Privacy policy

Last updated: 30 September 2026

This policy explains what data concerts.paris processes, why, and how to exercise your rights. It supplements the legal notice (in French). The General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the French Data Protection Act (loi Informatique et Libertés) apply. This English text is a translation of the French version, which prevails in case of discrepancy.

1. Data controller

The data controller is the publisher of the site, Hestia Data (SAS), 29 boulevard Edgar Quinet, 75014 Paris, France. Data contact: privacy@concerts.paris.

2. Data we collect

concerts.paris deliberately keeps data to a minimum:

• No user account: browsing the listings and event pages never requires a login or a password.
• Browsing data (server logs, IP address, user agent, pages viewed) for security and proper operation.
• Your email address, if you enter it yourself — and only then: newsletter sign-up, a request to be notified when an artist comes back to Paris, or a request to be notified if tickets go back on sale for a sold-out show. We then record the address, the date of your consent, the page you signed up from, the display language, the text shown to you, your browser and your truncated IP address — these details serve only to demonstrate your consent, as the law requires. Depending on the case, we also record the artist or show concerned. None of these addresses is sold or transferred; every email includes an unsubscribe link.
• Cookieless usage measurement: to know which features are actually used, the site records anonymous interactions (filter used, a venue's calendar viewed, an audio/video player opened, page viewed, visit duration). Each record carries an ephemeral visit identifier, randomly generated, kept in the tab's memory (sessionStorage, not a cookie) and destroyed when the tab is closed: it can neither recognise you from one visit to the next nor follow you from one site to another. No IP address, no profile.
• Audience measurement: see the section Cookies and trackers.
• Emails you send us (contact, reports) and their content.

3. Purposes and legal bases

• Providing the listings and event pages — performance of the service / legitimate interest.
• Security, abuse prevention, logs — legitimate interest.
• Newsletter and alerts (an artist coming back, tickets available again) — your consent, given by entering your address in the dedicated form. You can withdraw it at any time (unsubscribe link or a simple email), without giving a reason: withdrawal does not affect the lawfulness of emails already sent.
• Cookieless usage measurement (knowing which features are used, and improving the site) — legitimate interest. The measurement is strictly limited to this purpose, combines no personal data and follows no one from site to site: it falls within the audience measurement that the CNIL (French data protection authority) guidelines exempt from prior consent.
• Audience measurement with cookies — your consent.
• Ticketing affiliation — legitimate interest (commercial tracking of the sales generated), the affiliation cookies being set by the partner after your click.

4. Cookies and trackers

• Strictly necessary — the cp_consent cookie remembers your choices (duration: 6 months). Exempt from prior consent.
• Cookieless audience measurement — Cloudflare Web Analytics sets no cookie and does not track visitors from one site to another. In line with the CNIL guidelines, this measurement is exempt from consent.
• Cookieless usage measurement (internal) — an ephemeral visit identifier is written to the tab's memory (sessionStorage, key cp_session) and disappears when the tab is closed. No cookie, no third-party tracker, no cross-site tracking. Details of the data: section 2.
• Audience measurement with cookies — Google Analytics 4 (Google Ireland Ltd), loaded only after your consent via the banner. Google Consent Mode v2 is enabled: no signal is sent without consent. Cookie duration: 13 months maximum (CNIL recommendation).
• Affiliation — our “Book” links to partner ticketing sites are tracked (Awin, Impact and Kwanko programmes, active today). We set no affiliation cookie: the ticketing site sets its own, on its site, after your click, to attribute the sale (variable duration, often 7 to 30 days). You then leave concerts.paris and fall under the partner's privacy policy. On our side, the click is only counted in aggregate (no cookie, no IP address kept).

On your first visit, a banner lets you accept, refuse or customise non-essential cookies. You can change your choice at any time via “Manage cookies” at the bottom of the page. See the CNIL guide on cookies (in French).

5. Embedded third-party content and media

To help you discover artists, some event pages embed media players provided by third-party services:

• Spotify and Deezer — we may show a Spotify listening player and Deezer audio previews of the artist. These players are governed by the respective privacy policies of Spotify and Deezer.

YouTube (YouTube API Services)

• What we use. concerts.paris uses the YouTube API Services (YouTube Data API) to find an artist's video or a show's trailer, and the YouTube embedded player to display it on event pages and artist pages. By watching a YouTube video on our site, you agree to be bound by the YouTube Terms of Service. Data processed by YouTube is handled under the Google Privacy Policy.
• What we collect and store. No personal data goes through the YouTube API: we never ask you to sign in to YouTube or Google, we access no account and keep no authorisation token. We only store the public ID of the video to display (and, for some venues, the ID of their official YouTube channel). Every ID is re-checked with YouTube at least every 30 days: if it is no longer public or embeddable, it is deleted; the ID of an archived event page is deleted.
• Use and sharing. These IDs are used only to display the corresponding video. We do not share any data obtained through the YouTube API, do not sell it, and do not use it for advertising or to track you.
• What happens on your device. Before you click, only the video thumbnail is loaded (an image served by YouTube, i.ytimg.com): your browser then sends Google the technical information of any web request (IP address, browser). When you click “Play the video”, the YouTube player loads in privacy-enhanced mode (youtube-nocookie.com) and shares basic data about your use with YouTube (IP address, device, playback). YouTube and Google may then place or read cookies and local storage data on your device, and serve third-party content, including advertisements, in the player. On our side, we set no YouTube-related cookie; we only count, anonymously, that a player was opened (cookieless usage measurement, section 2).
• Control and revoke. concerts.paris never asks for access to your Google account. You can review or revoke the access you have granted to applications at any time on the Google security settings page, and clear YouTube cookies from your browser. Any request to delete data relating to you, sent to privacy@concerts.paris, is handled within 7 days.
• Contact us. Questions or complaints about how concerts.paris uses YouTube: privacy@concerts.paris or the contact page (in French).

6. Recipients

• Our technical processors (hosting, database, CDN).
• Scaleway (Scaleway SAS, a French company) — our email provider, whose servers are located in France (Paris region). It processes your address on our behalf, solely to deliver the messages you asked for (sign-up confirmation, newsletter, artist alert, “tickets available” alert) or to reply to a message you sent us.
• Embedded media providers — Google / YouTube, Spotify and Deezer — when a page loads an embedded player (see section 5). We send them no data: it is your browser that connects to them.
• Partner ticketing sites, only through the cookies/trackers they set on their own sites after your click.
• Competent authorities, upon legal request.

We do not sell your data. Some processors may be located outside the European Union; where applicable, appropriate safeguards govern the transfer (standard contractual clauses or an adequacy decision).

7. Retention periods

• Technical logs: 12 months maximum.
• Audience measurement cookies: 13 months maximum.
• Consent choice (cp_consent): 6 months.
• Cookieless usage measurement: 90 days, then automatic deletion by the database. Nothing is kept beyond that.
• Email address (newsletter, artist alert, “tickets available” alert): until you unsubscribe, and at most 3 years from your last interaction (sign-up, click on a link, email received), in line with the CNIL recommendation on marketing files. Deletion is automatic. We also delete: a sign-up still unconfirmed 30 days after the confirmation request was sent, and an alert whose concert took place more than 30 days ago.
• Proof of your consent: to be able to show that you did agree (and to what), we keep, for the same period as your address, the date, the sign-up page, the language, the exact text displayed to you, your browser and your truncated IP address (only the network is kept, never the full address).
• After you unsubscribe: we keep an irreversible fingerprint of your address (never the address itself) so as never to contact you again, even if it reached us again by another route. This fingerprint cannot be used to recover your address.
• Emails received: 3 years from the last exchange.
• YouTube video and channel IDs (no personal data): re-checked with YouTube at least every 30 days, deleted if no longer available (see the YouTube section).

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent to cookies and to set instructions regarding what happens to your data after your death.

To exercise them: privacy@concerts.paris (reply within one month). You may also lodge a complaint with the CNIL.

9. Contact

Questions about this policy: privacy@concerts.paris · contact page (in French).