Les Jardins de la Cité attaches particular importance to the protection of personal data and to respect for privacy, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and French Act No. 78-17 of 6 January 1978 as amended (“Informatique et Libertés”). This policy describes the processing carried out through the website www.lesjardinsdelacite.fr.

1. Data controller

BBLEND (a simplified joint-stock company with a share capital of €7,500, Paris Trade and Companies Register 449 531 516), trading as Les Jardins de la Cité, with its registered office at 88 avenue des Ternes, 75017 Paris.

For any question about your personal data, you can write to our data protection officer: dpd@lesjardinsdelacite.fr.

2. Data collected

The website has no user accounts and no advertising tracking or audience measurement. The only personal data processed are:

  • Data from the “Your project” form: name, organisation, email address, telephone, type of project, number of participants, intended period, budget if you state it, the content of your message and, if you fill it in, how you heard about us. You may also attach a document (PDF, Word or PowerPoint, 8 MB maximum). Only the name and email address are mandatory: without them we could not reply to you;
  • Data from the “Book 20 minutes” form: name, organisation, email address, telephone and suggested time slots;
  • Your landing page on the website and, where applicable, the name of the website that referred you (for example a search engine): noted in your browser during your visit and added to your request only if you send it, so that we know how people find us;
  • Data you choose to send us when you contact us by email or telephone: identity, position, organisation, contact details and the content of your message;
  • Technical connection data processed by our host for security and to keep the website running (server logs: IP address, time stamp, pages viewed).

The forms send your information to us by email and send you an acknowledgement of receipt; it is not stored in any database on the website. It is used only to reply to your request and follow it up: it is not added to any mailing list. If automatic sending fails, a copy of your request (without the attachment) is kept on our hosting, in a folder that cannot be accessed from the Internet, for as long as needed to handle it and for 30 days at most. To limit abusive submissions, the website counts submissions per IP address over one hour: the address is never stored in clear, only an encrypted fingerprint, which is deleted after one hour.

This data is collected directly from you. For business-to-business prospecting, we may also use publicly available business contact details (institutional websites, professional directories, tender notices); you are then informed of this when we first contact you. No automated decision-making or profiling is carried out using this data.

3. Purposes and legal bases

  • Replying to your requests and exchanging with you in a commercial or pre-contractual relationship, legal basis: steps taken at your request prior to a contract, or legitimate interest;
  • Managing our client relationships and business-to-business prospecting using publicly available business contact details, legal basis: legitimate interest;
  • Keeping the website secure and preventing abusive submissions, legal basis: legitimate interest;
  • Meeting our legal obligations, in particular accounting and tax obligations, legal basis: legal obligation.

4. Retention periods

  • Requests received and prospect data: 3 years after your last contact with us;
  • Data relating to a contract: the term of the contract, plus the applicable legal limitation periods (10 years for accounting records);
  • Back-up copy of a request that could not be sent: 30 days at most;
  • Fingerprint used to limit abusive submissions: 1 hour;
  • Connection logs: 12 months at most.

5. Recipients

The data is intended solely for the authorised staff of Les Jardins de la Cité. It is never sold, rented or transferred to third parties. It is hosted on the agency's behalf by OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which hosts the website and our email, uses servers located in the European Union and is bound by contractual confidentiality and GDPR compliance obligations (Article 28). It may also be disclosed to the authorities where required by law.

6. Transfers outside the European Union

No data is transferred outside the European Union through the website.

7. Cookies and local storage

The website sets no advertising, audience-measurement or social-media cookies, and therefore shows no consent banner. It only uses the following, which are strictly necessary for the website to work or for the service you request, and are therefore exempt from consent under the guidelines of the CNIL (the French data protection authority):

  • In your browser's local storage, until you clear it: your display preferences (light or dark mode, accessibility settings: text size, contrast, reduced motion) and the view you chose on the Projects page;
  • In session storage, cleared when you close the tab: your landing page, and the fact that the opening animation has already played, so it is not replayed on every page;
  • A two-minute technical cookie, which may be set after you send the form: it passes your first name and the type of your request to the thank-you page, and is then deleted.

This information stays on your device, is not used to track you and does not identify you. You can clear it at any time in your browser settings, or with the “Reset all” button in the accessibility panel for your display settings.

The links to our social media pages (LinkedIn, Instagram, Facebook, YouTube) are simple outgoing links: no third-party module is loaded on our pages, and no data is sent to these platforms unless you click on the links.

8. Embedded content

All content displayed on the website (texts, images, videos, fonts) is hosted directly on our website. No video player, map, font or third-party module is loaded from an external service: browsing our pages therefore involves no data transfer to third-party platforms and sets no cookies.

9. Your rights

Under the GDPR, you have the right to access, rectify and erase your data, to restrict its processing, to object to it and to data portability, as well as the right to give instructions on what happens to your data after your death. You can exercise these rights at any time by writing to dpd@lesjardinsdelacite.fr or by post to our registered office. If we have reasonable doubts about your identity, we may ask you for proof. We reply within one month, which may be extended by two months for complex requests, in which case we will let you know. In particular, you may object at any time, without giving a reason, to business prospecting: simply tell us in reply to one of our messages.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

10. Security

Les Jardins de la Cité implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of the data processed: encrypted connection (HTTPS), access restricted to authorised staff, checks on attached files, a back-up folder that cannot be accessed from the Internet. These are the same commitments the agency applies in its event services (GDPR-compliant management of invitations and attendance lists on behalf of its clients).

11. Changes to this policy

This policy may be updated to reflect changes to the website or to the regulations. The version in force is the one published on this page.

Last updated: October 2026.