1.Who are we ?
1.1 Processing Manager
You are provided with the following information so that you may be aware of Chocolatree’s commitment in terms of the protection of your personal data, as applied by Virginie Labigne of the company Chocolatree, whose headquarters are located at Z.I. “Les Bracots”- BP 23, 74890 BONS EN CHABLAIS.
and who acts in the capacity of Processing Manager for the processing of personal data as defined in this document, hereafter referred to as “the Processing Manager”” or “we/us”.
1.2 Our Data and Freedom Policy Manager
The Processing Manager has appointed a person to be in charge of the data and freedom policy. You can contact this person
by e-mail at the following address: chocolatree@chocolatree.fr
or by letter at the following address: CHOCOLATREE – Z.I. “Les Bracots”- BP 23, 74890 BONS EN CHABLAIS.
The Data Protection Officer can be contacted at the following address: dpo@savencia.com
2.The personal data that we process
As part of the processing of personal data, the Processing Manager collects and processes the following data:
- name, profession, company name, e-mail address
- site activity statistics (pages visited, duration of visits, number of downloads, etc)
3. The purpose and legal foundation for our data processing
3.1 The purpose of the processing
We process personal data for the following purposes:
- To manage the content of an Internet site;
- To manage marketing communication for customers and potential customers;
- To monitor the user’s visit;
- To analyse visits;
3.2 The legal foundation for our processing
We only process data if at least one of the following conditions is met:
- you have consented to the processing operations;
- we have, or a third party has, a legitimate interest justifying the processing of the personal data concerned;
- the fulfilment of a contract that binds us to you requires us to process the personal data in question;
- we are required by law and regulations to process the personal data in question.
3.3. The pursuit of legitimate interest
The legitimate interests pursued by the Processing Manager can in particular consist of ensuring the continuity of the business, improving the consumer experience, developing consumer loyalty and understanding consumer expectations.
4. Recipients of your data
The personal data that we collect, as well as any data collected at a later time, is intended for use by us in our capacity of Processing Manager.
We are careful to ensure that only authorised persons have access to this data. Our sub-contractors / service providers may receive this data in order to enable them to provide the services for which they are contracted.
Your personal data may be compared, standardised or shared between all of the Processing Manager’s parent, sister and subsidiary entities.
It may be transmitted to these entities for of the purpose stated in this information note. These operations are conducted on the basis of instruments that comply with applicable regulations that ae designed to protect and respect your rights.
5. Transfers of your data
In the context of the offered services, we may transfer your personal data to recipients located in the following countries:
- USA : due to the cookies used by Google Analytics and Facebook
Each of these transfers is governed by legal instruments in compliance with the applicable legal framework. The data transferred to our service providers located in the United States is EU-US Privacy Shield-certified, thus ensuring a sufficient level of protection.
The entity in charge of processing drafts Binding Corporate Rules (BCR) 8 with the different subsidiaries based in countries outside the European Union and of which the State has not been the subject of a ruling on adequacy9.In such a case, insert this phrase:
Transfers made to other countries are protected by the appropriate guarantees. Binding Corporate Rules (BCR) have been established for all of data transfers as specified in this paragraph.
6. The period of time that we will keep your data
The period of time that we will keep your personal data is directly related to the purpose for which it has been collected. In consequence thereof, we have developed our data retention policy as follows:
| Purpose of the processing | Period of time retained |
| Canvassing | 3 years starting from the last contact initiated by you or, when appropriate, starting from the end of the commercial relationship in addition to the legally required duration. |
| Customer | In the framework of the concluded contracts, the data is retained throughout the period of the commercial relationship in addition to the legally required duration. |
| Cookies | 13 months from the moment they are installed on your device |
| Contract for an amount greater than €120 for accounting purposes | 10 years (non-modifiable legal period) from the conclusion of the contract. |
| If the person concerned exercises the right to access, modify, delete, or limit data relating to identification documents and information enabling the exercising of these rights. | 1 year from reception of the request |
| If the person concerned exercises the right to oppose data relating to identification documents and to information enabling the exercising of the right to oppose. | 6 years from reception of the request |
7. Your rights
7.1 How to exercise your rights
You can exercise your rights
by e-mail at the following address: chocolatree@chocolatree.fr
or
by letter at the following address: CHOCOLATREE – Z.I. Les Bracots, 74890 Bons-en-Chablais, FRANCE
To do so, you must clearly state your first and last name(s) and the address to which you would like the response to be sent.
In principle, you can exercise your rights at no expense. Nonetheless, in terms of the right of access, you may be asked to pay reasonable expenses based on the administrative costs of any copy of the data that you are requesting.
With respect to the right to information, the Processing Manager is not required to respond when you already have the information that you are requesting.
The Processing Manager will inform you if he or she will respond to your requests.
These rights are not absolute and are subject to different conditions pursuant to:
- applicable local rights concerning the protection of personal data or privacy; and
- the applicable laws and regulations.
The Processing Manager will inform you that failure to provide or the modification of your data may affect the processing of some requests in the context of the fulfilment of the contractual relationship and that your request to ’exercise your rights will be retained for monitoring purposes for 6 years with respect to the exercising of the right to oppose and 1 year with respect to the exercising of other rights.
All of your rights are detailed below.
7.2 Your right to information
You hereby acknowledge that this information note informs you of the purpose, the legal framework, the interests, the recipients and categories of recipients with whom your personal data is shared, and of the possibility of a data transfer to another country or to an international organisation.
In addition to this information and in order to ensure that your data is processed in an equitable and transparent manner, you declare that you have received additional information concerning:
- the period for which your personal data will be retained;
- the existence of your acknowledged rights and the conditions for exercising them.
If we decide to process the data for any purpose other than that stated, you will be provided with all information relating to the new purpose.
7.3 Your right to access and modify your data
When you exercise this right, you receive confirmation that your personal data has or has not been processed and when it is, you have access to your data as well as to information about:
- the purpose of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients, in particular recipients that are located in another country
- when possible, the period during which the personal data is retained or, when this is not possible, the criteria used to determine this duration
- the existence of the right to ask the Processing Manager to modify or delete your personal data, of the right to limit the processing of your personal data, of the right to oppose this processing;
- the right to lodge a complaint with a supervisory authority;
- the information relating to the source of the data when said data is not directly collected from the persons concerned;
- the existence of automatic decision-making, including profiling, and in this last case, of useful information concerning the underlying logic, as well as the importance and planned consequences of this processing for the persons concerned.
Depending on the case, you can ask us to modify or add to your personal data if it is inexact, incomplete, ambiguous or out of date.
7.4 Your right to delete your data
You can ask us to delete your personal data in any of the following cases:
- the personal data is no longer necessary for the purpose for which it was collected or otherwise processed;
- you withdraw your previously granted consent;
- you oppose the processing of your personal data when there is no legal reason for said processing;
- the processing of the personal data does not comply with the provisions of the applicable legislation and regulations;
- your personal data was collected when you were a minor.
Nonetheless, it will not be possible to exercise this right when the retention of your personal data is required by law or regulations and in particular, for example, for the observance, exercising or defence of legal rights.
7.5 Your right to limit the data processing
You can ask for limits to be placed on the processing of your personal data in the circumstances stated by law and regulations.
7.6 Your right to oppose data processing (de-registration)
You have the right to oppose the processing of personal data about you when the processing is based on the legitimate interest of the Processing Manager.
In the case of direct communication, this right can be exercised in any manner, including in particular by clicking on the de-registration links at the bottom of the transmitted communications.
7.7 Your right to data portability
You have the right to the portability of your personal data.
The data for which this right can be exercised is:
- solely your personal data, which excludes anonymous personal data or data that does not concern you;
- declarative personal data as well as personal operating data;
- personal data that does not infringe the rights and freedoms of third parties including as protected by business secrecy.
This right is limited to processing based on consent or a contract as well as on personal data that you have personally generated.
This right includes neither derived nor inferred data, which is personal data created by the Processing Manager.
7.8 Your right to withdraw your consent
When our data processing is based on your consent, you can withdraw said consent at any time. We will then stop processing your personal data, although prior operations to which you have consented will not be affected.
7.9 Your right to appeal
You have the right to lodge a complaint with the relevant supervisory authority without prejudice to any other administrative or legal appeal.
7.10 Your right to issue post-mortem directives
You may issue instructions relating to the retention, deletion and transmission of your personal data after your death to a trusted third party who has been certified and authorised to ensure compliance with the wishes of the deceased, in compliance with the requirements of the applicable legal framework.