At CNR , your privacy is our priority
CNR is committed to processing your personal data with the utmost care, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

Our guiding principle :
We only collect the personal data we genuinely need.
We only use it for the purposes you have agreed to

1. Data contoller

Who are we? Your single point of contact for any questions relating to your personal data.
Company : Compagnie Nationale du Rhône (CNR)
Legal status : Société anonyme d'intérêt général
Share capital : 5 488 164 EUR
Lyon Trade and Companies Register (RCS) : 957 520 901
Registered office : 2 rue André Bonin, 69004 Lyon, France
Telephone : 04 72 00 69 69
VAT number : FR 59 957 520 901
Publishing Director : Nathalie HASSEL
Contact : https://www.cnr.tm.fr/contact/

2. Data collected

What we collect, nothing more.
No hidden data collection. No intrusive profiling. Here's exactly what we need.

> Contact details Your name, email address and telephone number—only if you complete a contact form.
> Your contributions Messages, questions, digital artworks, guestbook entries.
> Browing data Pages visited, time spent on the Site and clicks—to help us improve your browsing experience.
> Preferences Your choice to subscribe (or not) to our newsletter. You can change your preferences at any time.
> Technical data Browser, operating system and IP address—to ensure the Site's compatibility and security.

Fields marked with an asterisk (*) in our forms are mandatory. All other fields are optional.

3. Purposes and legal bases

We collect your data. Here’s why.
Every use of your personal data is based on a specific legal basis under the GDPR. Full transparency.

Purpose / Legal basis (GDPR)

> Responding to your enquiries and providing information about our activities and services. / Legitimate interest (Article 6(1)(f) GDPR). You have the right to object to this processing (Article 21 GDPR).

> Publishing your contributions (surveys, guestbook entries, digital artworks). / Consent

> Sending you our personalised newsletter (only at your request). / Consent

> Measuring website traffic and improving the performance of the Site. / Consent (cookies)

> Retaining data for evidential purposes and to protect our rights in the event of a dispute. / Legitimate interest

(Article 6(1)(f) GDPR). The balancing test has been documented in our Record of Processing Activities (Article 30 GDPR). Data is retained for a maximum of five years, which is proportionate to the limitation period under Article 2224 of the French Civil Code.

4. Recepients

Who we share your data with. And no one else.
Your personal data is never sold. It is shared only with parties directly involved in providing our services.
> CNR departements Authorised teams, including Sales, Finance, Marketing and IT.
> Groupe CNR Our subsidiaries and shareholders, strictly where necessary for the Group's activities.
> Technology service providers Hosting, maintenance and email service providers—all contractually bound to provide the same level of data protection in accordance with Article 28 of the GDPR.
> Public authorities Only where required by law or pursuant to a judicial or administrative order
 
Transfers outside the European Union :
Some of our technical service providers process your personal data outside the European Economic Area (EEA), particularly in connection with hosting services, website analytics and electronic communications (such as cloud services and email platforms).

These transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914), ensuring a level of protection equivalent to that required within the European Union.

The list of the service providers concerned and the safeguards applied is available upon request from our Data Protection Officer (DPO): donnees.personnelles@cnr.tm.fr

5. Data retention

We don’t keep your data a second longer than necessary.
Every category of personal data has a defined retention period. Once this period expires, the data is deleted or anonymised.

> Contact forms : Retained for 2 years from the date your request has been processed (for evidential purposes)
> Newsletters & communications : Retained for 3 years from the date of collection or your last contact with us, unless you object.
> Public interest inquiry data : In accordance with the French Heritage Code (Article L. 211-1) - obligations related to our status as a State concessionaire.
> Guestbooks & digital murals : Retained until you request their removal — you remain in control at all times.
> Cookies & traceurs : Cookies placed on our Site have a maximum lifespan of 13 months (CNIL recommendations). Once this period has expired, your consent is requested again. For details of the cookies (purposes, providers, exact retention periods), please consult our Cookie Policy.

6. Security

Your data is in good hands.
We implement the most stringent measures to protect the data you entrust to us (Article 32 GDPR).

> Access control Strict authorisation system - only authorised persons have access to your data.
> Encryption Data encrypted in transit (HTTPS) and at rest for sensitive data.
> Backups Regular backup procedures and a Business Continuity Plan (BCP) are in place.
> Regular audits Penetration testing and periodic security audits across all our systems.
 
In the event of an incident: any incident will be notified to the CNIL within 72 hours (Article 33 GDPR) and, where necessary, communicated directly to the data subjects concerned (Article 34 GDPR).

7. Your rights

You are in control. Use it.
The GDPR grants you specific rights regarding your data. Here is what you can do.

Reference / Your right / What it means

> Art. 15 GDPR / Access / Know exactly what data we hold about you and under what conditions.
> Art. 16 GDPR / Rectification / Correct or complete inaccurate or incomplete data.
> Art. 17 GDPR / Erasur / Request the deletion of your data (subject to our legal obligations).
> Art. 18 GDPR / Limitation / Temporarily restrict the use of your data in the cases provided for by law.
> Art. 20 GDPR / Portability / Receive your data in a machine-readable format in order to transfer it elsewhere.
> Art. 21 GDPR / Objection / Object to processing based on our legitimate interest.
> Art. 7 (3) GDPR / Withdrawal / Withdraw your consent at any time -  without affecting processing already carried out.
> French Data Protection Act / Post-mortem / Provide instructions regarding the processing of your data after your death..

8. Exercising your rights

A question ? Our DPO is here to help.
Contact our Data Protection Officer. Statutory response time : 1 month (extendable to 3 months).
Data Protection Officer (DPO - DARJE)
CNR — 2 rue André Bonin, 69316 Lyon Cedex 04
Email : donnees.personnelles@cnr.tm.fr

If you are not satisfied with our response, or if you do not receive a response within the prescribed time limit, you may lodge a complaint with the CNIL:
Online : https://www.cnil.fr/fr/plaintes
By post : CNIL - Service des Plaintes - 3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07

Policy updated in March 2026
In the event of a substantial modification, we will inform you by email or by means of a banner on the Site.