Privacy policy

The data controller is the association ORGUE VIVANT, a registered non-profit association governed by the French law of 1 July 1901, with its registered office at 19 Parvis Saint-Maurice, 59800 Lille, France.

Any question regarding this policy or the exercise of rights may be sent to contact@orguevivant.fr.

Contact form — Data: name, email address, content of the message. Purpose: replying to requests sent to the association. Legal basis: the association's legitimate interest in replying to those who contact it (Article 6(1)(f) GDPR). The message is forwarded by email to the association.

Newsletter — Data: email address, subscription and confirmation dates. Purpose: communicating concert dates, scheduled artists and festival news. Legal basis: the data subject's consent (Article 6(1)(a) GDPR), given through a subscription confirmed from their mailbox. Consent may be withdrawn at any time via the unsubscribe link in every mailing; the address is then deleted without delay.

Musical Moments — Data: for the people who sign musicians up from the space reserved for teachers, first name, last name, email address, conservatoire (optional) and date of last visit; for each musician signed up, first name, last name and instrument, as well as the programme of the session and, when the association makes the sign-up itself, the email address of the person signed up. Information about the musicians is provided by the person who signs them up. Purpose: organising the Musical Moments and publishing their schedule. Legal basis: the association's legitimate interest in organising its musical activity (Article 6(1)(f) GDPR); publishing each musician's first name and last-name initial relies on their agreement or, if they are a minor, their parents' agreement, as attested by the person making the sign-up. Only the date and time of the session, the musicians' first names and last-name initials, their instruments and the programme are published on the Site and in its calendar; full names and email addresses never are.

Photographs — Data: photographs taken at concerts and rehearsals, and their captions. Purpose: showing the association's activity in the Site's Photos section. Legal basis: the association's legitimate interest (Article 6(1)(f) GDPR) and the agreement of the musicians photographed. Published photographs, downloadable at full resolution, do not contain the location where they were taken. Anyone who appears in a photograph may ask for its removal at contact@orguevivant.fr; it is then removed without delay.

Audience measurement — Data: number of visits and pages viewed, measured with Vercel Web Analytics. No cookie or identifier is placed on the user's device; the data is aggregated and cannot track a person across sites. Legal basis: the association's legitimate interest in knowing the Site's audience. This mechanism does not require the user's consent.

Technical logs — Data: IP address and requests, recorded by the host. Purpose: security and proper operation of the Site. Legal basis: legitimate interest.

Data is neither sold nor disclosed to third parties for commercial purposes. It is processed on behalf of the association, under a contract compliant with Article 28 GDPR, by the following processors:

• Vercel Inc. (United States) — hosting of the Site and audience measurement
• Supabase Inc. (United States) — database and file storage, hosted in London (United Kingdom)
• Resend Inc. (United States) — email delivery: newsletter, subscription confirmation, contact form messages, Musical Moments emails; Resend keeps a copy of the emails sent in its sending log

The texts of concerts and news items, including artists' names and biographies, are also sent for automatic translation into English to the MyMemory service of Translated S.r.l. (Italy).

The United Kingdom benefits from an adequacy decision of the European Commission within the meaning of Article 45 GDPR.

Vercel Inc., Supabase Inc. and Resend Inc. are companies established in the United States. The processing they carry out, including any access to the data from the United States, is governed by the standard contractual clauses adopted by the European Commission, provided for in these providers' data processing agreements, in accordance with Article 46 GDPR.

• Contact form messages: one year from the last exchange
• Newsletter: until unsubscription; an unconfirmed subscription is deleted after thirty days
• Musical Moments: teachers' records kept for the duration of the collaboration, then deleted on request; sessions kept as an archive of the programme
• Copies of emails in Resend's sending log: the limited retention period of that log set by the provider
• Audience measurement: aggregated data, no individual identifier
• Photographs: while the album is online, or until a removal request
• Technical logs: a few days

The Site only places cookies strictly necessary for its operation, exempt from consent under Article 82 of the French Data Protection Act:

• i18n_redirected: stores the chosen language (duration: one year)
• ov_moments: keeps access to the space reserved for Musical Moments teachers (duration: one year)
• sb-…-auth-token: session of the Site's administrators (duration: eight hours)

Videos: a concert's teaser is hosted by YouTube (Google Ireland Limited). Nothing is sent to YouTube until you open the video by clicking the “Teaser” bubble. Once opened, it plays in privacy-enhanced mode (youtube-nocookie.com); YouTube may then collect browsing data and use your browser's storage, under its own privacy policy.

No advertising, audience-measurement or tracking cookie is used, so no consent banner is displayed.

The association implements appropriate technical and organisational measures to ensure the security and confidentiality of data: encryption of communications (HTTPS), restricted access to the database, protection of forms against automated submissions, and reliance on providers offering sufficient guarantees.

In accordance with Articles 15 to 22 GDPR, every person has the right to access, rectify and erase their data, the right to restriction of processing, the right to object and the right to data portability, as well as the right to withdraw consent at any time for processing based on it.

These rights may be exercised by email at contact@orguevivant.fr. The association replies within one month of receiving the request and may, in case of reasonable doubt about the applicant's identity, request supporting evidence.

Anyone who considers that their rights are not respected may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

The association reserves the right to amend this policy to reflect changes to the Site or to the applicable regulations. The applicable version is the one published on the Site; its update date appears below.