Updated in February 2026.
1. Who is the Data Controller?
The data controller is:
Association de gestion du Festival d'Avignon
20 rue du Portail Boquier 84000 Avignon FRANCE
Data processing is carried out in connection with:
– browsing or purchasing on the festival-avignon.com website
– online and in-person ticketing (by telephone or at a point of sale)
– sending information and communications (newsletter subscription)
– recruiting seasonal and freelance staff
– implementing the sanctions protocol under the Festival d'Avignon audience charter: only the information necessary to monitor sanctions and reports, in compliance with the applicable legal framework, is processed. Access is restricted to authorised personnel only.
2. What Data is Collected?
Personal data is collected directly from data subjects or indirectly during browsing on the website.
Data collected directly
When creating an account, purchasing tickets or merchandise, subscribing to the newsletter, or submitting a job application, the following categories of data may be collected:
Identification data: last name, first name, title, postal address, postcode, city, country, email address, telephone numbers.
Login data: login ID (email address), encrypted password.
Transaction data: event, date, seat, price, number of tickets or items, purchase history, transaction ID, payment status, invoices issued.
Data relating to price eligibility documentation: documents submitted to qualify for specific rates.
Application data: contact details, professional background, qualifications, certifications, availability, skills, cover letter, curriculum vitae.
Certain additional information (e.g. driving licence, T-shirt size) is collected only where necessary for logistical or contractual purposes.
Whether data fields are mandatory or optional is indicated in the relevant form. Failure to provide mandatory data may prevent an order from being processed or a request from being handled.
Data collected indirectly
When browsing the festival-avignon.com website, technical data may be collected:
– IP address
– data relating to the device, browser, and operating system
– pages viewed
– date and time of connection
– data relating to website performance and security
This data may be collected via cookies or other tracking technologies.
Some data is strictly necessary for the website to function. Other data is subject to prior consent where it relates to audience measurement or service improvement.
Data collected via trackers may constitute personal data within the meaning of Regulation (EU) 2016/679. It is used exclusively for technical, statistical, or service improvement purposes, and does not give rise to any direct nominal identification by the Festival d'Avignon.
3. Legal Basis for Data Processing
Processing is based on:
– performance of a contract (ticket purchase, account management)
– compliance with legal and regulatory obligations (in particular, accounting obligations)
– consent (newsletter subscription, submission of supporting documents)
– the legitimate interests of the Festival d'Avignon (fraud prevention, system security, service improvement). These processing activities are subject to a balancing exercise between the interests pursued by the Festival d'Avignon and the rights and freedoms of the data subjects.
4. Purposes of Data Processing
Personal data is processed for the following purposes:
Ticketing and sales
– creation and management of the online account
– recording, validating, and tracking orders
– payment and refund management
– invoicing
– access control at performance venues
Event-related information
– sending practical information regarding purchased performances (access, changes, postponements, cancellations)
– sending communications relating to the Festival's programme or activities
– segmentation of communications based on previously purchased performances or events, in order to provide information tailored to declared or observed interests
Administrative and accounting
– compliance with accounting and tax obligations
– maintenance of statutory records
Specific rates
– verification and validation of supporting documents for the application of reduced rates
Service improvement and security
– statistical analysis of attendance
– website audience measurement
– fraud prevention
– information system security
Recruitment and team
– receiving and reviewing applications
– administrative management of recruitment
– drawing up contracts
– logistical organisation of teams
Application data is not used for any commercial purpose.
5. Data Retention Period
Data is retained for periods proportionate to the purposes for which it was collected:
– Transaction and invoicing data: 10 years (in accordance with accounting and tax obligations)
– Prospecting and communications data: 3 years from the last engagement
– Inactive account data: 3 years from the last contact
– Price eligibility supporting documents: duration of the relevant edition
– Application data: duration of the recruitment process, unless retained by agreement for future opportunities
– Browsing data: maximum 13 months
The Festival d'Avignon may retain personal data for a longer period where required to do so by statutory or regulatory provisions.
Online payments are processed via the secure Paybox solution, operated by Verifone. Banking data is entered directly on the payment provider's platform and is neither collected nor retained by the Festival d'Avignon at any point.
Only the information strictly necessary to track the transaction (order reference, amount, date, and payment status) is accessible via the provider's secure back office. The provider acts as a data processor and implements measures compliant with the applicable electronic payment security standards (PCI-DSS), details of which are available directly on the Verifone website.
6. Recipients or Categories of Recipients of the Data
The data is accessible only to:
– authorised Festival departments (ticketing, communications, and administration)
– technical service providers acting as data processors
– partners hosting performances, for the purpose of ticket verification (session date, session time, event name, rate type, rate, sale price, sale type, last name, first name, postcode, country, unique ticket number, barcode, seat name and zone, seat category, seat type, seat number)
No data is transferred outside the European Union.
Users may specify their preferences directly in their online account.
No processing gives rise to automated decision-making producing legal effects or significantly affecting data subjects.
Segmentation operations may be carried out in order to tailor communications relating to the Festival's activities, based on expressed preferences or purchase history. These processing activities produce no legal effect and may be objected to at any time.
7. Rights of Data Subjects
In accordance with Regulation (EU) 2016/679, every data subject has:
– the right of access
– the right to rectification
– the right to erasure
– the right to restriction of processing
– the right to object
– the right to data portability
– the right to provide instructions regarding the handling of data after death
8. How to Exercise Your Rights?
These rights may be exercised at any time:
– by email at: rgpd@festival-avignon.com
– by post to the following address:
Festival d'Avignon
Protection des données personnelles
20 rue du Portail Boquier 84000 Avignon
Any request must enable the requester to be clearly identified and may require proof of identity where necessary to ensure data security.
A response will be provided within a maximum of one month from receipt of the request. This period may be extended by two months in cases of complexity or multiple requests, in accordance with Article 12 of Regulation (EU) 2016/679.
Where a request relates to data linked to an ongoing order or an upcoming event, certain information may be retained until the contractual obligations have been fully discharged, in particular to enable venue access, the management of any postponements or refunds, and compliance with legal obligations.
A complaint may be lodged with the Commission Nationale de l'Informatique et des Libertés (CNIL) if a data subject considers that the processing of their personal data constitutes a breach of the applicable regulations:
– via the website: cnil.fr
– by telephone: +33 (0)1 53 73 22 22
– by post to the following address:
3 place de Fontenoy
TSA 80715 75334 Paris cedex 07
9. Data Security and Hosting
Personal data is hosted in France.
Appropriate technical and organisational measures are implemented to ensure the confidentiality, integrity, and availability of the data, including:
– access controls restricted to authorised personnel only
– encryption of data flows and passwords
– logging and access monitoring systems
– securing of technical infrastructure
– contractual oversight of data processors
