1. Personal data
1.1 Introduction
The personal data we collect is protected and processed with the utmost care, in accordance with applicable legislation, French Law No. 78-17 of 6 January 1978 on information technology, files and civil liberties, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and the free movement of such data (the ‘GDPR’).
Personal data collected on barokchocolat.com (the ‘Website’) or when orders are placed is processed by JAMBO PAM, a French SASU with share capital of €100, based at 7 rue Guiot, 83200 Toulon (hereinafter ‘BAROK’), which can be contacted at pierre-alexandre@barokchocolat.com.
BAROK acts as data controller for the collection and processing of data relating to Users’ orders.
1.2 What data do we process and for what purposes?
BAROK only collects and processes personal data for which it has a lawful basis. These bases include your consent, performance of an order where processing is necessary to fulfil the order between BAROK and you, compliance with a legal obligation, and BAROK’s legitimate interests.
In particular, we collect and process the following data:
| Data | Purpose | Lawful basis |
|---|---|---|
| First and last name | Customer relationship management, invoicing | Performance of a contract |
| Company name, SIRET number | Invoicing, customer management | Legal obligation |
| Business email address | Communication, quotations, order follow-up | Performance of a contract |
| Business telephone number | Customer service, order follow-up | Legitimate interest |
| Postal address | Delivery, invoicing | Performance of a contract |
| Logo and graphic elements | Product personalisation | Performance of a contract |
| IP address, connection data | Security, website usage statistics | Legitimate interest |
| Order history | Customer service, reorders | Performance of a contract |
Data supplied by the Customer when placing an order is intended for BAROK and its partners acting as processors. It is used to process, manufacture, deliver and follow up orders, manage customer relationships and meet BAROK’s legal and regulatory obligations. It may not be used for other purposes.
1.3 Payment data
Payment data, such as card numbers, is processed directly by our secure payment provider and is never stored on our servers. Payments use a secure protocol compliant with applicable standards.
1.4 With which categories of recipients do we share your data?
The personal data we collect is intended for us as data controller. It may be shared with the categories of recipients below for the purposes described in this privacy policy.
BAROK may share your personal data with third parties only in the following cases:
- Technical service providers : BAROK uses service providers for technical services, including Website hosting, payment processing and parcel dispatch. These third parties must maintain high levels of security for your personal data and are bound by a legal agreement requiring them to preserve its confidentiality and security and process it only in accordance with BAROK’s instructions;
- Accounting provider : to meet BAROK’s legal and regulatory obligations;
- Carriers : to deliver the Products;
- Staff : BAROK may share your personal data with staff bound by confidentiality obligations, strictly for the purposes described above;
- Legal obligations : BAROK may disclose personal data to legally authorised bodies where required by law, to meet its legal, regulatory or contractual obligations.
BAROK does not transfer your data outside the European Economic Area (EEA). However, some technical service providers may be located outside the EEA. In such cases, BAROK implements contractual mechanisms compliant with applicable regulations, including European Commission standard contractual clauses and/or the EU–US Data Privacy Framework, to protect these transfers.
In all cases, BAROK makes its best efforts to ensure the confidentiality and security of personal data during transmission.
1.5 Data retention
| Data type | Retention period |
|---|---|
| Active customer data | Duration of the business relationship plus 3 years from the last order |
| Invoicing data | 10 years (statutory accounting obligation) |
| Prospecting data | 3 years from the last contact |
| Browsing data (cookies) | Up to 13 months |
| Connection logs | 12 months |
After these periods, the data is deleted.
1.6 Your rights
Under French Law No. 78-17 of 6 January 1978, as amended, and the GDPR, you have the following rights regarding your personal data:
- Right of access : to obtain confirmation that your data is being processed and receive a copy;
- Right to rectification : to correct inaccurate or incomplete data;
- Right to erasure : to request deletion of your data, subject to legal retention obligations;
- Right to restriction : to request restriction of processing in the circumstances provided by law;
- Right to data portability : to receive your data in a structured, commonly used and machine-readable format;
- Right to object : to object to the processing of your data on legitimate grounds, particularly for direct marketing.
You can exercise these rights by emailing pierre-alexandre@barokchocolat.com or writing to JAMBO PAM — 7 rue Guiot, 83200 Toulon, France.
BAROK undertakes to respond within thirty (30) days of receiving your request.
If you wish to make a complaint, you can contact the French Data Protection Authority (CNIL) , including through its website cnil.fr.