You are using an outdated browser. Please upgrade your browser to improve your experience and security.
Data protection policy
1. About Us
Valrhona SAS, whose registered office is at 12-14-16-18 Avenue PRESIDENT ROOSEVELT - 26600 TAIN L'HERMITAGE - France, specialises in the manufacture of cocoa, chocolate and confectionery products.
Valrhona SAS respects your privacy and is committed to processing your personal data fairly and transparently, in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR).
Please read the following carefully to understand our policy and practices regarding your personal data and how we process it.
2. Who is responsible for processing?
The company Valrhona SAS acts as data controller for the processing of personal data referred to in this document, hereinafter referred to as “the Data Controller” or “we”.
The data controller has appointed a person to be responsible for data protection policy, who can be contacted at :
• To the following e-mail address: scvalrhona@valrhona.fr
• Using the contact form
• By post sent to the following address: Société Valrhona, 315 allée des Bergerons, 26600 – Mercurol Veaunes Cedex – France.
proving your identity by any means. In addition, you must clearly indicate your surname(s) and first name(s) and the address to which you would like the reply to be sent.
The Data Protection Officer can be contacted at the following address: dpo@savencia.com
3. What categories of personal data are collected from you?
We collect and process the following categories of data in connection with the processing of personal data, the purposes of which are set out below:
| Purposes of processing | Categories of personal data processed |
|---|---|
| Creating and managing user accounts | Identification details: title, surname, first name; |
| Management of requests from the contact form | Identification details: title, surname, first name; Contact details: profile (professional or consumer), company name, e-mail address, telephone number, city, postal code, country. |
| Claims management | Identification details: title, surname, first name; Contact details: profile (professional or consumer), company name, e-mail address, telephone number, city, postal code, country. Data relating to the follow-up of the commercial relationship (for Valrhona customers): customer code, invoicing address, delivery address, information relating to orders, invoices, credit notes, loyalty points, etc. |
| Commercial canvassing / Sending marketing communications / Sending newsletters | Identification details: title, surname, first name, birthday date; |
| Competitions | Identification details: title, surname, first name; Contact details: company name, e-mail address, telephone number, city, postal code, country. Data relating to participation in the competition: answers submitted as part of the game, results obtained by the participant. |
| Management and follow-up of requests to exercise your personal data rights | Identification details: surname, first name ; Contact details: e-mail address. |
| Application management | Identification details: surname, first name ; Contact details: e-mail address ; Data sent as part of an application: CV, covering letter. |
Data marked with an asterisk in our forms must be provided. Otherwise, the associated service cannot be provided.
4. Our commitments
Valrhona SAS is committed to processing your personal data fairly and transparently. To this end, we take care to inform you of each processing operation we carry out by means of information notices at the bottom of each collection form.
Your personal data is collected fairly, without any processing taking place without your knowledge and without prior information.
We undertake to process your personal data for specific purposes: each data processing operation pursues a legitimate, specific and explicit purpose.
We ensure that your data is kept up to date and that procedures are in place to enable inaccurate data to be deleted or rectified.
5. What are the purposes, legal bases for processing and retention periods for your personal data?
The purposes, legal bases and retention periods implemented by the Data Controller are set out below.
We will retain your personal data in accordance with a retention policy set to ensure that data is retained for a period of time proportionate to the purpose for which it was collected, except where laws and regulations require a different retention period.
Accordingly, we have organised our policy as follows:
conséquence, nous organisons notre politique de la manière suivante :
| Purposes of processing | Legal basis | Retention period |
|---|---|---|
| Creating and managing user accounts | Legitimate interest | Until the deletion of your account on the website or if it is inactive for 3 years from your last connection to the account. |
| Management of requests from the contact form | Legitimate interest | The time it takes to process the request in the active database, then 1 year in intermediate storage |
| Claims management | Legitimate interest | The time it takes to process the request in the active database, then 3 years in intermediate storage |
| Commercial canvassing / Sending marketing communications / Sending newsletters | Consent | Until you withdraw your consent, or, failing that, 3 years after the last positive contact from you |
| Competitions | Performance of the contract (the game rules) Legitimate interest (combating fraud) | For the duration of the game, plus 6 months |
| Managing rights requests | Legal obligation (Articles 15 & seq. of the GDPR) | Right of access, rectification, deletion and restriction: 1 year then anonymisation at the end of the period Right to object: 6 years then anonymisation at the end of the period |
| Application management | Execution of pre-contractual measures | For a period of 3 months in active storage and up to 2 years in intermediate storage |
Data in interim storage may only be consulted on a one-off basis by specifically authorised persons.
6. With whom do we share your personal data?
The personal data we collect, as well as those collected subsequently, are intended for us in our capacity as Data Controller.
We ensure that only authorised persons have access to this data. Our subcontractors/service providers may receive this data to carry out the services we entrust to them.
When we use a service provider, we only disclose personal data to them after obtaining a commitment and guarantees from them regarding their ability to meet these security and confidentiality requirements.
In compliance with its legal and regulatory obligations, Valrhona SAS concludes contracts with its subcontractors that precisely define the terms and conditions of data processing by the latter, in accordance with the regulations on the protection of personal data.
Your personal data may be combined, pooled or shared between all the parent, sister and subsidiary entities of the Data Controller.
It may be communicated to these entities for the purposes set out in this data protection policy. These operations are carried out based on instruments that comply with the applicable regulations and are capable of ensuring that your rights are protected and respected.
7. Has your data been transferred outside the European Union?
As part of the services we offer, we transfer personal data to recipients in the following countries: France ; United States ; Italy ; Spain ; Germany ; Switzerland ; United Kingdom ; Sweden ; United Arab Emirates ; Hong Kong ; Singapore ; China ; Taiwan ; South Korea ; Australia ; Japan ; Morocco.
Each of these transfers is governed by legal instruments that comply with the applicable legal framework.
8. How do we protect your data?
We attach particular importance to the security of personal data.
Valrhona SAS has put in place technical and organisational measures appropriate to the degree of sensitivity of personal data, with a view to ensuring their integrity and confidentiality and protecting them against any malicious intrusion, loss, alteration or disclosure to unauthorised third parties.
However, despite our efforts, no security measure can protect against all risks of misappropriation or piracy, for which we, as the data controller, cannot be held responsible.
In the event of a personal data breach, we undertake to notify the CNIL in accordance with the regulations in force relating to the protection of personal data. In the event of a data breach presenting a high risk to your rights and freedoms, we will inform you as soon as possible in accordance with the conditions set out in the regulations in force relating to the protection of personal data.
9. What are your rights?
Valrhona SAS, as the data controller, is particularly concerned about respecting the rights you are granted in connection with the data processing it carries out.
9.1 Your right to information
You acknowledge that this data protection policy informs you of the purposes, legal framework, interests, recipients or categories of recipients with whom your personal data is shared, and of the possibility of data being transferred to a third country or to an international organisation.
In addition to this information and in order to ensure that your data is processed fairly and transparently, you declare that you have received further information concerning :
- how long we keep your personal data;
- the existence of your rights and how to exercise them.
If we decide to process data for purposes other than those indicated, you will be provided with all the information relating to these new purposes.
9.2 Your right of access
By exercising this right, you have confirmation that your personal data is or is not being processed and, where it is, you have the right to request a copy of your data and information about :
- the purposes of the processing ;
- the categories of personal data concerned;
- the recipients or categories of recipients and, where appropriate, if such disclosures are to be made, the international organisations to which the personal data have been or will be disclosed, in particular recipients established in third countries;
- where possible, the intended retention period for personal data or, where this is not possible, the criteria used to determine that period ;
- the existence of the right to ask the data controller to rectify or erase your personal data, the right to request a restriction on the processing of your personal data, and the right to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- information on the source of the data when it is not collected directly from the data subjects;
- the existence of automated decision-making, including profiling, and in the latter case, useful information concerning the underlying logic, as well as the importance and the expected consequences of this processing for the data subjects.
You may ask us to correct or supplement your personal data if it is inaccurate, incomplete, ambiguous or out of date.
9.3 Your right to rectify your data
You may ask us to rectify or complete your personal data if it is inaccurate, incomplete, ambiguous or out of date.
9.4 Your right to deletion
9.4.1 General case
You may ask us to delete your personal data in the cases provided for by legislation and regulations. Please note that the right to erasure of data is not a general right and will only be exercised if one of the grounds provided for in the applicable regulations is present.
9.4.2 Special case of competitions
Requests received during the competition period will be assessed in accordance with the competition rules.
9.5 Your right to limit data processing
You may request that the processing of your personal data be restricted in the cases provided for by law and regulations.
9.6 Your right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data for which the legal basis is the legitimate interest pursued by the controller.
9.7 Your right to portability
You have the right to the portability of your personal data. Please note that this is not a general right. Not all data from all processing operations is portable, and this right only applies to automated processing operations, to the exclusion of manual or paper-based processing. This right is limited to processing for which the legal basis is your consent or the performance of pre-contractual measures or a contract.
9.8 Your right to withdraw consent
Where the processing of data by us is based on your consent, you may withdraw it at any time. We will then stop processing your personal data, without affecting any previous operations for which you have given your consent.
9.9 Your right to define post-mortem directives
You also have the possibility of defining specific directives relating to the conservation, deletion and communication of your personal data after your death in accordance with the procedures set out below. These specific directives only concern the processing carried out by us and will be limited to this area.
You also have the right, once this person has been designated by the Executive, to define general guidelines for the same purposes.
10. How can you exercise your rights?
All the rights listed above may be exercised:
• To the following e-mail address: scvalrhona@valrhona.fr ;
• Using the contact form ;
• By post sent to the following address: DPO Valrhona - SERVICE CLIENT VALRHONA, 315 allée des Bergerons - CS20040 - 26600 MERCUROL-VEAUNES - FRANCE
proving your identity by any means. In addition, you must clearly indicate your surname(s) and first name(s) and the address to which you would like the reply to be sent.
In principle, you may exercise all your rights free of charge. However, regarding the right of access, you may be asked to pay a reasonable fee based on administrative costs for any copy of the data you request.
Regarding the right to information, the Data Controller shall not be obliged to respond if you already have the information you are requesting.
The Data Controller shall inform you if it is unable to comply with your requests within one month of receiving your request. If necessary, this period may be extended by a further two months, in which case you will be informed and given the reasons.
These rights are not absolute and are subject to various conditions under :
- applicable local legislation on the protection of personal data or privacy; and
- the laws and regulations applicable to you.
The Data Controller wishes to inform you that failure to provide or modify your data may have consequences for the processing of certain requests in the context of the performance of contractual relations and that your request to exercise your rights will be kept for monitoring purposes for 6 years in the case of exercising the right to object and 1 year in the case of exercising other rights.
The Data Protection Officer can be contacted at the following address: dpo@savencia.com
If necessary, you have the right to lodge a complaint with Commission Nationale de L’Informatique et des Libertés - CNIL (3 place de Fontenoy, 75007 Paris or https://www.cnil.fr/fr/plaintes ) or to take legal action.
11. Policy update
This Data Protection Policy may be modified, particularly in the event of changes to the services offered by Valrhona SAS on the site. We therefore recommend that you consult this policy each time you access the site.