Legal document · GDPR
Privacy policy
Pink October Raffle · Fonds de Dotation Paris Saint-Germain (PSG for Communities), in aid of the Groupe Hospitalier AP-HP. Sorbonne Université — how your personal data is processed when you enter the Raffle.
Document being completed
This policy restates the information already set out for the Pink October Raffle (the same data controller and retention period as in article 13 of the raffle terms and conditions). The exact trade name and domain of the payment provider mentioned in section 4 remain to be confirmed by the Organiser; they will be specified once confirmed. Only the online version of this page is authoritative.
Section 1
Data controller
The controller responsible for the personal data collected as part of the Pink October Raffle is:
- Company name
- Fonds de Dotation Paris Saint-Germain (umbrella brand: PSG for Communities)
- Legal form
- Endowment fund governed by French Act No. 2008-776 of 4 August 2008 on the modernisation of the economy
- Registered office
- 24 rue du Commandant Guilbaud, 75016 Paris
- Correspondence address
- 53 avenue Émile Zola, 92100 Boulogne-Billancourt
- SIREN
- 801 152 190
- Data Protection Officer
- dpo@psg.fr
This information appears, in identical terms, in Article 1 of the raffle terms and conditions and to section 1 of the legal notice.
Section 2
Data collected
When you enter the Raffle, the following categories of data are collected:
- Identity — first name, surname (to identify the participant and personalise the ticket);
- Contact details — email address, phone number, postal address (sending the electronic ticket, notification in the event of a win, shipping the prize);
- Order data — number of tickets purchased, amount, transaction reference, pack selected (management of the purchase and accounting for the operation);
- Marketing consent (optional) — if the corresponding box is ticked at the time of purchase, to be contacted about other communication campaigns run by the Fonds de Dotation Paris Saint-Germain or Paris Saint-Germain Football.
No health, racial or ethnic origin, opinion data, or any other data deemed "sensitive" within the meaning of the GDPR is collected, even though the Raffle supports a health-related cause. No user account is required to enter. No bank details are stored by the Organiser or by its technical provider: payment is processed directly by the payment provider (cf. section 4).
Section 3
Purposes & legal bases
Your data is used only for the purposes described below and is not sold or transferred to third parties for commercial purposes.
| Purpose | Legal basis |
|---|---|
| Management of entries (ticket purchases, ticket issuance) | Performance of the contract entered into when purchasing a ticket |
| Organisation of the prize draw and allocation of prizes | Performance of the contract |
| Notification of winners and delivery of prizes | Performance of the contract |
| Keeping participants informed about the operation (reminders, campaign news) | Legitimate interest of the Organiser |
| Communication about initiatives of the Fonds de Dotation Paris Saint-Germain and Paris Saint-Germain Football, if you have consented to it | Consent (unticked checkbox at the time of purchase) |
| Compliance with legal and regulatory obligations (prefectural declaration, accounting, fraud prevention) | Legal obligation |
No cookie or tracker is used for audience measurement or advertising purposes — see section 8.
Section 4
Recipients & processors
Your data is accessible only to authorised personnel of the Organiser, as well as to the following providers, acting as processors within the meaning of article 28 of the GDPR:
- Technical provider
- GoTombola — gotombola.co (opens in a new tab), a ticket sales platform, handling entry management and the electronic prize draw.
- Payment provider
- HelloAsso, responsible for the secure collection of ticket payments on behalf of the Organiser (the exact trade name and domain to be confirmed).
These providers act under a contract that strictly limits their processing to the instructions of the Organiser and to the sole purposes described in section 3. Other than these providers, no other third party has access to your data, except where legally required (judicial order, supervisory authority).
Section 5
Retention period
| Data type | Retention |
|---|---|
| Participant data (identity, contact details, order) | 12 months after the operation closes (31 October 2026), then deletion — see article 13 of the terms and conditions |
| Marketing consent | Until consent is withdrawn, then deletion or anonymisation |
| Accounting records relating to payments | 10 years, in accordance with the legal obligation to retain accounting documents (article L. 123-22 of the French Commercial Code) |
| Technical connection logs (security, fraud prevention) | 12 months maximum |
Once these periods have elapsed, data is securely deleted or anonymised, unless a longer legal retention obligation applies.
Section 6
Your rights
In accordance with the GDPR and the "Informatique et Libertés" Act, you have the following rights:
Right of access
Obtain confirmation that your data is being processed and receive a copy of it.
Right to rectification
Have inaccurate or incomplete data about you corrected.
Right to erasure
Request the erasure of your data, under the conditions provided for by the GDPR.
Right to restriction of processing
Request that the processing of your data be temporarily restricted.
Right to object
Object, on legitimate grounds, to processing based on legitimate interest.
Right to data portability
Receive your data in a structured format and transmit it to another controller.
These rights may be exercised with the Data Protection Officer (section 7). The Organiser undertakes to respond within one month. You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority (opens in a new tab).
Section 7
Contact & DPO
- dpo@psg.fr
- Post
- Data Protection Officer — Fonds de Dotation Paris Saint-Germain, 53 avenue Émile Zola, 92100 Boulogne-Billancourt
For any general question about the Raffle, you may also write to mecenat@psg.fr.
Section 8
Cookies & trackers
This website (homepage, prize draw results, sharing page, legal pages) places
no cookie for analytics, advertising or personalisation, and no browsing data is
stored locally (no localStorage nor
sessionStorage) on these pages.
A single strictly functional cookie may be set:
locale. It is written only if you explicitly choose a language
using the FR / EN / ES selector in the navigation bar, so that the site can be served
to you in that language on your next visits. If you make no choice, no cookie is set: the language is
then simply inferred from the preferences declared by your browser.
This cookie contains only a two-letter language code (fr, en or
es), allows no identification, is never passed to any third party and expires after
twelve (12) months. As it answers a request you have expressly made, it is exempt from consent
under Article 82 of the French Data Protection Act: no consent banner is therefore required.
You may delete it at any time from your browser settings, with no consequence other than a return
to automatic language detection.
The participant's private areas (ticket details, sale details, entry result) are
also free of any telemetry: they are served with a strict security policy
(connect-src 'self', Referrer-Policy: no-referrer) and are neither
indexed nor tracked (noindex, nofollow).
The purchase tunnel (the "Enter the raffle" section of the homepage) redirects, at the point of payment, to the payment provider's domain (cf. section 4). Any cookies placed at this stage are the sole responsibility of that provider and its own privacy policy, available on its website.
Section 9
Security & transfers outside the EU
The Organiser and its technical provider GoTombola implement appropriate technical and organisational measures: encryption of exchanges (HTTPS/TLS), a content security policy (CSP) restricting the domains authorised to load resources, no storage of bank details on the Organiser's side, and data access limited to authorised personnel only.
Data is hosted on GoTombola's cloud infrastructure, in the European zone (cf. legal notice, section 4). To the best of the Organiser's knowledge, no data is transferred outside the European Union to date. Should such a transfer become necessary, it would be governed by the safeguards provided for by the GDPR, in particular the European Commission's standard contractual clauses.
Section 10
Changes to this policy
This policy may be updated, in particular to take account of legal, regulatory or technical developments. The date of the last update appears at the top of this page. We invite you to consult it regularly.
Additional documents: raffle terms and conditions, legal notice.