MUSE Personal Data Protection Policy

1. Core Principles

   The Muséum is committed to the following key principles to ensure respect for fundamental rights:

   • Transparency: we provide you with all relevant information regarding the processing of your data, including purposes and recipients;
   • Data minimization: we collect and process only the data that is adequate, relevant, and not excessive in relation to the purposes for which it was collected;
   • Confidentiality and integrity: we implement all reasonable technical and organizational measures to protect your personal data from disclosure, loss, alteration, or unauthorized access;
   • Retention: we retain your personal data only for the duration necessary for the processing or the determined service;
   • Respect for your rights: we offer you the ability to access, rectify, and object to the processing of your data, either through the Deputy General Directorate of Collections or our Data Protection Officer. Where permitted by law, we also allow you to exercise your rights to restrict processing and to data portability.

   1. When do we process your personal data?

      Your data may be collected and processed when:

      • You create an account on the MUSE website;
      • You browse our website, which may use cookies;
      • You wish to borrow specimens or obtain samples;
      • You wish to consult specimens or obtain images of specimens;
      • You send us questions or requests;
      • You exercise your rights.

   2. What personal information does the Muséum collect?

      Personal data is information relating to an identified or identifiable natural person, either directly or indirectly.

      The Muséum collects only the information strictly necessary to provide its services.

      In accordance with the law, the Muséum does not collect personal data, in the context of processing related to the MUSE website, that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a natural person's sex life or sexual orientation.

2. How does the Muséum use your data?

   Your personal information is collected for the purposes detailed below.

   Some information is essential to benefit from the corresponding service (indicated by an asterisk). Without providing this information, we will not be able to offer you the service.

   The retention periods for your data are defined by the Muséum in accordance with legal and contractual constraints. These periods are determined based on the intended purposes. Once these periods have elapsed, the data is either deleted or anonymized, meaning modified so that it is permanently impossible to link them to an individual.

   In accordance with the French Heritage Code, we may retain, beyond the initial retention period, certain documents concerning you that are of administrative utility or scientific, statistical, or historical interest.

   As a user, you guarantee that the information you provide is accurate, complete, and up to date.

   You create an account on the MUSE website

   Purpose	Management of user accounts and user authentication
   Legal basis	Public interest mission
   Data processed and retention period	Identity (last name*, first name*, postal address (only for individuals not affiliated with an institution)*, email address*, phone number*), institution
   Recipients	The relevant departments of the Muséum national d’Histoire naturelle

   You wish to borrow specimens or obtain samples

   Purpose	Management of specimen loans and sampling, tracking reservation history, sending notifications and alerts to users who made reservations, managing availability and avoiding reservation conflicts
   Legal basis	Public interest mission
   Data processed and retention period	Identity (last name*, first name*, postal address (only for individuals not affiliated with an institution)*, email address*, phone number*), institution, loan date, return date, name, first name and email address of the contact person*, requests (data related to the request – information about the type of request; specimen selection; type of need)
   Recipients	The relevant departments of the Muséum national d’Histoire naturelle

   You wish to consult specimens or obtain specimen images

   Purpose	Management of visits to collections and reproduction (2D & 3D) of specimens
   Legal basis	Public interest mission
   Data processed and retention period	Identity (last name*, first name*, postal address (only for individuals not affiliated with an institution)*, email address*, phone number*), institution, requests (data related to the request – information about the type of request; specimen selection; type of need), visit date
   Recipients	The relevant departments of the Muséum national d’Histoire naturelle

   You send us questions or requests

   Purpose	Send questions, suggestions, or requests to the departments of the Muséum national d’Histoire naturelle
   Legal basis	Legitimate interest
   Data processed and retention period	Identity (last name*, first name*), email address*
   Recipients	The relevant departments of the Muséum national d’Histoire naturelle

   You exercise your rights

   Purpose	Allow you to exercise your rights regarding your personal data
   Legal basis	Legal obligation
   Data processed and retention period	Content of communications, last name*, first name*, email address, ID document (exceptionally, if we have no other way to identify you – will be deleted once identity is verified), copy of requested data. These data are retained for 6 years after request processing for evidentiary purposes to protect the Muséum’s interests.
   Recipients	The relevant departments of the Muséum national d’Histoire naturelle and the Data Protection Officer (DPO)

   Annual statistics on requests submitted on Muse relating to collections

   Purpose	Generate statistics on requests submitted via the website related to the collections
   Legal basis	Legal obligation
   Data processed and retention period	All data stored in the application may be used for statistical purposes (cross-referenced searches between institutions, requests, applicant information, collections, specimens).
   Recipients	The relevant departments of the Muséum national d’Histoire naturelle

   Legal or Regulatory Requirement

   The Muséum may be required to disclose your personal data in response to legitimate requests from public authorities, particularly to comply with national security, anti-fraud requirements, or other legal obligations.

   Data Retention Period

   The data collected is retained in accordance with applicable regulations for the time necessary to fulfill the purposes for which it was collected. Some data may be kept permanently for archival purposes in the public interest, in accordance with Article 5(1)(e) and Article 89 of the General Data Protection Regulation (GDPR).

3. Transfer of Data Outside the European Union

   No data is transferred outside the European Union.

4. Security and Confidentiality of Personal Data

   The Muséum national d’histoire naturelle is committed to taking all necessary measures to ensure the security and confidentiality of personal data and, in particular, to prevent it from being damaged, deleted, or accessed by unauthorized third parties.

5. Rights of Individuals Whose Data is Collected and Processed

   It is expressly agreed that the personal data collected by the Muséum national d’histoire naturelle is used in accordance with the purposes described in this privacy policy.

   In accordance with applicable regulations on the protection of personal data, and subject to meeting the relevant conditions, any User has the right to access, rectify, and object for legitimate reasons (except in cases of direct marketing, where no reason is required), withdraw consent at any time, and, where permitted by law, restrict processing, request data portability, and request the erasure of their personal data. Users may also define directives regarding the handling of their data after their death.

   These rights can be exercised at any time, provided that proof of identity is supplied by any means. Users may also modify their personal data themselves from their Account, as selected during Account creation. The Muséum will respond to your rights requests as soon as possible and, in any event, within one month of receiving the request.

   Please note that these rights may be restricted, particularly when the data processing is carried out for archival purposes in the public interest (Article 89 of the GDPR).

   For more information about these rights, you may contact the Data Protection Officer (DPO) of the Muséum national d’histoire naturelle at dpo[@]mnhn.fr, or by mail at: Direction des affaires juridiques et des achats - Data Protection Officer, 57 rue Cuvier, 75005 PARIS, France. Please make sure to mention in your request that it concerns the MUSE platform.

   In the event of any difficulties managing your personal data, you may file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07, France.

6. Cookie Management

   Our website uses cookies and other related technologies (for simplicity, all such technologies are referred to as 'cookies'). Cookies may also be placed by third parties engaged by the Muséum.

   1. What is a cookie?

      Cookies are computer files that are automatically placed on the hard drive of your computer, tablet, or mobile device when you browse our website. They are managed by your internet browser (Internet Explorer, Firefox, Safari, or Google Chrome).

      Our cookies serve multiple purposes: they can be used to remember your visitor ID on our website, determine the page display language, etc.

      According to the French Data Protection Authority (CNIL), there are several types of cookies:

      Cookies that do not require your consent:

      • ‘Necessary’ internal cookies, which store information between two visits to the same website on the same device (e.g., login credentials or user interface customization elements). These do not require your consent.
      • ‘Statistical’ cookies, which track your interactions with the site and generate statistics to optimize the quality of your browsing experience. Since these statistics are anonymous (i.e., they do not identify you), your consent is generally not required either.

      Cookies that require your consent:

      • ‘First-party’ cookies are placed by the site itself. In addition to necessary cookies, they may be used to collect personal data, track user behavior, or serve advertising purposes. Therefore, they require your prior consent.
      • ‘Third-party’ cookies are placed by (or for) another website (Site B) on this site: they allow Site B to track which pages you visit and to collect information about you. Their use also requires your consent.

   2. Purposes of Cookies

      The cookies we place serve to:

      • Generate statistics on traffic and use of the various components of our site (number of page views, visits, activity, return frequency, etc.) to monitor and improve the quality of our services;
      • Make your use of our site easier, for example by remembering information entered into a form or preferences selected on our site to deliver content relevant to your interest in our activities.

      Cookies Used

      Technical Cookies

      The Muse website uses these cookies to enable the operation of certain web pages. This is why they do not require your consent.

      Name	Retention	Purpose
      NEXT_LOCALE	No limit	User's preferred language
      muse.user-space	Session duration (until browser is closed)	User profile (requester or MNHN staff)
      __Secure-authjs.session-token	5 minutes	Authentication token

      Analytical Cookies

      The Muséum uses analytical cookies strictly for internal research purposes aimed at improving the service offered to all users. These cookies help assess how users interact with the website—as anonymous users (the data collected does not allow personal identification).

      Name	Retention	Purpose
      _pk_id	13 months	Store a unique user ID
      _pk_ses	30 minutes	Measure session duration

7. How to Block Cookies via Your Browser

   Most modern browsers can be configured to prevent cookies from being stored on your device. However, you may then have to manually set some preferences every time you visit a site or page. Some features and services (such as logging in via a profile) may also not be available.

   If you use Firefox: click on the menu button and select 'Settings'. Then select the 'Privacy & Security' panel. Under the 'Privacy' section, choose 'Standard', 'Strict', or 'Custom' depending on your desired level of cookie blocking. Click 'Reload all tabs' to apply changes.

   If you use Chrome: click on the menu button and select 'Settings'. Open the 'Privacy and Security' tab, then click 'Third-party cookies' and select either 'Block third-party cookies in Incognito' or 'Block third-party cookies' depending on your preference. All changes are saved automatically.

   If you use Microsoft Edge: select 'Settings', then the 'Cookies and site permissions' tab, then click 'Manage and delete cookies and site data'. Uncheck 'Allow sites to save and read cookie data (recommended)' or, if you only want to block third-party cookies, select 'Block third-party cookies'. All changes are saved automatically.