Data Protection Policy
The Centre National de la Musique (CNM) is committed to ensuring that the processing of your personal data, carried out as part of its activities, complies with European Regulation No. 2016/679, known as the General Data Protection Regulation (GDPR), and the French Data Protection Act (Informatique et Libertés).
In this Data Protection Policy, we explain how and why we use your personal data, what your rights are, and how you can exercise them.
Who is this Data Protection Policy intended for?
This policy aims to inform:
- Users of the services provided by the CNM;
- Visitors to the website accessible at https://whatthefrance.org;
- CNM customers and prospects.
This data protection policy only concerns processing activities for which the CNM acts as the data controller.
1 – What data do we collect?
CNM may collect personal data directly from you or indirectly.
- When you use our services, including when you visit our website and you use our services, you may be required to provide certain information that’s constitutes personal data.
- We may also automatically collect technical data when you use ours services or visit our website.
In accordance with the principle of data minimization, we only collect data necessary for the purposes for which it is processed.
The different categories of data collected by the CNM are as follows:
1. For users of our services:
| Data categories | Data |
| Identification and login data | Name First name Email address |
| Personal life data | Gender Disability |
| Professional life data | Email address Phone number Company name Rôle in the company Activity information |
| Connection and navigation data on the platform | Identifiers, hashed passwords IP addresses Logs Functional cookies |
| Economic and financial data | Income information (pay slip) Tax information Budget Legal declarations (URSSAF, …) |
| Banking data | Bank details Payment methods |
| Contractual data | Contracts related to artistic activities |
| Data necessary for subscription to CNM services | Contract number Contract opening date Effective date End date (if applicable) |
| Contact and interaction data with CNM | Messages Emails Calls Interactions on our site |
- For website visitors:
| Data categories | Data |
| Identification and contact data | Name First name Email address Phone number |
| Connection and navigation data on the site | Identifiers, hashed passwords IP addresses Logs Functional cookies |
| Contact and interaction data with CNM | Messages Emails Calls Interactions on our site |
- For prospects and/or customers (manly for CNM Boutique) :
| Data categories | Data |
| Identification data | Name First name Phone number Email address Postal address |
| Professional data life | Email address Phone number Company name |
| Banking data | Bank details (RIB) Payment methods |
| Contact and interaction data with CNM | Messages Emails Callss |
2- What is the purpose of using your data?
Your personal data is collected and processed only based on the legal grounds provided by the regulations:
- Contract performance: the processing is necessary for the performance of a contract or with a view to concluding a contract (article 6.1.b of the GDPR);
- Legal obligation: the processing is carried out in accordance with a legal obligation to which the CNM is subject (article 6.1.c of the GDPR);
- Legitimate interest: the processing enables the realization of a mission related to the CNM’s activity, and the persons concerned can expect such processing to be carried out with their data (article 6.1.f of the GDPR);
Processing activities that do not fall within one of the three cases mentioned above are subject to a request for consent at the time of data collection. This consent is obtained freely and in an informed manner.
Your personal data is therefore collected to ensure:
- For users of the services:
| Purposes | Categories of data processed | Legal Basus |
| Management of user accounts | Identification data Connection data | Contract performance (art. 6.1.b GDPR) |
| Management of authentication and security | Identification data Connection data Navigation data | Legitimate interest (article 6.1.f GDPR) – Platform and data security Legal obligation (article 6.1.c GDPR) – Compliance with cybersecurity regulations |
| User support and assistance | Identification data Data necessary for request management | Contract performance (article 6.1.b GDPR) – Assistance and support related to the use of the platform |
| Administrative and contractual management of users | Identification data Personal life data Professional data Banking data | Contract performance (article 6.1.b GDPR) – Management of paid services Legal obligation (article 6.1.c GDPR) – Billing and accounting obligations |
| Management of financial aid requests | Identification data Professional life data Professional data Economic and financial data Banking data Contractual data Data necessary for subscription to CNM services | Contract performance (article 6.1.b GDPR) – Request management Legal obligation (article 6.1.c GDPR) – Billing and accounting obligations |
| Proceeding with payments | Banking data | Contract performance (article 6.1.b GDPR) – Payment for subscribed sevices |
| Newsletter subscription | Identification data Professional life data | Contract performance (article 6.1.b GDPR) – Newsletter subscription and management |
| Registration for training | Identification data Professional life data | Contract performance (article 6.1.b GDPR) – Registration and management of training |
| Registration for trade shows or events | Identification data Professional life data | Contract performance (article 6.1.b GDPR) – Registration for events |
| Service What the France | Identification data Connection and navigation data on the platform | Legitimate interest (article 6.1.f GDPR) – Access and maintenance of the platform |
- For website visitors:
| Purposes | Categories of data processed | Legal basis |
| Management, administration, and improvement of the website | Navigation data Connection data | Legitimate interest (article 6.1.f GDPR) – Improvement of services and user experience |
| Contact with the CNM | Identification data Data necessary for the implementation and management of the request | Legitimate interest (article 6.1.f GDPR) – Platform and data security |
| Management of authentication and security | Identification data Connection data Navigation data | Legitimate interest (article 6.1.f GDPR) – Platform and data security Legal obligation (article 6.1.c GDPR) – Compliance with cybersecurity regulations |
- For customers and prospects:
| Purposes | Categories of data processed | Legal basis |
| Purchase of CNM products | Identification data Banking data | Contract performance (art. 6.1.b GDPR) |
| Contact with the CNM | Identification data Data necessary for the implementation and management of the request | Contract performance (art. 6.1.b GDPR) |
| Marketing operations | Navigation data Connection data | This processing is based on your consent, where required. |
| Management of handling claims and legal disputes | Identification data Personal life data Economic and financial data | Legal obligation (article 6.1.c GDPR) – |
3- How long is your data kept?
We only keep your data for the time necessary to fulfill the purposes mentioned above or to enable us to meet our legal obligations.
The CNM is committed to deleting data once the defined retention period has been reached.
4 – Who processes your data?
Your personal data may only be processed by authorized CNM personnel.
No third parties or subcontractors can access your personal data, except where legally required to disclose it to competent authorities.
If The CNM uses partners or service providers, it will ensure they commit to implementing the necessary technical and organizational measures to protect personal data in compliance with legal requirements.
5 – What security four your data?
We have implemented technical and organizational measures appropriate to the nature of the data, the scope of processing, and data accessibility to protect your information.
All our staff members are committed to respecting the security and protection of your data.
CNM also commits to limiting data transfers outside the European Union. In cases where such transfers occur, CNM will implement safeguards, including the use of European Commission Standard Contractual Clauses.
Moreover, personal data protection requirements are incorporated at the outset of any new projects, developments, or IT environment changes.
Prior to any processing operations that could pose a risk to individuals’ rights and freedoms, CNM will conduct a Data Protection Impact Assessment (DPIA).
6 – What are your rights?
You have the following rights concerning your personal data:
- Right of access: To obtain confirmation that your personal data is or is not being processed and, where it is, the right to access such data;
- Right to rectification: To request the correction or completion of your data;
- Right to erasure: To request the deletion of your data (except when CNM has a legal obligation to retain it)
- Right to data portability: To recover and transfer your data to another data controller;
- Right to restriction of processing: In certain cases provided for by law, to obtain the restriction of the processing of your data;
- Right to object: To object at any time to processing of your personal data for direct marketing purposes;
- Right to information: To be informed of any data breach likely to result in a high risk to your rights and freedoms.
7 – How to exercise your rights ?
You can exercise your rights through the following link: Rights Exercise Form
or by sending an email to: contact-dpo@cnm.fr
The CNM will ensure that you receive a response within one month of receiving the request. In some cases, due to the complexity of the request or the number of requests, this period may be extended by two months.
If you believe your rights have not been respected, you have the right to lodge a complaint with the French data protection authority (CNIL) via its website: www.cnil.fr.
8 – Contact us regarding data protection
For any questions about this Data Privacy Policy, please contact CNM by email at: contact-dpo@cnm.fr
Last updated: 2025/04/29
