The Muséum national d’Histoire naturelle’s personal data protection policy
1 — The role of the Muséum in the protection of your personal data
At the Muséum national d'Histoire naturelle, we take care of your data!
This policy presents, in a single document, clear and simple information concerning the data processing carried out by the Muséum on the following websites:
- Muséum website (mnhn.fr)
- Jardin des Plantes website
- Musée de l’Homme website
- Parc zoologique de Paris website
- Versailles-Chèvreloup Arboretum website
- Réserve zoologique de la Haute-Touche website
- Website of the Concarneau marine station and Marinarium
- Harmas Jean-Henri Fabre website
- Jardin botanique Val Rahmeh – Menton website
It will help you to better understand the types of personal data that are collected by the Muséum, and their use, with due regard to your rights.
The Muséum undertakes to protect your private life in accordance with the current legislation, by ensuring the protection, confidentiality, non-alteration, availability and security of the personal data you entrust us with.
The Data controller is the Muséum national d'Histoire naturelle, represented by its President. It is a scientific, cultural and professional public institution with headquarters at 57, rue Cuvier in Paris 05.
2 — The main principles
The Muséum undertakes to apply the following principles to ensure that fundamental rights are respected:
- Transparency: we provide you with all the useful information on the processing of your data, including the purposes they is used for and the recipients;
- Data minimisation: we only collect and process data that is appropriate, relevant and not excessive in relation to the purposes for which it was collected;
- Confidentiality and integrity: we implement all the reasonable technical and organisational measures to protect your personal data against disclosure, loss, alteration or access by an unauthorised third party;
- Retention: we keep your personal data for only as long as is necessary for the purposes of processing or for the specific service;
- Protection of your rights: we offer you the possibility to access, modify and oppose to the processing of your data. Where permitted by law, we also offer you the possibility to exercise your data processing limitation right and your data portability right;
- Commitment of our partners: the operations for which we call upon specialist partners are subject to a contract in order to ensure the protection of your data and your rights.
3 — How does the Muséum use your data?
Your personal information is collected for the purposes detailed below.
Some information (indicated by an asterisk) is mandatory to benefit from the service concerned. If this information is not provided, the Muséum will not be able to provide you with this service.
The data retention time limits are defined by the Muséum with regard to the legal and contractual constraints. These time limits are set according to the purposes of the processing concerned. After this time limit, the data is either deleted or kept after being made anonymous, that is to say, modified so as to render its attribution to a person definitively impossible.
Contact us
| Purposes | Responding to your queries and complaints, via the “Contact us” form or similar forms | ||
|---|---|---|---|
| Legal basis | Legitimate interest | ||
| Processed data and retention period | Surname, first name, email address, telephone number, report of discussions and complaints | ||
| Recipients | Digital Contents service, authorised officials from the Museums, Gardens and Zoos management team, the Development management team and the Audiences management team. | ||
Management of newsletters and news
| Purposes | Sending the Muséum’s news and newsletters to the subscribers | ||
|---|---|---|---|
| Legal basis | Legitimate interest | ||
| Processed data and retention period | Surname, first name, email address, telephone number, report of discussions and complaints | ||
| Recipients | Digital Contents service | ||
Venue hire request
| Purposes | Processing your venue hire requests | ||
|---|---|---|---|
| Legal basis | Contract | ||
| Processed data and retention period | Surname, first name, email address,* telephone number Retention period: 3 years following the last incoming contact | ||
| Recipients | Digital Contents service, authorised officials from the Development management team | ||
Request for filming or photography
| Purposes | Processing your requests for filming or photography | ||
|---|---|---|---|
| Legal basis | Contract | ||
| Processed data and retention period | Surname, first name, email address,* telephone number Retention period: 3 years following the last incoming contact | ||
| Recipients | Digital Contents service, authorised officials from the Development management team and Communications management team | ||
Management of events organised by the Muséum (game contests, etc.)
| Purposes | Organising the event and contacting the winner(s) | ||
|---|---|---|---|
| Legal basis | Consent | ||
| Processed data and retention period | Surname, first name, email address,* telephone number, date of birth, postal address Retention period: until the random draw for the game contest is held and up to one month after the last prize has been awarded for the winners | ||
| Recipients | Digital Contents service, authorised officials from the Audiences management team | ||
Website improvement
| Purposes | Enable the Muséum to develop, exploit, improve, host and manage the Website and improve your user experience | ||
|---|---|---|---|
| Legal basis | Legitimate interest (economic interest in continuously improving its Website and its services and in understanding your needs to meet your expectations) | ||
| Processed data and retention period | URL path (the path you take through the Muséum websites), the services visited, connection times, etc. IP address, connection information, browser type and version, time zone setting, type of browser plug-ins, geolocation information, operating system version (12 months) Retention period: 13 months | ||
| Recipients | Digital Contents service, DINSI, IT service providers | ||
Tracking interactions with our communications (tracking pixels)
| Purposes | To measure the performance of our email campaigns (open and click-through rates), adjust our mailing frequency to avoid oversending, and collect certain technical information (device type, browser, or email client) to optimize how our emails are displayed based on the devices used, and identify inactive subscriptions in order to remove addresses that have not viewed our communications for an extended period |
|---|---|
| Legal basis | We process this data based on your consent. Note for our existing customers as of April 14, 2026: In accordance with the CNIL’s recommendations regarding our historical customer database, a specific communication was sent to you to inform you of this processing and give you the opportunity to object to it. Unless you object following receipt of this message, this tracking will continue. In any case, you may withdraw your consent or object to this follow-up at any time, easily and immediately, by using the link to manage your preferences at the bottom of each of our emails or by clicking on this link. |
| Recipients | Internal: Marketing and CRM Department, Communications and Digital Content Division, External: our CRM service provider (Arenametrix) and its subcontractors |
Management of requests to exercise rights
| Purposes | Allowing you to exercise your rights on your personal data | ||
|---|---|---|---|
| Legal basis | Legal obligation | ||
| Processed data and retention period | Content of exchanges, surname*, first name*, e-mail address, proof of identity (exceptionally if we have no other means of identifying you, which will be deleted as soon as your identity has been verified), copy of requested data. This data will be kept for a period of 6 years after the request has been processed, for evidence purposes and to defend the Museum's interests. | ||
| Recipients | Digital Contents service, Data Protection Officer | ||
Legal or regulatory requirement
The Muséum may be required to communicate your personal data in the event of lawful requests by public authorities, notably to meet requirements in terms of national security, combatting fraud, or another legal obligation.
4 — Security and confidentiality of personal data
The Muséum national d’Histoire naturelle commits to undertake all the measures necessary to guarantee the security and confidentiality of the personal data, and particularly to prevent it from being damaged, deleted, or accessed by unauthorised third parties.
5 — Transfers outside the European Union
The Muséum national d'Histoire naturelle also uses security solutions to protect itself against distributed denial-of-service attacks (DDoS). These devices are supplied by the American company Cloudflare. The aggregated data is hosted on Cloudflare's servers in the United States. Data transfers outside the European Union therefore take place to the United States.
In this regard, Cloudflare is certified under the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.
6 — Rights of persons whose data is collected and processed
It is expressly agreed that the personal data collected by the Muséum national d’Histoire naturelle is used in accordance with the purposes described in the present personal data protection policy.
In accordance with the applicable regulations in the area of personal data protection, and subject to fulfilling the conditions, you have a right of access, rectification and opposition for a legitimate reason (except as regards prospecting, where it is not necessary to give a reason), and where permitted by law, of limitation, portability and deletion of the personal data concerning you. You may also at any time formulate instructions regarding the retention, deletion and communication of your personal data after your death.
These rights may be exercised at any time, provided you can verify your identity by any means.
Please note that you can also delete your account directly via your customer account under the "Profile" section.
Should you wish to receive further information on the content of these rights, you may contact the Muséum’s data protection officer at the address dpo [at] mnhn.fr (dpo[at]mnhn[dot]fr).
The Muséum will respond to your requests to exercise rights as soon as possible and, in any event, within one month of receipt of such requests.
If you are experiencing difficulties in managing your personal data, you may file a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés - CNIL).
7 — Turning this policy into a success
This policy is designed to be as transparent and useful as possible. Please consult our Data Protection Policy regularly to ensure you are familiar with the most recent version. If significant amendments are made to the present policy, a notification will be made by posting a notice on the website.
Last update — 02/04/2026