I. WHAT
PERSONAL DATA DO WE PROCESS?
The collection of personal data is limited to what is strictly necessary (data minimization principle).
We collect and use only the personal data we need to provide you with high-quality, personalized products and services.
We may need to collect various categories of personal data from you, previously identified as compulsory or optional, in order to manage your request, in particular :
- identification and contact information (company, surname, first name, postal and e-mail address, telephone number, fax number, gender, position and signature);
- Information required for shipping and managing your orders (delivery address, billing address, VAT number, etc.).
- identification and authentication data, in particular when using our services (technical logs, computer traces, security information, IP address);
- data relating to interactions with us on our websites, on our applications, on our pages, on social networks, during interviews and telephone or video conversations and in e-mails);
We never collect sensitive data.
The data we use may be collected directly from you or obtained from the following sources, in order to verify or enrich our databases:
- publications/databases made available by official authorities (Official Journal) ;
- service providers ;
- third parties such as commercial information organizations in compliance with data protection regulations ;
- websites/directories/databases/social network pages containing information that you have made public or that has been made public by third parties.
Where the processing of your personal data is based on your consent, you may decide to withdraw it at any time. If your consent is withdrawn, this will not affect the processing of your personal data based on other legal grounds, such as the fulfilment of your orders and the retention of your order data in accordance with applicable law.
If you no longer wish to receive our advertising or promotional information, we remind you that you can revoke your consent to
direct marketing at any time directly from the unsubscribe link included in every advertising e-mail we send you. If you do so, we will promptly update our databases and take all reasonable steps to respond to your request as quickly as possible, but we may continue to contact you to the extent necessary in connection with any product or service you have requested.
II. FOR HOW LONG, WHY AND ON WHAT BASIS DO WE USE YOUR PERSONAL DATA?
We collect your data for the following purposes and on the following legal bases:
- Fulfill your order, carry out operations relating to the management of our customers concerning contracts, orders, invoices, and follow-up of the contractual relationship with our customers. For this purpose, we base our processing on your consent and on the performance of the contract you or your company have entered into with us. Personal data is kept for the duration of the contractual relationship
. In addition, your data (with the exception of your bank details) is archived for evidentiary purposes for a period of 5 years; - Track customer behavior. For this purpose, we base our processing on our legitimate interest in developing and promoting our business. Personal data is kept for 3 years from the date of your last visit to our website;
- To build up a file of customers/prospects. For this purpose, we base our processing on our
legitimate interest in developing and promoting our business. For customers, data is kept for the duration of the contractual relationship. For prospects, data is kept for a period of 3 years from the date of your last contact; - To send newsletters, requests and promotional messages. For this purpose, we base our processing on our legitimate interest in developing and promoting our business. Data is kept for 2 years from the date of your last contact;
- To provide you with information about our products
and services. With regard to this purpose, we base
our processing on our legitimate interest in responding to your pre-sales and post-sales requests. Data is kept for the time necessary to process your request for information and deleted once the request has been processed; - To comply with legal obligations applicable to our business. For this purpose, we base our processing on the need to meet our legal and regulatory obligations. Invoices are archived for 10 years, while data relating to your transactions (with the exception of bank details) is kept for 5 years;
- Manage requests to exercise rights. For
this purpose, we base our processing on the need to meet our legal and regulatory obligations. If we ask you for proof of identity, we keep it only for the time needed to verify your identity.
III. TO WHOM MAY YOUR PERSONAL DATA BE DISCLOSED?
Personal data collected as part of the services offered by CHOCOLAT DEBAUVE ET GALLAIS are processed using secure protocols and enable CHOCOLAT DEBAUVE ET GALLAIS to manage the data received in its IT applications. In order to fulfil the above-mentioned purposes, we may disclose your
personal data only to :
- Members of our company ;
- service providers and subcontractors performing services on our behalf ;
- Distribution network,
- business partners,
- financial authorities, judicial authorities or state agencies, public bodies on request and within the limits permitted by regulations;
- certain regulated professions such as lawyers, notaries, auditors and bailiffs.
Your data is stored on
SHOPIFY's servers in Canada.
In order to process your order, your data may be transferred outside the European Union. Where applicable, the transfer of your data is secured using the following tools:
- or the data is transferred to a country that has been the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the RGPD: in this case, this country ensures a level of protection deemed sufficient and adequate to the provisions of the RGPD ;
- or the data is transferred to a country whose level of data protection has not been recognized as adequate in the RGPD: in this case these transfers are based on appropriate guarantees indicated in Article 46 of the RGPD, tailored to each provider;
- or the data is transferred on the basis of one of the appropriate guarantees described in Chapter V of the RGPD.
IV. WHAT ARE YOUR RIGHTS AND HOW
CAN YOU EXERCISE THEM?
In accordance with the applicable regulations, you have the following rights:
- Right of access: you can obtain information about the processing of your personal data and a copy of your personal data.
- Right of rectification: if you believe that your personal data is inaccurate or incomplete, you may request that it be amended accordingly.
- Right to erasure: you may request the erasure of your personal data to the extent permitted by law.
- Right to restrict processing: you may request that we restrict the processing of your personal data.
- Right to object: you may object to the processing of your personal data for reasons relating to your particular situation. You have the absolute right to object to the processing of your personal data for the purposes of commercial canvassing, including the profiling associated with such canvassing.
- Right to data portability, where this right is applicable, you have the right to have the personal data you have provided to us returned to you or, where technically possible, transferred to a third party;
- The right to set up instructions for the storage, deletion or communication of your personal data, applicable after your death.
- Right to withdraw your consent: if you have given your consent to the processing of your personal data, you have the right to withdraw your consent at any time.
You can exercise your rights by contacting CHOCOLAT DEBAUVE ET GALLAIS at the following postal address: Contact email: [email protected]
Contact address : A l'ATTENTION DU DPO, CHOCOLAT DEBAUVE ET GALLAIS, 30 RUE DES SAINTS-PERES, 75007 PARIS
V. SECURITY OF YOUR PERSONAL DATA
CHOCOLAT DEBAUVE ET GALLAIS uses all technical and organizational security measures to ensure the protection of information concerning you, in compliance with regulations.
To this end, we have implemented technical measures (such as firewalls) and organizational measures (such as a login/password system, physical protection measures, etc.).
VI. COOKIES
Subject to your agreement, CHOCOLAT DEBAUVE ET GALLAIS, as publisher of the Website, may install cookies on the hard disk of your terminal (computer, tablet, mobile...) when you visit our Website.
Cookies are small files stored on your computer when you visit our site.
CHOCOLAT DEBAUVE ET GALLAIS uses the following cookies: XXX [to be completed according to the cookies you use on your Site].
VII. HOW CAN YOU FIND OUT ABOUT CHANGES TO THIS PRIVACY POLICY?
In a world of constant technological change, we will regularly update this information document. We invite you to consult the latest version of this document on our website, and we will inform you of any substantial changes through our websites or by our usual means of communication.
VIII. HOW TO CONTACT US
If you have any questions or complaints regarding CHOCOLAT DEBAUVE ET GALLAIS' compliance with this policy, or if you would like to provide CHOCOLAT DEBAUVE ET GALLAIS with any recommendations or comments to improve the quality of this policy, you may contact CHOCOLAT DEBAUVE ET GALLAIS at the following postal address:
Contact email: [email protected]
Contact address : A l'ATTENTION DU DPO, CHOCOLAT DEBAUVE ET GALLAIS, 30 RUE DES SAINTS-PERES, 75007 PARIS
IX. BREACH OF PERSONAL DATA
In the event of a breach of your personal data, CHOCOLAT DEBAUVE ET GALLAIS undertakes to notify the CNIL under the conditions prescribed by the RGPD.
If you consider that CHOCOLAT DEBAUVE ET GALLAIS is not complying with its obligations with regard to your personal data, you may submit a complaint or a
request to the competent authority. In France, the competent authority is the CNIL, to which you can send an electronic request by clicking on the following link: https: //www.cnil.fr/fr/plaintes.
