Data Protection Policy
La Maison du Chocolat, whose headquarters are located at 65 Avenue de Ségur in the 7th arrondissement of Paris, specializes in the chocolate and pastry sector.
La Maison du Chocolat is committed to respecting your privacy and to processing your personal data in a fair and transparent manner, in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).
Please take the time to carefully read the following to understand our policy and practices regarding your personal data and how we handle it.
The company, La Maison du Chocolat, acts as the data controller for the processing of personal data described in this document, hereinafter referred to as “the Data Controller” or “we”.
The Data Controller has appointed a person responsible for the data protection and privacy policy, whom you may contact:
- At the following email address: mesdonneespersonnelles@lamaisonduchocolat.com
- Using the contact form: access the contact form.
- By postal mail sent to the following address:
La Maison du Chocolat
41 rue Paul Lescop, 92000 Nanterre, France
By providing proof of your identity by any appropriate means. You must also clearly indicate your full name(s) and the address to which you would like the response to be sent.
The Data Protection Officer can be contacted at the following address: dpo@savencia.com
As part of the personal data processing activities described in this document, we collect and process the following categories of personal data:
| Purposes of processing | Categories of personal data processed |
| Order Management |
Identification data: title, first name, last name, company, country; Data related to commercial relationship tracking: invoices, billing address, delivery address, order information, details of purchased products, tracking number provided by the carrier; Contact details : email address, phone number; |
| Creation and management of user accounts |
Identification data: title, first name, last name, company, job title, country; Contact details: email address, phone number. |
| Handling requests from the contact form |
Identification data: title, first name, last name ; Contact details: email address, phone number, company, job title, country, city |
| Handling complaints |
Identification data: first name, last name; Contact details: email address and/or phone number ; Data related to commercial relationship tracking: order number. |
| Sales prospecting actions / Sending marketing communications / Sending newsletters |
Identification data: first name, last name; Contact details: email address, phone number, postal address Other data: interests, preferred categories |
| Management and monitoring of requests to exercise your personal data rights. |
Identification data: last name, first name;; Contact information: email address. |
| Management of quote requests made through the Website |
Données d’identification : Identification data: title, first name, last name, company, country; Données de contact :Contact details: email address, phone number |
| Advertising retargeting of our audiences |
Identification data: first name, last name, postal code, country;; Contact details: email address, phone number; Browsing data |
| Audience analysis |
Demographic data: age, gender, interests, geolocation data Browsing data: pages visited, actions, clicks, conversions Technical data: browser version, device, user identifiers, operating system |
| Customer segmentation and tracking of the customer journey |
User experience data: purchasing habits |
Data marked with an asterisk in our forms must be provided. Otherwise, the associated service cannot be delivered.
La Maison du Chocolat is committed to processing your personal data fairly and transparently.
Your personal data is collected fairly, without any processing taking place without your knowledge and without prior information.
We are committed to processing your personal data for specific purposes: each data processing operation serves a legitimate, defined, and explicit purpose..
We ensure that your data is kept up to date and implement processes to allow the deletion or correction of inaccurate data.
The purposes, legal bases, and retention periods implemented by the Data Controller are presented below.
We will retain your personal data in accordance with a retention policy designed to ensure that data is kept for a period proportionate to the purpose for which it was collected, unless laws and regulations require a different retention period.
As a result, we structure our policy as follows :
| Purposes of processing | Legal bases | Retention periods |
| 1. Order management | Contractual obligation | Duration of the contractual relationship in active base, then 5 years in intermediate archiving |
| Billing elements are retained for 10 years from the end of the accounting period | ||
| 2. Creation and management of user accounts | Legitimate interest | 4 years from your last contact |
| 3. Management of requests from the contact form | Legitimate interest | Duration of request processing in active base, then 3 years in intermediate archiving |
| 4. Complaint management | Legitimate interest | Duration of request processing in active base, then 3 years in intermediate archiving |
| 5. Commercial prospecting / Sending marketing communications / Sending newsletters | Consent | Until you withdraw your consent, or failing that, 4 years after your last positive contact |
| 6. Management of rights requests | Legal obligation (Articles 15 and following of the GDPR) | Right of access, rectification, erasure and restriction: 1 year then anonymization after the deadline |
| Right to object: 6 years then anonymization after the deadline | ||
| 7. Management of quote requests made via the Site | Execution of pre-contractual measures | For quotes not converted into orders, 5 years from the date of issue |
| In case of order placement, 10 years from the end of the accounting period | ||
| 8. Advertising retargeting of our audiences | Consent | Until you withdraw your consent, or failing that, 4 years after your last positive contact |
| 9. Audience analysis | Consent | Data is retained for 14 months |
| 10. Customer categorization and tracking of customer journeys | Legitimate interest | 4 years after your last positive contact |
Data in intermediate archiving can only be accessed occasionally and for justified reasons by specifically authorized personnel.
The personal data we collect, as well as those collected later, are intended for us in our capacity as Data Controller.
We ensure that only authorized individuals have access to this data. Our subcontractors/service providers may receive this data to carry out the services we entrust to them.
When we use a service provider, we only share personal data after obtaining a commitment and guarantees from them regarding their ability to meet security and confidentiality requirements.
La Maison du Chocolat enters into contracts with its subcontractors, in compliance with its legal and regulatory obligations, precisely defining the conditions and methods of data processing by them, in accordance with data protection regulations.
Your personal data may be matched, pooled, or shared among all parent, sister, and subsidiary entities of the Data Controller.
They may be shared with these entities for the purposes outlined in this data protection policy. These operations are carried out using instruments that comply with applicable regulations and ensure the protection and respect of your rights.
As part of the services offered, we transfer personal data to recipients located in the following countries:
- United States
- Japan
- Hong Kong
- Canada
- Tunisia
Each of these transfers is governed by legal instruments that comply with the applicable legal framework.
We place great importance on the security of personal data.
La Maison du Chocolat has implemented technical and organizational measures appropriate to the sensitivity level of personal data, to ensure their integrity and confidentiality and to protect them against any malicious intrusion, loss, alteration, or disclosure to unauthorized third parties.
However, despite our efforts, no security measure can protect against all risks of misuse or hacking, for which, as the data controller, we cannot be held responsible.
We commit, in the event of a personal data breach and in accordance with applicable data protection regulations, to notify the CNIL. If a data breach presents a high risk to your rights and freedoms, we will inform you as soon as possible, always under the conditions provided by the applicable data protection regulations.
La Maison du Chocolat, as the data controller, is particularly committed to respecting the rights granted to you in the context of the data processing it carries out.
a. Your right to information
You acknowledge that this data protection policy informs you of the purposes, legal framework, interests, recipients or categories of recipients with whom your personal data is shared, and the possibility of data transfer to a third country or international organization.
In addition to this information, and in order to ensure fair and transparent processing of your data, you declare that you have received additional information regarding:
- the retention period of your personal data;
- the existence of rights granted to you and how to exercise them.
If we decide to process data for purposes other than those indicated, all information relating to these new purposes will be communicated to you.
b. Your right of access
By exercising this right, you can confirm whether your personal data is being processed and, if so, you have the right to request a copy of your data and information regarding:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients and, where applicable, international organizations to whom the personal data has been or will be disclosed, especially recipients located in third countries;
- where possible, the intended retention period of the personal data or, if not possible, the criteria used to determine this period;
- the existence of the right to request rectification or erasure of your personal data, the right to request restriction of processing, and the right to object to processing;
- the right to lodge a complaint with a supervisory authority;
- information about the source of the data when not collected directly from the data subject;
- the existence of automated decision-making, including profiling, and in such cases, meaningful information about the logic involved, as well as the significance and expected consequences of such processing for the data subject.
You may request that your personal data be rectified or completed if it is inaccurate, incomplete, ambiguous, or outdated.
c. Your right to rectification
You may request that your personal data be rectified or completed if it is inaccurate, incomplete, ambiguous, or outdated.
d. Your right to erasure
d.i General case
You may request the erasure of your personal data in cases provided for by legislation and regulations. Please note that the right to erasure is not a general right and can only be granted if one of the conditions set out in the applicable regulations is met.
e. Your right to restriction of processing
You may request the restriction of the processing of your personal data in cases provided for by legislation and regulations.
f. Your right to object
You have the right to object at any time, for reasons relating to your particular situation, to the processing of your personal data where the legal basis is the legitimate interest pursued by the data controller.
g. Your right to data portability
You have the right to portability of your personal data. Please note that this is not a general right. Not all data from all processing activities is portable, and this right only applies to automated processing, excluding manual or paper-based processing. It is limited to processing based on your consent or the execution of pre-contractual measures or a contract.
h. Your right to withdraw consent
Where the data processing we carry out is based on your consent, you may withdraw it at any time. We will then stop processing your personal data, without affecting previous operations for which you had given consent.
h.i. Your right to define post-mortem directives
You also have the option to define specific directives regarding the retention, erasure, and communication of your personal data after your death, as described below. These specific directives only apply to processing carried out by us and are limited to this scope.
All the rights listed above can be exercised:
- By email at: contact us by email.
- Using the contact form: click here to access the contact form.
- By postal mail sent to the following address:
La Maison du Chocolat
41 rue Paul Lescop, 92000 Nanterre, France
By postal mail sent to the following address:
La Maison du Chocolat
GDPR Representative
41 rue Paul Lescop, 92000 Nanterre, France
with proof of identity by any means. You must also clearly indicate your full name and the address to which you wish the response to be sent.
In principle, you can exercise all your rights free of charge. However, regarding the right of access, reasonable fees based on administrative costs may be charged for any copies of data you request.
Regarding the right to information, the Data Controller is not required to respond if you already have the information you are requesting.
The Data Controller will inform you if it cannot respond to your requests within one month of receiving your request. If necessary, this period may be extended by two additional months, in which case you will be informed and given the reasons.
These rights are not absolute and are subject to various conditions under:
- applicable local data protection or privacy laws; and
- laws and regulations applicable to you.
The Data Controller informs you that failure to provide or modification of your data may affect the processing of certain requests in the context of contractual relations. Your request to exercise your rights will be retained for tracking purposes for 6 years regarding the right to object and 1 year for other rights.
The Data Protection Officer can be contacted at: dpo@savencia.com
If necessary, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (3 place de Fontenoy, 75007 Paris or https://www.cnil.fr/fr/plaintes) or to take legal action.
This Data Protection Policy may be modified, particularly in the event of changes to the services offered by La Maison du Chocolat. Therefore, we recommend that you consult this policy each time you access the site.