The Muséum national d’Histoire naturelle’s personal data protection policy

1 — The role of the Muséum in the protection of your personal data

At the Muséum national d'Histoire naturelle, we take care of your data!

This policy presents, in a single document, clear and simple information concerning the data processing carried out by the Muséum on the following websites:

It will help you to better understand the types of personal data that are collected by the Muséum, and their use, with due regard to your rights.

The Muséum undertakes to protect your private life in accordance with the current legislation, by ensuring the protection, confidentiality, non-alteration, availability and security of the personal data you entrust us with.

The Data controller is the Muséum national d'Histoire naturelle, represented by its President. It is a scientific, cultural and professional public institution with headquarters at 57, rue Cuvier in Paris 05.

2 — The main principles

The Muséum undertakes to apply the following principles to ensure that fundamental rights are respected:

Transparency: we provide you with all the useful information on the processing of your data, including the purposes they is used for and the recipients;
Data minimisation: we only collect and process data that is appropriate, relevant and not excessive in relation to the purposes for which it was collected;
Confidentiality and integrity: we implement all the reasonable technical and organisational measures to protect your personal data against disclosure, loss, alteration or access by an unauthorised third party;
Retention: we keep your personal data for only as long as is necessary for the purposes of processing or for the specific service;
Protection of your rights: we offer you the possibility to access, modify and oppose to the processing of your data. Where permitted by law, we also offer you the possibility to exercise your data processing limitation right and your data portability right;
Commitment of our partners: the operations for which we call upon specialist partners are subject to a contract in order to ensure the protection of your data and your rights.

1.1 On what occasions does the Muséum collect your personal data?

Your data may be collected when:

You browse one of the Muséum’s websites;
You ask a question via the “Contact us” form;
You subscribe to the Muséum’s newsletter and news;
You make a venue hire request;
You make a request for filming or photography;
You participate in an event organised by the Muséum;
You make a request to exercise your rights.

1.2 What personal information is collected by the Muséum?

Persona data is any information relating directly or indirectly to an identifiable natural person.

The Muséum collects information that is strictly necessary for the provision of its services. This information is indicated by an asterisk and generally includes your surname, first name, postal address, email address, fixed or mobile telephone number, date of birth, and subscriber card number.

In accordance with the law, the Muséum does not collect Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or sexual life or sexual orientation of a natural person.

The Muséum takes great care to protect and respect the rights of individuals as regards their personal data, particularly in the case of persons aged 13 and under.

In this case, the consent of their parents or legal representatives is required.

3 — How does the Muséum use your data?

Your personal information is collected for the purposes detailed below.

Some information (indicated by an asterisk) is mandatory to benefit from the service concerned. If this information is not provided, the Muséum will not be able to provide you with this service.

The data retention time limits are defined by the Muséum with regard to the legal and contractual constraints. These time limits are set according to the purposes of the processing concerned. After this time limit, the data is either deleted or kept after being made anonymous, that is to say, modified so as to render its attribution to a person definitively impossible.

Contact us

Purposes	Responding to your queries and complaints, via the “Contact us” form or similar forms
Legal basis	Legitimate interest
Processed data and retention period	Surname, first name, email address, telephone number, report of discussions and complaints
Recipients	Digital Contents service, authorised officials from the Museums, Gardens and Zoos management team, the Development management team and the Audiences management team.

Management of newsletters and news

Purposes	Sending the Muséum’s news and newsletters to the subscribers
Legal basis	Legitimate interest
Processed data and retention period	Surname, first name, email address, telephone number, report of discussions and complaints
Recipients	Digital Contents service

Venue hire request

Purposes	Processing your venue hire requests
Legal basis	Contract
Processed data and retention period	Surname, first name, email address,* telephone number Retention period: 3 years following the last incoming contact
Recipients	Digital Contents service, authorised officials from the Development management team

Request for filming or photography

Purposes	Processing your requests for filming or photography
Legal basis	Contract
Processed data and retention period	Surname, first name, email address,* telephone number Retention period: 3 years following the last incoming contact
Recipients	Digital Contents service, authorised officials from the Development management team and Communications management team

Management of events organised by the Muséum (game contests, etc.)

Purposes	Organising the event and contacting the winner(s)
Legal basis	Consent
Processed data and retention period	Surname, first name, email address,* telephone number, date of birth, postal address Retention period: until the random draw for the game contest is held and up to one month after the last prize has been awarded for the winners
Recipients	Digital Contents service, authorised officials from the Audiences management team

Website improvement

Purposes	Enable the Muséum to develop, exploit, improve, host and manage the Website and improve your user experience
Legal basis	Legitimate interest (economic interest in continuously improving its Website and its services and in understanding your needs to meet your expectations)
Processed data and retention period	URL path (the path you take through the Muséum websites), the services visited, connection times, etc. IP address, connection information, browser type and version, time zone setting, type of browser plug-ins, geolocation information, operating system version (12 months) Retention period: 13 months
Recipients	Digital Contents service, DINSI, IT service providers

Management of requests to exercise rights

Purposes	Allowing you to exercise your rights on your personal data
Legal basis	Legal obligation
Processed data and retention period	Content of exchanges, surname, first name, e-mail address, proof of identity (exceptionally if we have no other means of identifying you, which will be deleted as soon as your identity has been verified), copy of requested data. This data will be kept for a period of 6 years after the request has been processed, for evidence purposes and to defend the Museum's interests.
Recipients	Digital Contents service, Data Protection Officer

Legal or regulatory requirement

The Muséum may be required to communicate your personal data in the event of lawful requests by public authorities, notably to meet requirements in terms of national security, combatting fraud, or another legal obligation.

4 — Security and confidentiality of personal data

The Muséum national d’Histoire naturelle commits to undertake all the measures necessary to guarantee the security and confidentiality of the personal data, and particularly to prevent it from being damaged, deleted, or accessed by unauthorised third parties.

5 — Rights of persons whose data is collected and processed

It is expressly agreed that the personal data collected by the Muséum national d’Histoire naturelle is used in accordance with the purposes described in the present personal data protection policy.
In accordance with the applicable regulations in the area of personal data protection, and subject to fulfilling the conditions, you have a right of access, rectification and opposition for a legitimate reason (except as regards prospecting, where it is not necessary to give a reason), and where permitted by law, of limitation, portability and deletion of the personal data concerning you. You may also at any time formulate instructions regarding the retention, deletion and communication of your personal data after your death.

These rights may be exercised at any time, provided that you provide proof of identity via an authentication space when this is possible, or by sending a copy of a currently valid identity document.
Should you wish to receive further information on the content of these rights, you may contact the Muséum’s data protection officer at the address dpo [@] mnhn.fr.
The Muséum will respond to your requests to exercise rights as soon as possible and, in any event, within one month of receipt of such requests.

If you are experiencing difficulties in managing your personal data, you may file a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés - CNIL).

6 — Turning this policy into a success

This policy is designed to be as transparent and useful as possible. Please consult our Data Protection Policy regularly to ensure you are familiar with the most recent version. If significant amendments are made to the present policy, a notification will be made by posting a notice on the website.

Last update — 04/10/2021