Personal data

Personal data

At CNR , your privacy is our priority

CNR is committed to processing your personal data with the utmost care, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

Our guiding principle :

We only collect the personal data we genuinely need.
We only use it for the purposes you have agreed to

 

1. Data contoller

Who are we?

Your single point of contact for any questions relating to your personal data.

Company Compagnie Nationale du Rhône (CNR)
Legal status Société anonyme d’intérêt général
Share capital 5 488 164 EUR
Lyon Trade and Companies Register (RCS) 957 520 901
Registered office 2 rue André Bonin, 69004 Lyon, France
Telephone 04 72 00 69 69
VAT number FR 59 957 520 901
Publishing Director Nathalie HASSEL
Contact https://www.cnr.tm.fr/contact/

 

2. Data collected

What we collect, nothing more.

No hidden data collection. No intrusive profiling. Here’s exactly what we need.

> Contact details

Your name, email address and telephone number—only if you complete a contact form.

> Your contributions

Messages, questions, digital artworks, guestbook entries.

> Browing data

Pages visited, time spent on the Site and clicks—to help us improve your browsing experience.

> Preferences

Your choice to subscribe (or not) to our newsletter. You can change your preferences at any time.

> Technical data

Browser, operating system and IP address—to ensure the Site’s compatibility and security.

  

Fields marked with an asterisk (*) in our forms are mandatory. All other fields are optional.

 

3. Purposes and legal bases

We collect your data. Here’s why.

Every use of your personal data is based on a specific legal basis under the GDPR. Full transparency.

Purpose Legal basis (GDPR)
Responding to your enquiries and providing information about our activities and services.

Legitimate interest (Article 6(1)(f) GDPR). You have the right to object to this processing (Article 21 GDPR).
Publishing your contributions (surveys, guestbook entries, digital artworks). Consent
Sending you our personalised newsletter (only at your request). Consent
Measuring website traffic and improving the performance of the Site. Consent (cookies)
Retaining data for evidential purposes and to protect our rights in the event of a dispute.

Legitimate interest

(Article 6(1)(f) GDPR). The balancing test has been documented in our Record of Processing Activities (Article 30 GDPR). Data is retained for a maximum of five years, which is proportionate to the limitation period under Article 2224 of the French Civil Code.

 

4. Recepients

Who we share your data with. And no one else.

Your personal data is never sold. It is shared only with parties directly involved in providing our services.

> CNR departements

Authorised teams, including Sales, Finance, Marketing and IT.

> Groupe CNR

Our subsidiaries and shareholders, strictly where necessary for the Group’s activities.

> Technology service providers

Hosting, maintenance and email service providers—all contractually bound to provide the same level of data protection in accordance with Article 28 of the GDPR.

> Public authorities

Only where required by law or pursuant to a judicial or administrative order

 

Transfers outside the European Union :

Some of our technical service providers process your personal data outside the European Economic Area (EEA), particularly in connection with hosting services, website analytics and electronic communications (such as cloud services and email platforms).

These transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914), ensuring a level of protection equivalent to that required within the European Union.

The list of the service providers concerned and the safeguards applied is available upon request from our Data Protection Officer (DPO): donnees.personnelles@cnr.tm.fr

 

5. Data retention

We don’t keep your data a second longer than necessary.

Every category of personal data has a defined retention period. Once this period expires, the data is deleted or anonymised.

  • Contact forms
    Retained for 2 years from the date your request has been processed (for evidential purposes)

  • Newsletters & communications
    Retained for 3 years from the date of collection or your last contact with us, unless you object.

  • Public interest inquiry data
    In accordance with the French Heritage Code (Article L. 211-1) – obligations related to our status as a State concessionaire.

  • Guestbooks & digital murals
    Retained until you request their removal — you remain in control at all times.

  • Cookies & traceurs
    Cookies placed on our Site have a maximum lifespan of 13 months (CNIL recommendations). Once this period has expired, your consent is requested again. For details of the cookies (purposes, providers, exact retention periods), please consult our Cookie Policy.

 

6. Security

Your data is in good hands.

We implement the most stringent measures to protect the data you entrust to us (Article 32 GDPR).

> Access control

Strict authorisation system – only authorised persons have access to your data.

> Encryption

Data encrypted in transit (HTTPS) and at rest for sensitive data.

> Backups

Regular backup procedures and a Business Continuity Plan (BCP) are in place.

> Regular audits

Penetration testing and periodic security audits across all our systems.

In the event of an incident: any incident will be notified to the CNIL within 72 hours (Article 33 GDPR) and, where necessary, communicated directly to the data subjects concerned (Article 34 GDPR).

 

7. Your rights

You are in control. Use it.

The GDPR grants you specific rights regarding your data. Here is what you can do.

Référence Your right What it means
Art. 15 GDPR Access Know exactly what data we hold about you and under what conditions.
Art. 16 GDPR Rectification Correct or complete inaccurate or incomplete data.
Art. 17 GDPR Erasur Request the deletion of your data (subject to our legal obligations).
Art. 18 GDPR Limitation Temporarily restrict the use of your data in the cases provided for by law.
Art. 20 GDPR Portability Receive your data in a machine-readable format in order to transfer it elsewhere.
Art. 21 GDPR Objection Object to processing based on our legitimate interest.
Art. 7 (3) GDPR Withdrawal Withdraw your consent at any time –  without affecting processing already carried out.
French Data Protection Act Post-mortem Provide instructions regarding the processing of your data after your death..

 

8. Exercising your rights

A question ? Our DPO is here to help.

Contact our Data Protection Officer. Statutory response time : 1 month (extendable to 3 months).

Data Protection Officer (DPO – DARJE)
CNR — 2 rue André Bonin, 69316 Lyon Cedex 04
Email : donnees.personnelles@cnr.tm.fr

If you are not satisfied with our response, or if you do not receive a response within the prescribed time limit, you may lodge a complaint with the CNIL:

Policy updated in March 2026

In the event of a substantial modification, we will inform you by email or by means of a banner on the Site.