Privacy policy

1. Data controller

The data controller is the sole trader operating Mon Auditorium (SIREN 106 953 920, see the legal notice), hereafter “we”.

For any question about your data: contact at mon-auditorium.fr, subject “GDPR”.

This is a courtesy translation. In the event of any discrepancy, the French version prevails.

2. Data collected

Identification and account

• First name, surname, email address;
• password (stored as a cryptographic hash) or Google / Apple identifier;
• profile picture, free-text biography, instruments played, musical tastes (favourite composer, period, work, performer);
• chosen interface language and cities of choice;
• notification preferences.

Anonymous session

On first launch the app opens an anonymous technical session so that the catalogue can be browsed without an account. It amounts to a technical account identifier, with no identity data at all. It becomes an ordinary account if you subsequently register.

Use of the Service

• Concerts added to your personal programme (“My Season”) and their status;
• declared tickets and their seating;
• favourites (artists, works, composers, halls, venues, concerts);
• concerts placed under availability watch;
• the content of error reports you submit;
• La Loge subscription status (plan, dates, state) and a technical subscriber identifier. No payment card data ever reaches us: payment is processed by Apple or Google.

Technical data

• Device identifier for push notifications (OneSignal);
• installation identifier: a random identifier, created on your device, unrelated to your identity or to any advertising identifier. It is used solely to count free uses of La Loge features so that they cannot be renewed indefinitely. It is kept in the system keychain (iOS) or the app’s preferences (Android) and may therefore survive an uninstall; it is never transferred between devices, and it can under no circumstances be used to recover or open a session;
• application crash reports (Firebase Crashlytics);
• server technical logs (timestamp, route called, response code, IP address), for diagnosis and security;
• local preferences stored on the device (theme, text size, search history);
• website only: IP address, browser type, pages visited, in aggregate form (see §7).

3. Purposes and legal bases

No decision producing legal effects is taken by automated means, and your data is subject to no advertising profiling.

4. Retention periods

• Account data: for as long as the account exists, then deleted or anonymised within 30 days of the account’s deletion, subject to the legal periods below.
• Inactive anonymous session: deleted after 12 months without use.
• Declared ticket data: 2 years after the concert date.
• Subscription status: for the duration of the subscription, then 3 years for evidential purposes; the related accounting records are held by Apple and Google.
• Installation identifier: 24 months after the last counted use.
• Technical logs: 12 months.
• Website browsing data: 13 months at most (CNIL recommendation).
• Contact-form messages: 3 years after the last interaction.

5. Recipients and processors

Your data is never sold, rented, or passed to brokers or advertising networks. It is shared only with the technical providers necessary to run the Service, each acting as a processor or joint controller for its own part:

Transfers to providers established outside the European Union are covered by the European Commission’s standard contractual clauses or by a recognised adequacy mechanism.

Your data may also be disclosed to the competent authorities where the law requires it.

6. Your rights

Under the General Data Protection Regulation (EU 2016/679) you have the rights of access, rectification, erasure, portability, objection and restriction, as well as the right to withdraw your consent at any time where processing rests on it.

Two of these rights can be exercised directly in the app, without writing to us: rectification (your profile) and erasure (Settings → Privacy & security → Delete my account).

For the others, write to contact at mon-auditorium.fr. We reply within one month. Should you disagree, you may lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or with the authority of your country of residence.

7. Cookies and trackers

The Mon Auditorium app uses no cookies at all. It keeps local preferences on your device (session, theme, text size, search history) and the installation identifier described in §2.

The mon-auditorium.fr website uses:

• cookies strictly necessary to its operation, which require no consent;
• ma_cookie_consent: records your acceptance or refusal, stored locally, until erased;
• Google / Firebase Analytics audience-measurement cookies, set only after your explicit agreement through the banner shown on your first visit.

No advertising cookies, no sharing with any ad network. You can change your mind at any time by clearing your browser’s cookies for this site: the banner will reappear.

8. Security

• Encrypted communications (HTTPS / TLS);
• hashed passwords;
• restricted and logged database access;
• regular encrypted backups;
• separation of administrative roles in the back office.

In the event of a data breach likely to result in a high risk to your rights, you will be informed as soon as possible, in accordance with article 34 GDPR.

9. Changes to this policy

We may amend this policy. In the event of a substantial change you will be informed by email or by notification in the app, at least 30 days before it takes effect. The version in force is always available at mon-auditorium.fr/en/privacy.html.

10. Contact

For any question about this policy or your personal data: contact at mon-auditorium.fr, subject “GDPR – [your request]”.