PRIVACY PROTECTION POLICY
1.
Valrhona, whose registered office is located at 315 allée du Bergeron, Mercurol-Veaunes, 26600, France, specializes in the food industry sector.
Valrhona respects your privacy and is committed to processing your personal data fairly and transparently, in accordance with applicable data protection regulations, including the General Data Protection Regulation (GDPR).
Please read the following carefully to understand our policies and practices regarding your personal data and how we process it.
1.1. Who Is the Data Controller?
La Cité du Chocolat Valrhona acts as the Data Controller for the personal data processing activities described in this document, hereinafter referred to as the "Data Controller" or "we".
The Data Controller has designated a person responsible for data protection matters, who can be contacted:
- By email: citeduchocolat@valrhona.fr
- Via the contact form
- By post at:
Service Communication Cité du Chocolat
37 avenue du Président Roosevelt
26600 Tain l'Hermitage
France
When making a request, you must provide proof of your identity by any appropriate means. You must also clearly indicate your surname, first name, and the address to which you would like the response sent.
The Data Protection Officer (DPO) may be contacted at: dpo@savencia.com
2. What Categories of Personal Data Are Collected?
As part of the processing activities outlined below, we collect and process the following categories of personal data:
Purposes of Processing | Categories of Personal Data |
| Management of Requests Submitted Through the Contact Form | Identification data: first name, last name
|
| Customer and Prospect Communications Management | Contact data: email address
|
| Management and Follow-Up of Data Subject Rights Requests | Identification data: first name, last name Contact data: email address |
| Audience Analysis, Customer Journey Tracking, and Customer Segmentation | Connection data: login identifier, IP address Browsing data: pages visited Technical data: device information |
Data marked with an asterisk (*) in our forms must be provided. Failure to provide mandatory information may prevent us from delivering the associated service.
Our Commitments
La Cité du Chocolat Valrhona is committed to processing your personal data fairly and transparently. To this end, we inform you about every processing activity through privacy notices displayed on our data collection forms.
Your personal data is collected fairly, without your knowledge being bypassed, and never without prior information.
We undertake to process your personal data only for specific purposes: every processing activity serves a legitimate, explicit, and predefined purpose.
We also ensure that your data remains accurate and up to date and implement procedures to erase or correct inaccurate data.
3.What Are the Purposes, Legal Bases, and Retention Periods for Processing Your Personal Data?
We retain personal data according to a retention policy ensuring that data is kept only for as long as necessary for the purposes for which it was collected, unless applicable laws or regulations require a different retention period.:
Processing Purposes | Legal Bases | Retention Periods |
| Management of Requests Submitted Through the Contact Form | Legitimate interest | Duration of request processing in the active database, then 1 year in intermediate archives. |
| Customer and Prospect Communications Management | Consent | Until withdrawal of consent or, failing that, 3 years after your last positive interaction with us. |
| Management and Follow-Up of Data Subject Rights Requests | Obligation légale (articles 15 et suivants du RGPD) | Right of access, rectification, erasure, and restriction: 1 year, then anonymization
|
| Audience Analysis, Customer Journey Tracking, and Customer Segmentation | Consent |
4. With Whom Do We Share Your Personal Data?
The personal data we collect, including data collected at a later stage, is intended for us in our capacity as Data Controller.
We ensure that only authorized persons have access to your data. Our processors and service providers may receive such data solely for the purpose of performing services on our behalf.
Whenever we engage a service provider, we only disclose personal data after obtaining commitments and guarantees regarding their ability to meet security and confidentiality requirements.
La Cité du Chocolat Valrhona enters into contracts with its processors in compliance with applicable legal and regulatory obligations. These agreements precisely define the conditions and methods under which personal data may be processed, in accordance with data protection laws.
Your personal data may be consolidated, pooled, or shared among the parent companies, sister companies, and subsidiaries of the Data Controller.
Such data may be communicated to these entities for the purposes described in this Privacy Policy. These operations are governed by legal instruments compliant with applicable regulations and designed to ensure the protection of your rights.
5. Is Your Data Transferred Outside the European Union?
As part of the services provided, we transfer personal data to the United States (in connection with Google Analytics cookies).
Each of these transfers is governed by legal mechanisms compliant with the applicable legal framework.
6. How Long Do We Keep Your Data?
The retention periods applied to your personal data are proportionate to the purposes for which the data was collected.
| Marketing Prospecting | Retention Schedule |
| Prospection | 3 years from your last contact with us or, where applicable, from the end of the business relationship plus the applicable statutory limitation periods. |
| Customer Data | For contracts entered into, data is retained throughout the business relationship plus the applicable statutory limitation periods. |
| Cookies | 13 months from installation on your device. |
Sales Contracts (Accounting Purposes)
| 10 years (mandatory legal period) from the conclusion of the contract. |
| Requests Exercising Rights of Access, Rectification, Erasure, or Restriction | 1 year from receipt of the request. |
| Requests Exercising the Right to Object | 6 years from receipt of the request.
|
7. How Do We Protect Your Data?
We place particular importance on the security of personal data.
La Cité du Chocolat Valrhona has implemented technical and organizational measures appropriate to the sensitivity of personal data to ensure its integrity and confidentiality and to protect it against unauthorized access, loss, alteration, or disclosure.
However, despite our best efforts, no security measure can entirely eliminate the risks of misuse, diversion, or hacking, for which we cannot be held liable as Data Controller.
In the event of a personal data breach, and in accordance with applicable data protection regulations, we undertake to notify the French Data Protection Authority (CNIL) when required.
Where a breach is likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible under the conditions required by applicable regulations.
8. How Can You Exercise Your Rights?
Exercising Your Rights
All rights described below may be exercised:
By email: citeduchocolat@valrhona.fr
Via the contact form
By post:
Service Communication Cité du Chocolat
37 avenue du Président Roosevelt
26600 Tain l'Hermitage
France
You must provide proof of identity and clearly indicate your surname, first name, and the address where you wish to receive the response.
As a general rule, you may exercise your rights free of charge. However, regarding requests for access, a reasonable administrative fee may be charged for additional copies of the data requested.
The Data Controller will not be required to provide information already in your possession.
If we cannot respond to your request, we will inform you within one month of receiving it. This period may, where necessary, be extended by two additional months, in which case we will explain the reasons for the extension.
These rights are not absolute and are subject to:
Applicable local personal data and privacy laws
Other laws and regulations applicable to you
The Data Controller informs you that failure to provide or update your data may affect the processing of certain requests in the performance of contractual relationships.
Records relating to your rights requests will be retained:
6 years for objections
1 year for all other rights
The Data Protection Officer can be contacted at:
dpo@savencia.com
You also have the right to lodge a complaint with the French Data Protection Authority (CNIL):
CNIL
3 Place de Fontenoy
75007 Paris, France
https://www.cnil.fr/fr/plaintes
You may also seek judicial remedies.
8.1 Right to Information
You acknowledge that this Privacy Policy informs you about:
The purposes of processing
The legal basis for processing
Legitimate interests pursued
Recipients or categories of recipients
Possible transfers to third countries or international organizations
You have also received information concerning:
The retention period applicable to your personal data
The rights available to you and how to exercise them
Should we decide to process your data for purposes other than those initially specified, all relevant information regarding the new purposes will be provided to you.
8.2 Right of Access and Rectification
You have the right to obtain confirmation as to whether or not your personal data is being processed and, where that is the case, access to your data and information concerning:
The purposes of processing
Categories of personal data concerned
Recipients or categories of recipients
Retention periods or the criteria used to determine them
Your rights to rectification, erasure, restriction, and objection
Your right to lodge a complaint with a supervisory authority
The source of the data where it was not collected directly from you
The existence of automated decision-making, including profiling
You may request that inaccurate, incomplete, ambiguous, or outdated personal data be corrected or supplemented.
8.3 Right to Erasure
You may request the deletion of your personal data in the cases provided for by applicable laws and regulations.
Please note that the right to erasure is not absolute and may only be exercised where one of the grounds specified by law applies.
8.5 Right to Restriction of Processing
You may request the restriction of the processing of your personal data in the circumstances provided for by applicable legislation and regulations.
8.6 Right to Object (Unsubscribe)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the Data Controller's legitimate interests.
8.7 Right to Data Portability
You have the right to the portability of your personal data.
Please note that this is not a general right. Not all data and processing activities are portable. This right applies only to automated processing based on:
Your consent, or
The performance of pre-contractual measures or a contract.
8.8 Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time.
Following withdrawal, we will cease processing your personal data, without affecting the lawfulness of processing carried out before the withdrawal.
8.9 Right to Give Post-Mortem Instructions
You may define specific instructions concerning the retention, deletion, and disclosure of your personal data after your death.
These instructions apply solely to processing activities carried out by us and are limited to that scope.
You may also, where permitted by law, define general instructions for the same purposes.
Updates to This Policy
This Data Protection Policy may be amended, particularly in the event of changes to the services offered on www.citeduchocolat.com.
We therefore recommend that you review this Policy each time you visit the website.