3.01. Mapping and organizing my data

Audience data management in the cultural sector relies on several tools that enable the collection, analysis, and exploitation of these data. Among these tools are ticketing software, CRMs (Customer Relationship Management), websites and analytics tools, emailing tools, as well as files contained in spreadsheets...

Before implementing costly tools or sophisticated actions, it is essential to ensure the quality and usability of the data you possess. Conducting an audit and analysis of existing data allows you to identify the strengths and weaknesses of your current system and refine your strategy.

Furthermore, for compliance with the GDPR, a detailed mapping of personal data processing is mandatory (see 9. What is the regulation applicable to personal data?). This is therefore an opportunity to be both effective AND up to date with your legal obligations!  

This table is indicative and helps to understand the nature of data collected within your organization. You should identify your own uses as precisely as possible.

Identity: Title, last name, first names, address - including billing address, phone number, fax number, email addresses, date of birth, internal processing code identifying the client, accounting identification code, user IP address.

Personal situation: Marital status, number of people in the household, number and age of child(ren) in the household.
For example, in the marketing of Family cards, or identifying that a couple regularly attends together, or that a senior adult (grandparent?) often comes with children (grandchildren?), you possess expressed or deduced information on the personal situation of your audience.

Be careful: collecting sensitive data-that is, data likely to reveal alleged racial or ethnic origin, political, philosophical or religious opinions, union membership, sexual orientation, or health information about the person concerned-is prohibited. For performing arts venues, pay particular attention to information related to the disabilities of your audiences. Rather describe the services your audiences need without specifying types of disabilities.

Professional life: Profession, socio-professional category, activity.
Indeed, in your ticketing file, for example, you have professional information, at least about your group relay spectators, such as teachers or socio-cultural facilitators. More generally, from the moment you have a link between a record and a professional organization or a column with the company name.

Personal practices: Types of shows attended, types of outing habits (in group, alone, as a couple...), information on the device used to connect to the website (smartphone, brand...).

Payment / Billing: Data related to credit card (number, expiry date, CVV), bank transfer (RIB), or check.
These personal data are also stored by the accounting department. This is a processing not to be overlooked.

Transaction: Transaction number, details of the purchase, subscription, good or service subscribed to.

Relationship tracking: Information requests, tickets and products purchased, memberships or subscriptions subscribed, services included in the order and invoice, quantity, amount, periodicity, date and amount of the order and invoice, invoice due date, delivery conditions and address, purchase history, sales origin (ticket counter, online, public relations team member...).

Reviews: Data relating to contributions from people posting reviews on shows or the organization, including their pseudonym.  

Objective: to list all databases and files containing information about your spectators.
Tools: Excel files, CRM, ticketing software, newsletters, social networks...

To establish your data processing register, you must precisely identify:

• the stakeholders (representatives, subcontractors, co-controllers, etc.) involved in data processing: this is where you concretely list the tools and software deployed within your organization, their vendors, and the team members responsible for them
• the categories of data processed: identity, family, economic or financial situation, banking data, connection data, location data, etc.
• the purposes: what the data is used for (what you do with it), who accesses the data and to whom it is communicated
• the retention periods you apply: you can refer to a retention schedule such as those published by CNIL¹ in France
• how the data is secured and protocols in case of a security breach.

It is also at this stage that you should determine if some datasets are inaccessible. For example, customer data for sessions sold via certain distributors may be inaccessible to ticketing issuers, even in case of cancellation or postponement. For files you access upon request from the software vendor, ensure the file format and column ordering, as each software vendor designs their data architecture differently, and each team defines their usages and settings.

Note: we also remind you that here we speak about personal data related to your spectators from a marketing and audience development perspective. The inventory of data sources for GDPR compliance goes much further, as it involves listing all personal data processing: data on your employees, artists, private partners, etc.  

¹(FR) CNIL - Référentiel relatif aux traitements de données à caractère personnel mis en œuvre aux fins de gestion des activités commerciales (external link)

Objective: Evaluate the reliability and usability of the collected data. Data quality analysis aims to identify and resolve errors, gaps, and potential issues before any further analysis or modeling. It involves checking for missing values, inconsistent values, erroneous information, and incorrect metadata.

Analysis criteria:

• Completeness: Are any essential pieces of information missing? (e.g., email address, postal code, visit frequency)
• Reliability: How old is the data? Is it regularly updated? Are there duplicates?
• Consistency: Are the data homogeneous and comparable or assimilable across different sources? Can correspondences or alignments be established between different files?
• Minimization: Could some collected data be unnecessary? How can the amount of collected data be reduced?

Actions:

• Data cleaning and enrichment: Removing duplicates, updating contacts. These actions should be regular and part of the teams' work schedule.
• Implementation of a data management charter (for data entry, updating), a document describing the strategy and basic process related to exercising control and authority over an organization's data assets.
• Appointment of a data governance referent to ensure ongoing monitoring of data quality and compliance. This person may serve as the Data Protection Officer (DPO), mandatory for GDPR compliance, provided there is no conflict of interest related to data use. For example, the person in charge of relational marketing cannot be the DPO.

In application of the data minimization principle, only data necessary for the implementation of the intended purpose of relational and commercial management processing may be collected. Data minimization notably supports the retention of accurate and up-to-date data.  

• [EN] [NL] Stappenplan: publieksdata in de cultuursector (external link) / Manual (use) of audience data in the cultural sector (external link), DEN, 2024
• [FR] Cartographier vos traitements de données personnelles (external link), CNIL
• [FR] Guide complet de cartographie des données (external link), : Masha Komnenic, GDPR Termly, 2022
  
• [EN] GDPR Data Mapping : What is it and how to comply? (external link) IT Gouvernance