Privacy Policy | Chocolats Frigoulette

This translation is provided for your convenience: in the event of any discrepancy, the French version prevails.

1. Data controller

The controller of the data collected via this website is SAS FRIGOULETTE.

For any question about your personal data: contact@chocolats-frigoulette.fr.

2. Data collected and purposes

The personal data collected depend on the features you use. The full list appears in the Subprocessors section below, where each recipient states precisely which data it processes and for what purpose.

Contact forms and “Become a stockist”

Data: your name, your email address, your telephone number (optional on the contact form) and your message; for a shop, in addition, the name of the shop, its type of business, its town and, if provided, its SIRET number and its website or Instagram or Facebook page.
Purpose: to reply to you and, for a shop, to consider a proposal to sell our chocolates. These data are used for nothing else and are neither sold nor used for advertising.
Legal basis: our legitimate interest in replying to the requests sent to us and, for a shop, pre-contractual measures taken at its request (Art. 6.1.b and 6.1.f GDPR).
Retention: no more than 3 years after the message is sent, followed by automatic deletion. You may ask for them to be deleted before then.

Workshop and tour bookings

Data: your name, your email address, your telephone number, the session chosen and the number of participants; if you wish (optional fields), the ages of the children, your allergies or intolerances and a comment (birthday, reduced mobility...). During payment, a fingerprint of your IP address (never the address itself) limits the number of payments open at the same time, to prevent abuse.
Purpose: to organise the session booked, to keep you informed (confirmation, reminder, change or cancellation), to refund you where applicable and to issue the invoice. The ages of the children, the allergies and the comment are used only to prepare and adapt the session: they appear on the chocolatiers’ printed schedule, which never leaves the chocolate factory and is thrown away after use.
Legal basis: the performance of your booking (Art. 6.1.b GDPR) and our accounting obligations for the invoice (Art. 6.1.c); for allergies, which are health data, your explicit consent, given by ticking the box provided (Art. 9.2.a), which you may withdraw at any time by writing to us; for the comment and the ages of the children, your consent, given by filling in these optional fields.
Payment: it is processed by Stripe (see the subprocessors below). We never receive your bank card details, only confirmation of the payment and the reference that allows us to refund you.
Emails: the confirmation, the reminder and the notices of cancellation or refund are sent to you from the chocolate factory’s email account (contact@chocolats-frigoulette.fr, Microsoft 365: see the subprocessors below). The text of your allergies or of your comment is never sent by email.
Retention: automatic deletion, with no need for you to ask.Allergies and the ages of the children: 7 days after the session. The comment: the day after the session. The fingerprint of the IP address: after one day. A booking whose payment did not go through: deleted 30 days later (30 days after the session for a booking cancelled without anything having been paid online). Other bookings: anonymised 3 years after the session (name, email address and telephone number erased, only the amounts remain for accounting purposes). The log of emails sent (address, subject): 6 months. Invoices: 10 years, as required by law.

Group requests

Data: your name, your email address, your telephone number, the type of group, the activity and date requested, the number of people and your message (optional).
Purpose: to reply to you with a proposal (date, programme, price) and, if you accept it, to record your group’s booking.
Legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR).
Retention: no more than 3 years after the request is sent, followed by automatic deletion. You may ask for them to be deleted before then.

3. Legal basis for processing

Depending on the context, the processing of your data is based on one of the legal bases provided for in Article 6 of the GDPR: performance of a contract, legitimate interest, consent, or legal obligation.

4. Where your data are stored

Your data are hosted in the European Union, in Frankfurt (Germany) and in France:

the database (orders, messages, contact details) is hosted by Neon on its Frankfurt servers;
the website’s processing (orders, payment, forms) runs on Vercel’s servers in Frankfurt;
the website’s files (product photos) are stored by Cloudflare in the European Union;
for the preparation and invoicing of your order and for sending your invoice by email, your order and your contact details (name, address, email address, telephone number) are entered in our business management software (Dolibarr), installed and hosted by the company Scopen (Valence) on servers located in France.

Neon, Vercel and Cloudflare are American companies: any access they may have to your data is governed by the European Commission’s standard contractual clauses. Card payments are processed by Stripe Payments Europe (Ireland), and the video on the “Visit the chocolate factory” page is provided by YouTube: their terms are set out below.

Booking and alert emails are sent from the chocolate factory’s Microsoft 365 email account (the contact@chocolats-frigoulette.fr mailbox), hosted in the European Union; a copy remains in that mailbox’s Sent Items. Microsoft may occasionally transfer data to the United States, under the EU-US Data Privacy Framework and the standard contractual clauses.

5. Subprocessors and recipients

To provide you with this service, we use third-party subprocessors. Each subprocessor processes only the data strictly necessary for its task, under a contract that complies with Article 28 of the GDPR.

Vercel Inc.

440 N Barranca Ave #4133, Covina, CA 91723, USA

Frankfurt (EU)

Purpose

Website hosting and execution of server functions (Frankfurt region - fra1)

Data processed

IP addresses
Server logs
Session cookies

Retention

30 days for logs

Legal basis

Legitimate interest (Art. 6.1.f GDPR)

Transfer / details

Website processing runs in Frankfurt (Germany, fra1 region). US company: Standard Contractual Clauses (SCC).

Find out more

OpenFreeMap

Open source project, dedicated servers in Hungary (EU)

Purpose

Map display: the vector tiles are loaded directly by the visitor’s browser

Data processed

Visitor IP address
Map area being viewed

Retention

No retention announced beyond the server’s technical logs

Legal basis

Legitimate interest (Art. 6.1.f GDPR)

Transfer / details

No transfer outside the EU. Open source project with no formal data processing agreement: no data is deliberately sent to it, only the visitor’s IP address reaches it, as with any resource loaded from another domain

Find out more

Databricks, Inc. (Neon)

160 Spear Street, 13th Floor, San Francisco, CA 94105, USA

Frankfurt (EU)

Purpose

PostgreSQL database hosting

Data processed

All application data stored in the database

Retention

Account lifetime (deletion on request)

Legal basis

Contract performance (Art. 6.1.b GDPR)

Transfer / details

Database hosted in Frankfurt (Germany, AWS eu-central-1 region). US company: Standard Contractual Clauses (SCC).

Find out more

Cloudflare, Inc.

101 Townsend Street, San Francisco, CA 94107, USA

Purpose

File storage and distribution (uploaded binary objects)

Data processed

User-uploaded files
Metadata (name, MIME type, size)

Retention

Account lifetime (deletion on request)

Legal basis

Contract performance (Art. 6.1.b GDPR)

Transfer / details

Files stored in the European Union (Cloudflare’s EU jurisdiction). US company: Standard Contractual Clauses (SCC).

Find out more

Stripe Payments Europe, Limited

1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

Purpose

Card payment processing

Data processed

Name
Email
Billing address
Payment information (card numbers never transit through our server, entered directly with Stripe)

Retention

Legal accounting period (10 years in France)

Legal basis

Contract performance (Art. 6.1.b GDPR) + legal obligation (Art. 6.1.c)

Transfer / details

Technical data may be transferred to Stripe, Inc. (USA) under Standard Contractual Clauses

Find out more

SARL Scopen (Dolibarr business management software)

26 rue Barthélémy de Laffemas, 26000 Valence, France

France

Purpose

The chocolate factory’s business management software (Dolibarr), installed and hosted by Scopen: recording of website orders, stock management, issuing invoices and sending invoices by email

Data processed

First and last name
Postal address
Email
Phone
Order details

Retention

Legal accounting period for orders and invoices (10 years in France)

Legal basis

Contract performance (Art. 6.1.b GDPR) + legal obligation (Art. 6.1.c)

Find out more

Microsoft Ireland Operations Ltd (Microsoft 365)

One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland

European Union

Purpose

The chocolate factory’s email service (Microsoft 365): website emails sent from the contact@chocolats-frigoulette.fr mailbox (workshop and tour bookings: confirmation, reminder, cancellation, refund; alerts to the chocolate factory)

Data processed

Recipient’s email address
First name and surname
Email content: session booked, number of participants, amount, personal tracking link (never the text of an allergy or special requirement)

Retention

Copy of emails in the Sent Items of the contact@chocolats-frigoulette.fr mailbox. Our own sending log (address, subject): 6 months.

Legal basis

Contract performance (Art. 6.1.b GDPR)

Transfer / details

Email service hosted in the European Union (Microsoft EU Data Boundary). Occasional transfers to the United States possible, governed by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC).

Find out more

6. Your rights

Under the GDPR, you have the following rights over your data:

Right of access and rectification
Right to erasure (right to be forgotten)
Right to data portability
Right to object to and to restrict processing
Right to withdraw your consent at any time (where processing is based on consent)
Right to lodge a complaint with the CNIL, the French data protection authority (cnil.fr)

To exercise your rights: contact@chocolats-frigoulette.fr. We undertake to reply within one month at most.

7. Cookies

By default, this website uses only the cookies strictly necessary for it to work (session, preferences). No advertising or profiling cookie is placed without your explicit consent.

To count visits, we use Vercel Web Analytics, provided by our host: it places no cookie, does not track you from one website to another and does not keep your IP address. It only gives us totals (pages viewed, country, type of device, referring website). No consent banner is therefore needed.

Your basket is kept in your browser (local storage) so that it is not lost from one visit to the next. If you tick “Remember my details” when ordering, your contact details are also kept there for your next order: they remain on your device and are not sent to us for this purpose. Untick the box when placing an order, or clear the website’s data in your browser, to delete them.

The “Visit the chocolate factory” page features a video hosted by YouTube (youtube-nocookie.com). It loads and starts playing, without sound, when it appears on screen (or when you click on it): YouTube is then contacted and may place cookies or trackers in accordance with its own privacy policy.

8. Changes

This policy may be updated to reflect changes in the services and subprocessors used. The date of the last update is shown at the top of this page. Substantial changes will be notified by email to holders of a user account.