Privacy policy

This site collects little data: a contact form, and since 5 October 2026 an audience measurement tool. This page states exactly what is collected, why, and for how long.

Data controller

SPL Lascaux Exposition internationale, 25 rue Wilson, F-24000 Périgueux, France.

What is collected

Personal data is collected only if you write to us through the contact form. It then transmits: first name, last name, email address, organisation, country, subject and message. A checkbox records your agreement before sending; without it, the message is not sent.

The site holds no database: messages are delivered by email and live thereafter in the recipients’ mailboxes.

Why, and on what basis

The data is used solely to handle and answer your request. The legal basis is your consent, given through the form’s checkbox, together with the exhibition’s legitimate interest in replying to enquiries — in particular from museums and organisers.

It is never sold, rented, or passed to third parties for commercial purposes.

Who receives it

The project manager of the Lascaux International Exhibition, and the agency in charge of the website as a technical copy during the development phase. No other recipient.

How long it is kept

Messages are kept for as long as needed to handle the request, then archived in the recipient’s mailbox.

Security

The site is served over HTTPS. The form is protected against automated submissions by a signed token and by a limit on the number of messages: for that limit, your IP address is never stored in clear — only a hashed fingerprint is, for fifteen minutes, after which it disappears.

Cookies and local storage

The site sets no advertising cookies and no social network cookies, and carries out no profiling. It does, however, use an audience measurement tool, described below.

The following cookies are set:

Google Analytics 4 measures how the site is used: pages viewed, referrer, device type. Two cookies are set as soon as a page opens, _ga and _ga_M3G8VZ9CCH, lasting two years, and the data is sent to Google. How long the measurements are kept is set in the SPL’s Google Analytics account. You can opt out by installing the opt-out add-on published by Google, or by blocking these cookies in your browser settings.

Two further items, both necessary to the service:

Vimeo hosts the videos. When a video loads, the vimeo.com domain sets a technical cookie named __cf_bm, lasting thirty minutes, used to tell visitors from bots. It is a security cookie, exempt from consent. The player is called with “Do Not Track” enabled: Vimeo does not measure audience there and sets no advertising cookie. The player library is loaded only when the assembly slideshow is opened, and on no other page.
The contact form uses Turnstile, Cloudflare’s anti-robot check, loaded on that page alone. It tells visitors from machines using technical signals — IP address, browser characteristics — sent to Cloudflare. It was chosen precisely because it sets no advertising cookie and is not used for profiling, unlike the more common captchas. Without it, the exhibition’s inbox fills with solicitations: two automated messages reached it in September 2026.
Your browser keeps two display preferences — whether you have already turned the sound on, and the state of a reading option — in session storage. These are not cookies: nothing is sent to the server, and everything disappears when the tab is closed.

Finally, like any website, the host keeps connection logs for security and diagnostic purposes. They are retained according to the host’s policy and are not used for audience measurement.

Audience measurement is currently active without your prior consent being collected. A choice mechanism, which will hold it back until you accept, is to be put in place shortly; this page will be updated then. In the meantime, the two means given above let you opt out.

Newsletter sign-up is not yet offered: no form appears on the site, and no address is collected for this purpose. When it is, sign-up will use double opt-in, every message will carry an unsubscribe link, and this page will name the tool used and what becomes of the addresses collected.

Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to its processing, and to withdraw your consent at any time. To exercise these rights, write to us through the contact form.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

Updates

This policy may change, in particular if new tools are added to the site. The date of the latest update appears below.

Last updated: 22 September 2026.