personal data protection in Switzerland was recognised by Commission Decision No. 2000/518/EC of 26 July 2000.
Duration of storage
Personal data is kept for the time required to manage the commercial relationship and to compile statistics, intended in particular for the Ministry of Culture.
Personal data relating to bank cards is kept encrypted for 18 months by our payment service provider, Ingenico, in particular with the aim of facilitating reimbursements by crediting the bank card used for the purchase.
Deleting an account
After identification on www.operadeparis.fr, you have the possibility of deleting your account, in the "My details" section. By choosing to delete your account, no claim can be made in case of loss or non-receipt of your tickets.
The Paris Opera has implemented technical and logistical measures to guarantee the protection of your data, and in particular:
Data hosting locations
Your data is stored:
- on the Paris Opera's internal servers located in France
- on the servers of the service provider Secutix SA, based in Switzerland, and using the AWS services of the Amazon group whose secure data warehouses are located in Germany. This service provider is contractually bound to comply strictly with the General Data Protection Regulation (GDPR) and in particular to implement everything necessary to secure and protect your data.
Data protection measures
To secure your data, the Paris Opera and SecuTix SA, which guarantees to meet the requirements and to have obtained the certificates of compliance with the ISO/IEC 27001:2013 and PCI DSS v3.2 standards, take all the necessary technical and operational measures, in particular access controls, the use of firewalls and current anti-virus software, SSL encryption and log files during manual changes to the databases. The monetary aspect (credit card transactions) is PCI DSS certified and audited once a year.
Passwords used by the Paris Opera and SecuTix SA must meet complexity requirements to be valid.
Physical access to data warehouses is strictly controlled by codes, tracking, alarms, badges and video surveillance.
You may exercise your rights with the Data Protection Officer (DPO) and lodge a complaint, if necessary, with the Commission Nationale de l'Informatique et des Libertés (CNIL).
Identification will be required to exercise these rights. This identity document is:
- immediately deleted in the event that the Data Protection Officer is not legally competent or if the properly addressed request to the Officer did not require the transmission of an identity document;
- deleted 1 year after receipt of the request in other cases.
Under this procedure, data are kept for the calendar year of the request, plus five years.
1. Exercising your rights with the DPO
The Paris Opera's Data Protection Officer (DPO) is your contact for any request to exercise your rights.
You may contact him/her:
79 bis, avenue de l'Europe
A right to information (articles 13 and 14 of the RGPD): you may exercise your right to information in order to know what personal data is processed by the Opera, for whom this information is intended, what are the purposes of the processing, how long your data is kept and what are your rights.You have the following rights in particular:
- A right of access (article 15 of the GDPR): you may exercise your right of access to obtain the personal data concerning you. In this case, you may be asked to provide proof of identity in order to verify its accuracy.
- A right of rectification (article 16 of the RGPD): if the personal data held is inaccurate, you may request that your information be updated.
- A right to deletion or "right to be forgotten" (Article 17 of the GDPR): you can request the deletion of your personal data.
- A right to processing restrictions (Article 18 of the GDPR): you have the right to request to restrict the processing of your personal data in accordance with the assumptions set out in Article 18 of the GDPR and to provide instructions on what to do with your data in the event of your death
- A right to data portability (article 20 of the GDPR): you may ask the Paris Opera to return your data to you for transmission to a third party.
- A right to object (article 21 of the RGPD): you may object to your data being processed in accordance with the conditions set out in article 21 of the RGPD.
2. Making a complaint to the CNIL
You have the right to make a complaint to the Commission Nationale de l'Informatique et des Libertés (CNIL), in particular:
- If you believe, after contacting the DPO, that your rights regarding your data are not respected
- In the event of a violation of rights noted in the processing of your personal data.