This privacy policy (hereinafter the "Privacy Policy") details how Bal du Moulin Rouge S.A., a public limited company with capital of 4,515 676.00 euros, registered with the Trade and Companies Register of Paris under the number B 552 046 120, having its registered office at 82 Boulevard de Clichy - 75018 Paris (France) (hereinafter the "Moulin Rouge"), collects and processes the personal data of the users (hereinafter the “Users” who visit or use the features and services offered on either of the Moulin Rouge's websites accessible at the URLs www.moulinrouge.fr and www.moulinrougestore.com(hereinafter the "Websites").

The person in charge of the questions regarding the personal data protection of the Moulin Rouge can be reached at the following address information@moulinrouge.fr.

Constitutes a personal data any information related to the User, as identified individual or who could be identified, directly or indirectly, by reference to an identification number or to one or several elements of its own (notably its name, surname, date of birth, postal address, email address, photo, curriculum vitae, hereinafter referred “Personal Data”).

The Privacy Policy covers all the processing carried out by the Moulin Rouge and forms an integral part of the general terms and conditions of use, the general terms and conditions governing ticket sales and the general terms and conditions for the sale of products online which the User must read and also accept, if applicable.

The Moulin Rouge encourages the Users to carefully read the terms and conditions of the Privacy Policy before using any of the Websites and disclosing any of their Personal Data.

Users can consult the Privacy Policy on the Websites at any time, outside the maintenance period, by clicking the link labelled "PERSONAL DATA" at the bottom of the web pages of the Websites.

To the extent permitted by law, if there is any contradiction between the French version of the Privacy Policy and the English translation, the original French version will prevail.

1. 1. Ethics

The Moulin Rouge and, where applicable, its subsidiaries and affiliates, protect the privacy of Users by complying with the laws in force.

To this end, the Moulin Rouge and, where applicable, its subsidiaries and affiliates, collect and process the Personal Data concerning the Users in accordance with the national and European laws in force and notably the Regulation (EU) 2016/679 of the General Data Protection Regulation (hereinafter “GDPR”).

All Personal Data is processed with due care and confidentiality.

The Privacy Policy details how the Moulin Rouge and, where applicable, its subsidiaries and affiliates, use the Personal Data and inform Users of the measures taken by the Moulin Rouge to ensure the protection of Personal Data, in accordance with the provisions of the French Data Protection Act (Loi Informatique et Libertés) of 6th January 1978 as amended (hereinafter the "French Data Protection Act") and in accordance with provisions of the GDPR.

2. Collection of personal data

2.1 To view and visit the Websites, the User does not, in principle, have to provide any of his own Personal Data, excepting Cookies potentially implemented under the conditions specified hereunder.

The Moulin Rouge is only likely to collect Personal Data from Users through the tabs "CONTACT", "NEWSLETTER", "RECRUITMENT", "ACCOUNT", "ORDER" or "RESERVATION" in order to ensure proper monitoring of the requests made by the User.

2.2 Any User wishing to subscribe to the newsletter, open an account, place an order or make a reservation through the Websites must complete a detailed application form as provided for this purpose, give information about his identity, provide a valid e-mail address, and confirm his consent to the general terms and conditions of use (GTCU) and to the general terms and conditions of sale applicable (GTCS) as well as to this Privacy Policy.

2.3 Any User wishing to apply as an artist or dancer must complete a detailed application form as provided for this purpose, give information about his identity, provide a valid e-mail address, and confirm his consent to this Privacy Policy.

In support of his application and to demonstrate his artistic talent, if he wishes, the User may also upload photographs and a link to a media of his choice so as to illustrate his skills (e.g. presentation of his CV on LinkedIn, performance art videos on YouTube, etc.).

2.4 When gathering the Personal Data, the User expressly agrees to provide only information that is complete, accurate and up to date, and not detrimental to the interests or the rights of third parties.

The information required in order to carry out the tasks described above is indicated by an asterisk in the different pages of the Websites concerned. The other information is optional.

3. Purpose and legal basis of the processing of personal data

The personal data processing carried out by the Moulin Rouge has for legal basis the execution of the contract and the precontractual measures or the consent of the Users.

The Moulin Rouge processes Personal Data particularly in order to:

- send information related to the activities of the Moulin Rouge;

- manage the Users' profiles and orders through the accounts;

- manage the reservation and ticketing services;

- carry out operations related to promoting the activities of the Moulin Rouge, including commercial prospecting and the management of technical prospecting operations (which includes, in particular, technical operations such as standardization, enrichment and data deduplication) in compliance with the laws in force;

- manage requests from Users and develop the statistics needed to improve the Websites;

- organise contests, lotteries or any promotional activity;

- carry out the recruitment of new artistic talent and manage the applications;

- manage requests for the right to access, correct, object, limit and have personal data deleted in accordance with the General Terms and Conditions.

4. Recipients of the personal data

The Moulin Rouge is responsible, as controller, for the processing of the Personal Data of Users As listed here above.

ATHYS, a limited liability company with capital of €7,622.45, registered with the Trade and Companies Register of Paris under the number RCS 410 723 886, having its registered office at 82 Boulevard de Clichy - 75018 Paris, as a subsidiary of the Moulin Rouge, is the recipient and sole party responsible for processing the Personal Data of Users wishing to apply as an artist or dancer.

Within the limits of their respective duties, the following parties may have access to all or part of the Personal Data:

• the teams in charge of developing the Websites, and promoting the commercial products and services of the Moulin Rouge;

• the teams in charge of auditing (auditor, teams responsible for internal audit procedures...);

• the subsidiaries and affiliates of the Moulin Rouge in charge of managing all or part of the services offered by the Websites, including recruitment activities;

• the subcontractors in charge of providing the technical services related to the administration, maintenance and hosting of the Websites, in compliance the national and European provisions applicable regarding the personal data protection;

• the subcontractors in charge of ensuring the secure online payment services, in compliance with the provisions of the the national and European provisions applicable regarding the personal data protection;

• organisations, court officials and ministerial officers.

5. Storing and security of the personal data

5.1 Personal Data Retention

The Personal Data is generally stored for as long as it is strictly necessary for managing the relationship between the Moulin Rouge and the Users. The durations of the personal data retention depend on the purposes for which the data are collected and processed.

The Personal Data is stored by the Moulin Rouge throughout the effective period of use of the Websites by the User and, where applicable, for a maximum period of 3 years from the User's last login to his account.

At the end of this 3-year period, the Moulin Rouge may contact the User again to see if he wants to keep his account and continue to receive information related to the activities of the Moulin Rouge. In the absence of an explicit and positive response from the User, his Personal Data will be deleted or anonymized according to the provisions in force.

Personal Data which enables establishing proof of a purchase or reservation may, however, be archived in accordance with the provisions in force (in particular that provided under the Commercial Code, the Civil Code and the Consumer Code).

Personal Data relating to recruitment activities (tabs "CASTING ATTRACTIONS" and "DANCER AUDITIONS") is stored for a period of 5 years from the last contact with the candidate.

All processing operations that may be initiated by Bal du Moulin Rouge is summarized in the table hereafter :