Personal data protection

PERSONAL DATA PROTECTION CHARTER

OL GROUPE

OL GROUPE is a major player in the sports, entertainment and media industry in France. Its activity and that of its subsidiaries is mainly centred on the Olympique Lyonnais football club, and on the development of infrastructures and reception facilities for sports and cultural events and the marketing of related rights. In this context, OL Groupe owns several infrastructures including the Groupama Stadium, the Groupama OL Training Center, the LDLC Arena and the OL Academy.

Eager to protect the privacy of its users and customers, OL Groupe has taken steps to comply with the General Data Protection Regulation (GDPR), which came into force on 25 May 2018, and the Regulation. This document describes the measures taken by OL Groupe to protect the personal data we collect.

OL Groupe recommends that you read this document carefully and regularly check for changes. These changes are made without prior notice and published online.

This document was last modified in October 2022.

If you have any questions about our policy or the processing of your personal data, please contact us at the following address: [email protected]

1. DATA COLLECTED

The OL Group may collect some of your personal data mainly within the framework of our commercial relationship, and in particular during :

  • your online purchases of our products and services (merchandising, ticketing, etc.) ;
  • visiting or using our online services (ol.fr, olvallee.fr, mobile club and ol vallée applications, forum, WIFI service);
  • your membership of our loyalty and MYOL cashless card programme;
  • your contacts with our customer service department;
  • your participation in marketing operations such as contests or satisfaction surveys.

The OL Group undertakes to specify which data is necessary and/or optional for the proper functioning of the service, each time your data is collected.

The majority of data that is processed is :

  • Data enabling you to be identified:
    • The connection identifiers;
    • Surname and first name;
    • Date of birth;
  • Contact data:
    • Postal address;
    • E-mail address.

Other data that may be collected for specific services will be named explicitly in clear statements when collected.

  • Data related to operations carried out on our sites:
    • Products and tickets purchased,
    • The type of subscription,
    • Purchase history.
  • Data related to payment transactions:
    • Bank details and information relating to the transaction carried out
  • Opinions and comments on our sites

Some personal data is also collected automatically after using one of our services. These are :

  • IP address and device identifiers
  • Technical data relating to the browser or device (name, operating system of your device, preferred language)
  • Authentication data (login and usage logs, IP address, unique identifier)

We also have information on the persons designated as beneficiaries of access to a sports event or an event organised by Olympique Lyonnais or hosted in its facilities.

2. SPECIFICITY OF COOKIES

This policy (hereinafter the "Policy") aims to inform you about the way in which we, as data controller, collect your Personal Data by means of cookies present on our Website.

WHAT IS A COOKIE?

A cookie is a small text file deposited on a terminal when visiting the Site. OL Groupe uses cookies in order to

  • Adapt the content and display of our Service to your terminal in order to improve your browsing experience;
  • Remember information related to a form already filled out, or related to products, services or information of our Service;
  • To personalise our content and advertising according to the User's interests;
  • To establish statistics and audience measurements on the use of our Site
  • To carry out sharing on social networks;
  • To optimise the distribution and evaluate the effectiveness of the advertising messages we send.

WHAT DATA DO WE COLLECT?

All data relating to a terminal at a given moment is collected via cookies, and in particular

  • The identification and content of a cookie file stored by us, our subcontractors, our partners or third party social network publishers in your terminal;
  • The IP address of the terminal
  • Your mobile identifiers used for advertising
  • The date, time and duration of a terminal's connection to an element of the service
  • The language of the browser software used by the terminal
  • The Internet address of the page from which the terminal accesses the Service
  • The type of operating system of the terminal
  • The type and version of the browser software used by the Terminal
  • The characteristics of the content consulted or shared
  • Any information on transactions carried out or initiated

WHAT TYPES OF COOKIES DO WE USE?

We use cookies to collect information on the Users of our Site, in order to memorise them either for the duration of your visit (so-called "session" cookies) or for repeated visits (so-called "persistent" cookies).

There are also so-called "third-party" cookies and so-called "proprietary" cookies. A proprietary cookie is the one installed by the website that the User is visiting. Conversely, a third-party cookie is a cookie installed by a domain other than that of the website the User is visiting.

Thus, when a User visits a website or platform, and another entity sets a cookie through that website or platform, the cookie is a third-party cookie.

We use several types of cookies on our Site, the characteristics of which are described below.

HOW TO MANAGE YOUR COOKIES?

With regard to the deposit of cookies strictly necessary for the operation of our Site, these are activated by default and do not require your consent. However, you can find information about these cookies on our CMP or in this Policy. The lifetime of these cookies is limited in time to thirteen (13) months, and is not automatically extended on new visits. You may modify these cookies on our site in the "Cookie Settings" tab in order to choose among the three types of cookies that OL Groupe may use (technical cookies (mandatory for the proper functioning of the site), performance and tracking cookies, advertising tracking cookies). Other cookies are subject to your consent. You may therefore consent to the deposit of these cookies, or refuse them, from the CMP at the bottom left of your screen, which is available at any time during your visit to our Site.

SET YOUR BROWSER SETTINGS:

If you are browsing on Google Chrome: you can manage your settings via the following link https://support.google.com/chrome/answer/95647?hl=en

If you are using Safari : : you can manage your settings via the following link : https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

If you are using Firefox: you can manage your settings via the following link: https://support.mozilla.org/fr/kb/options-preferences-parametres-firefox#w_panneau-vie-privee-etsecurite

If you are using Internet Explorer, you can manage your settings via the following link: https://support.microsoft.com/en-us/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16- ede5947fc64d

3. PURPOSES OF DATA PROCESSING

The purposes for which your data is processed include

  • Customer account management;
  • Management of the loyalty programme;
  • Offering our services, processing your purchases, allowing you access to our facilities, delivering your orders (tickets or products);
  • Communicating with you about information relating to purchases and the event you are attending (changes to dates/times, access arrangements, etc.);
  • Commercial prospecting, in particular through competitions;
  • Carrying out commercial and marketing analyses and statistics, and developing steering, measurement and reporting tools;
  • Suggesting complementary or promotional offers in a marketing context or displaying relevant and targeted advertising based on previous behaviour or any other useful information;
  • Identifying and correcting bugs that may occur on our sites in order to ensure their proper functioning;
  • Improving your customer experience online and at our operating sites by learning more about our customers through data analysis so that we can tailor our products and services to meet your needs;
  • To ensure that you can exercise your rights.

We also process your data, within the limits and in compliance with the provisions of Article L. 332-1 of the French Sports Code, to ensure the safety of sporting and commercial events by refusing or cancelling, where applicable, the issue of access tickets or access to persons who have contravened or are contravening the provisions of the general terms and conditions of sale or of the internal regulations relating to the safety of these events.

The purposes of each processing operation are exhaustively specified in special notices.

The OL Group undertakes not to use your personal data for any other purpose than the one specified.

4. DATA RETENTION PERIOD

The OL Group has defined a retention period for personal data for each processing operation in a register of its processing operations. The retention period does not exceed the period necessary for the purposes for which the data is processed.

The length of time your data is kept is specified with the category of data and the purposes for which it is processed by the OL Group.

5. RECIPIENTS OF YOUR DATA

The OL Group has a strict management of access to your data. Thus, only the personnel whose functions require the use of your data are authorized to consult the personal data you have entrusted to us.

In cases where the OL Group has hired a subcontractor to process personal data of users and clients on its behalf, the OL Group ensures that the subcontractor presents sufficient guarantees as to the implementation of appropriate technical and organizational security measures so that the processing meets the requirements of the GDPR and guarantees the protection of your rights.

The OL Group may transfer your personal data to :

  • service providers insofar as they are involved in the provision of a product or service, such as postal and delivery services;
  • payment service providers who handle payment transactions and appropriate controls;
  • third parties providing IT services to us, such as platform providers, hosting services, technical support for our software and applications that may contain your data, data analysis, email distribution;
  • service providers associated with the organisation of events organised by or in our facilities, including those responsible for access and security in the Groupama Stadium and LDLC Arena;
  • the administrative, judicial and supervisory authorities, when such communication is required by law.

On the other hand, no data concerning you will be transferred to partners for marketing or commercial prospecting purposes without your consent.

6. PARTICULARITY OF MINORS

The OL Group is convinced that the data of minors must be subject to special protection, and therefore implements more advanced security mechanisms for them.

We encourage parents to make their children aware of the protection of their privacy and the way they communicate on the Internet.

In addition, we comply with the relevant legal provisions and do not allow children under the age of 16 to register on our sites and applications.

In order to protect minors as much as possible, they cannot buy tickets on their own, and a child ticket must be purchased with an adult ticket.

7. VIDEO SURVEILLANCE PROCESSING

All of Olympique Lyonnais' establishments are placed under video surveillance, in the legitimate interest of security, as indicated by signage on all sites (including the stadium, the training centre, the academy, the shops, and in the future the LDLC Arena).

This system has been subject to prior prefectural authorisation.

The joint managers of this processing are, depending on the sites concerned

  • OL Groupe and Olympique Lyonnais SASU
  • OL Groupe and OL Association
  • OL Group and OLVA SAS

The image of all visitors to the above-mentioned sites, as well as OL employees, may therefore be captured by this system.

The purpose of this system is to protect property and people and the images are kept for 15 days.

The images can only be viewed by authorised personnel from the OL GROUPE security department and by the police. Finally, the company's staff in charge of maintaining the video protection equipment may also have access to the images, for this sole purpose.

Nevertheless, in the event of an incident, the video surveillance images may be used in the event of criminal proceedings and/or in the event of a stadium ban club sanction within the limits of the legislation and regulations in force. The images may then be extracted from the system and stored on another medium for the time required to settle the proceedings relating to this incident and be accessible only to persons authorised in this context, in particular within the stadium's security department.

In accordance with the legislation in force, you may access the data concerning you or request their deletion. Under certain conditions, you also have the right to object to and limit the processing of your data. If applicable, you have the right to give us instructions to organise the fate of your data after your death, and the right to lodge a complaint with a supervisory authority such as the CNIL online or by post.

To exercise these rights or if you have any questions about the processing of your data under this scheme, you can contact our Data Protection Officer (DPO) at [email protected]

8. TRANSFER OF YOUR PERSONAL DATA OUTSIDE THE EU

Your data may be processed outside the European Union. In this case, we take the necessary measures with regard to our service providers to guarantee an adequate level of protection of your data in full compliance with the regulations in force.

If the service providers concerned are not located in a country whose legislation is considered to offer adequate protection, they will have signed the European Commission's standard contractual clauses beforehand so that the level of protection guaranteed by the regulations in force is not compromised.

9. YOUR RIGHTS

In accordance with the French "Informatique et Liberté" law in force and the European regulations concerning the protection of personal data, you have the following rights

  • Right of access: allowing you to obtain information concerning the processing of your personal data and a copy of it;
  • Right of rectification: allowing you, if your data is inaccurate, to request that it be amended
  • Right to erasure: allowing you to have your data erased or deleted
  • Right to portability: allowing you to obtain an electronic copy or transfer of your data from our database to another;
  • Right to object on legitimate grounds;
  • Right to restrict processing: allowing you to request the restriction of the processing we carry out on your data.
  • Right to withdraw your consent where appropriate;
  • The right to set out instructions on what to do with your personal data in the event of your death.

These requests can be made by e-mail to [email protected] or by post to the attention of the DPO of Olympique Lyonnais Groupe, 10 Avenue Simone Veil 69150 Décines Cedex, accompanied by a copy of an identity document.

If you have an OL client account, you may also access, modify, correct or delete your personal data directly via the "My OL Client Area" page of your account (https://auth.ol.fr/Account/Login). In this space, you may also modify your consent to receive communications and/or offers from OL and its partners.

The OL Group undertakes to respond to your request within a maximum of one month after receipt. If your right cannot be exercised, the OL Group will inform you of the reasons within a maximum of one month.

Furthermore, any message sent to you includes the option (notably by clicking on a hypertext link) to oppose the further processing of your data for commercial purposes. Finally, you are reminded that you have the right to lodge a complaint with a supervisory authority and in particular with the CNIL (https://www.cnil.fr/fr/plaintes).

10. SECURITY MEASURES

The OL Group has put in place security measures to protect your personal data as much as possible against accidental or illicit destruction, accidental loss, alteration, distribution or unauthorized access to your data. access to your data.

These security measures are furthermore reinforced when the OL Group processes data

considered sensitive. As the security of your data is a priority, the OL Group undertakes to comply with the security standards security standards in accordance with the regulations.

11. GLOSSARY 

"Collecting" means collecting personal data. This collection may be done, for example, by means of questionnaires or online forms.

"Consent" means any free, specific, informed and unambiguous expression of will by which you agree, by a declaration or by a clear positive act, that personal data concerning you may be processed.

"Minor" is a child or adolescent who has not reached the age of 16. A minor is subject to parental authority; he or she does not have all the rights of an adult and cannot exercise the rights he or she holds.

"OL Groupe" means Olympique Lyonnais Groupe, a public limited company with a board of directors, registered with the Lyon Trade and Companies Register under number 421 577 495, whose registered office is located at 10, avenue Simone Veil - 69150 DECINES Cedex, as well as :

(i) any profit-making entity controlled by the Olympique Lyonnais Groupe, the term "control" having the meaning given to it in Article L.233-3 of the French Commercial Code,

(ii) any non-profit entity (association, foundation, endowment fund, etc.) of which Olympique Lyonnais Groupe or one of the entities it controls is a member, director or officer,

(iii) OL Association whose relationship with Olympique Lyonnais is defined under the terms of an agreement entered into pursuant to Article L.122-14 of the French Sports Code.

"Regulation" means, for the purposes of this Code, all the regulations in force applicable to the processing of personal data and, in particular, the RGPD as defined in the introduction, Law 78-17 of 6 January 1978 relating to information technology, files and freedoms as amended by Law 2004-801 of 6 August 2004 relating to the protection of individuals with regard to the processing of personal data, as well as Law 2018-113 of 14 May 2018 relating to the protection of personal data.

"Sub-processor" means the natural or legal person, public authority, service or other body that processes personal data on behalf of the controller.