Privacy policy

Last updated: August 4, 2026

This Privacy Policy describes how the company Les Gourmandises des Français, operating the website under the trade name Le chocolat des Français, collects, uses, stores and protects your personal data when you browse our website, create an account, place an order, subscribe to our marketing communications or interact with us.

It applies to all the services offered on the Le chocolat des Français website, hereinafter the "Services".

We are committed to processing your personal data in accordance with the General Data Protection Regulation, known as the "GDPR", and French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

By using our Services, you acknowledge that you have read this Privacy Policy.

1. Data Controller

The controller of your personal data is:

Les Gourmandises des Français
39 avenue de l’Opéra, 75002 Paris, France

Information on the company’s legal form, share capital and registration number is available in the website’s legal notice.

2. Principles Applicable to the Processing of Your Data

We process your personal data in accordance with the following principles:

  • data is processed lawfully, fairly and transparently;
  • data is collected for specified, explicit and legitimate purposes;
  • only data that is relevant and necessary for those purposes is collected;
  • data is kept up to date as far as possible;
  • data is not kept for longer than necessary;
  • appropriate technical and organizational measures are implemented to protect its confidentiality, integrity and availability.

3. Personal Data Collected

The personal data we collect depends on how you use our Services.

3.1. Identification and Contact Data

We may collect:

  • your last name and first name;
  • your email address;
  • your telephone number;
  • your billing address;
  • your delivery address;
  • information about your company, where you place an order for professional purposes.

3.2. Account Data

When you create a customer account, we may collect:

  • your login credentials;
  • your preferences;
  • your order history;
  • the information saved in your customer account.

3.3. Order and Transaction Data

We may process:

  • the products viewed, added to your basket or ordered;
  • the amount and date of your orders;
  • delivery information;
  • cancellation or refund requests;
  • the promotional codes used;
  • your purchase history;
  • the associated invoices and supporting documents.

3.4. Payment Data

Payments are processed by Shopify and by the payment providers offered on our website.

The information required for payment, such as your bank card details, is collected and processed directly by these providers in a secure environment.

Le chocolat des Français does not have access to your full bank card number or its security code.

However, we may receive certain information about the transaction, such as:

  • the payment method used;
  • confirmation or refusal of the payment;
  • the amount and date of the transaction;
  • a masked portion of the card number;
  • the information needed to manage refunds and disputes.

3.5. Data Relating to Your Communications with Us

When you contact us, we may collect:

  • the content of your request;
  • the information provided to customer service;
  • communications by email, telephone or contact form;
  • any documents you choose to send us.

We ask that you do not provide sensitive information that is not necessary to process your request.

3.6. Technical and Browsing Data

When you browse our website, we may collect:

  • your IP address;
  • the type of device used;
  • your operating system;
  • the type and version of your browser;
  • the pages viewed;
  • the date and time of your visit;
  • the products viewed or added to your basket;
  • the source of your visit;
  • your interactions on the website;
  • certain technical or advertising identifiers.

This data may be collected using cookies, pixels and similar technologies, under the conditions described in the section on cookies.

4. Sources of Personal Data

We may collect your personal data:

  • directly from you, when you create an account, place an order, fill in a form or communicate with us;
  • automatically, when you browse or use our website;
  • from Shopify and our technical service providers;
  • from our payment, delivery, customer service, audience measurement or advertising providers;
  • from partners, where the regulations allow it and you have been informed.

5. Purposes and Legal Bases for Processing

We use your personal data only where a legal basis allows us to do so.

5.1. Order Management

We use your data to:

  • record and process your orders;
  • manage payments;
  • prepare and ship the products;
  • keep you informed of the progress of your order;
  • handle complaints and refunds;
  • issue invoices and accounting documents.

This processing is necessary for the performance of the contract concluded with you and for compliance with our legal obligations, in particular accounting and tax obligations.

Where certain mandatory information is not provided to us, we may be unable to process or deliver your order.

5.2. Customer Account Management

We use your data to:

  • create and administer your account;
  • allow you to view your orders;
  • remember certain preferences;
  • make your future purchases easier;
  • secure access to your customer account.

This processing is necessary for the performance of the Services you have requested.

5.3. Customer Service and Management of the Commercial Relationship

We use your data to:

  • answer your questions;
  • process your requests and complaints;
  • provide you with assistance;
  • follow up on our commercial relationship;
  • keep a record of our communications where necessary.

Depending on the nature of your request, this processing is based on the performance of the contract or on our legitimate interest in providing effective customer service and defending our rights.

5.4. Marketing Communications

Subject to the applicable rules, we may use your contact details to send you:

  • information about our products;
  • commercial offers;
  • brand news;
  • invitations or information about our events;
  • promotional communications.

Where required by the regulations, these communications are sent on the basis of your consent.

Where you are already a customer, we may also send you offers for products or services similar to those you have already purchased, on the basis of our legitimate interest, subject to your right to object.

You can unsubscribe at any time using the link provided in our emails.

Withdrawing your consent or objecting does not affect the communications necessary for following up your orders or managing your account.

5.5. Personalization and Advertising

Subject to your consent where required, we may use certain data relating to your browsing and purchases to:

  • personalize the content and recommendations presented to you;
  • measure the effectiveness of our advertising campaigns;
  • show you advertisements likely to match your interests;
  • build advertising audiences;
  • limit the repetition of certain advertisements.

This processing may involve the use of cookies or advertising identifiers placed by our partners.

You can accept, refuse or change your choices at any time using our cookie management tool.

5.6. Audience Measurement and Website Improvement

We may use certain data to:

  • measure website traffic;
  • understand how visitors use our Services;
  • identify the most viewed pages or features;
  • improve the performance, usability and content of the website;
  • detect technical difficulties.

Depending on the configuration of the tool concerned, this processing is based on your consent or, where the regulatory conditions for exemption are met, on our legitimate interest.

5.7. Security and Fraud Prevention

We may use your data to:

  • secure our website and systems;
  • authenticate users;
  • detect suspicious behavior;
  • prevent fraudulent payments;
  • combat abuse and unlawful activities;
  • protect our rights, our customers and our partners.

This processing is based on our legitimate interest in ensuring the security of our Services and, where a specific obligation applies, on compliance with our legal obligations.

5.8. Legal Obligations and Defense of Our Rights

We may process or retain certain data in order to:

  • comply with our legal, regulatory, accounting and tax obligations;
  • respond to legitimate requests from the competent authorities;
  • establish, exercise or defend our legal rights;
  • manage pre-litigation and litigation matters;
  • keep the evidence necessary to defend our interests.

This processing is based on compliance with our legal obligations or on our legitimate interest in protecting and defending our rights.

6. Mandatory or Optional Nature of the Information

Fields marked as mandatory are necessary to process your request, create your account or fulfill your order.

If you do not provide this information, we may be unable to provide you with the requested Service.

Other information is optional. Not providing it does not, in principle, prevent you from using the essential features of the website.

7. Recipients of Your Data

Within the limits of their respective responsibilities, your data may be accessible to:

  • authorized members of our teams;
  • Shopify, which hosts and provides the infrastructure for our online store;
  • our payment providers;
  • our logistics providers and carriers;
  • our customer support providers;
  • our IT, hosting, maintenance and security providers;
  • our email or SMS delivery providers;
  • our audience measurement tools;
  • our advertising and marketing partners, where you have consented;
  • our advisers, insurers, statutory auditors and providers responsible for defending our rights;
  • administrations, courts or competent authorities where required by law.

These recipients receive only the data necessary to carry out their tasks.

Where our providers act as processors, they process your data on our instructions and are required to implement appropriate confidentiality and security measures.

Certain partners, such as payment providers or advertising platforms, may also act as independent controllers for certain operations. Their own privacy policies then apply to the processing they carry out under their responsibility.

We do not sell your personal data.

8. Relationship with Shopify

Our online store is hosted and provided by Shopify.

Shopify processes certain personal data to enable us to offer and secure our Services, in particular when you browse the website, create an account, place an order or make a payment.

Shopify acts primarily as a processor for the processing carried out on behalf of our store. However, Shopify may act as a controller for certain features or uses carried out for its own purposes, in accordance with its terms and its own privacy policy.

You can consult Shopify’s Privacy Policy for consumers at the following address: https://www.shopify.com/legal/privacy/consumers.

You can also obtain more information about how Shopify uses your data at the following address: https://privacy.shopify.com/en.

9. Transfers of Data Outside the European Economic Area

Some of our providers, including Shopify and certain technical or advertising partners, may process data from countries located outside the European Economic Area.

Where your data is transferred to a country that does not benefit from a European Commission adequacy decision, we ensure that the transfer is governed by the rules of the GDPR.

10. Retention Periods

We keep your data only for as long as necessary for the purposes for which it was collected, plus, where applicable, any periods required by law or necessary to defend our rights.

In general:

Order and Customer Relationship Data

Data necessary for managing the commercial relationship is kept for the duration of that relationship, and may then be archived for the applicable limitation period.

Accounting Documents and Invoices

Invoices and accounting records are kept for the applicable legal period, generally ten years from the close of the financial year concerned.

Customer Accounts

Data associated with a customer account is kept for as long as the account is in use and may be deleted or archived after a prolonged period of inactivity, subject to legal retention obligations.

For people who have never made a purchase, data may be kept for a maximum of three years from its collection or from the last active contact.

Your unsubscription and your objection may be kept on a suppression list in order to respect your choice on a lasting basis.

Customer Support

Communications with customer service are kept for as long as necessary to process your request, and then for as long as necessary to manage any disputes and defend our rights.

Payment Data

We do not keep your full bank card number. Payment providers keep the necessary data in accordance with their own legal obligations and security rules.

Fraud-Related Data

Data relating to proven or suspected fraud may be kept for as long as necessary to analyze the incident, defend our rights and comply with our legal obligations.

Cookies

The lifespan of each cookie depends on its purpose. It is indicated, where this information is available, in our cookie management tool.

The choices you express regarding acceptance or refusal of cookies may be kept for six months before you are asked again.

Some data may be kept for longer where necessary to comply with a legal obligation, respond to a request from an authority or defend our rights in court.

11. Cookies and Similar Technologies

11.1. Definition

A cookie is a small file or identifier stored on or read from your device when you visit a website.

Cookies may in particular be used to:

  • ensure the operation of the website;
  • maintain your session;
  • remember your basket;
  • secure payments;
  • remember your preferences;
  • measure website audience;
  • personalize content;
  • measure or personalize advertisements.

11.2. Strictly Necessary Cookies

Some cookies are essential to the operation of the website and to the provision of the Services you request.

They may in particular be used to:

  • remember the products added to your basket;
  • keep you logged in to your account;
  • secure the website and payments;
  • distribute the technical load;
  • record your cookie preferences.

These cookies do not require your consent where they are strictly necessary for the operation of the website or for the provision of a Service you have expressly requested.

11.3. Audience Measurement Cookies

Subject to your consent where required, we may use audience measurement cookies in order to understand traffic to and use of the website.

These cookies may in particular measure:

  • the number of visitors;
  • the pages viewed;
  • the duration of visits;
  • traffic sources;
  • interactions with pages and products.

We may in particular use services provided by Google Analytics or equivalent tools, depending on the configuration of the website.

11.4. Advertising and Marketing Cookies

Subject to your consent, advertising cookies or pixels may be placed in order to:

  • measure the effectiveness of our campaigns;
  • attribute a visit or an order to a campaign;
  • show you personalized advertisements;
  • create advertising audiences;
  • limit the repetition of ads;
  • better understand interactions with our communications.

These technologies may be provided by partners such as Google, Meta, TikTok or other platforms actually used on our website.

11.5. Third-Party Content and Services

Some pages may include content or services provided by third parties, such as videos, maps or social media modules.

These third parties may place cookies or collect information about your browsing, subject to your consent where required.

11.6. Managing Your Preferences

On your first visit, a banner allows you to:

  • accept all optional cookies;
  • refuse them;
  • customize your choices by purpose.

Non-essential cookies are placed only after your consent has been obtained, where required.

You can change your preferences or withdraw your consent at any time using the cookie management link available in the footer of the website.

Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

You can also limit or delete cookies from your browser. As menu names may change, we invite you to consult your browser’s official help.

Disabling certain strictly necessary cookies may prevent some features of the website from working properly.

12. Data Security

We implement reasonable technical and organizational measures to protect your data against:

  • destruction;
  • loss;
  • alteration;
  • unauthorized disclosure;
  • unauthorized access;
  • any other form of unlawful processing.

These measures may in particular include:

  • the use of the HTTPS protocol;
  • restricting access to authorized persons only;
  • protection of accounts and systems;
  • monitoring and maintenance of our tools;
  • backup of certain information;
  • the use of providers offering appropriate guarantees;
  • raising awareness among persons with access to the data.

Despite the measures implemented, no IT system or method of transmission can guarantee absolute security.

In the event of a personal data breach, we will assess the risks to the individuals concerned. Where required by the regulations, we will notify the breach to the CNIL as soon as possible and, where feasible, within 72 hours of becoming aware of it.

Where the breach is likely to result in a high risk to the rights and freedoms of the individuals concerned, we will inform them under the conditions provided for by the regulations.

13. Data Relating to Minors

Our Services are not specifically intended for children.

We do not knowingly seek to collect personal data concerning minors who would not be able to consent on their own to the processing of their data in accordance with the applicable regulations.

Where a purchase is made by a minor, it must be made with the authorization and under the responsibility of their legal representative.

If you are the parent or legal representative of a minor who has provided us with their personal data without authorization, you can contact us to request its deletion.

14. Your Rights

Subject to the conditions and exceptions provided for by the regulations, you have the following rights.

Right of access. You can obtain confirmation of whether or not we process data concerning you and, where we do, obtain access to that data as well as information about its processing.

Right to rectification. You can request the correction or updating of inaccurate or incomplete data.

Right to erasure. You can request the deletion of your personal data in the cases provided for by the regulations. This right does not apply where retention is necessary, in particular to comply with a legal obligation or defend our rights.

Right to restriction of processing. You can request the temporary suspension of certain processing under the conditions provided for by the GDPR.

Right to object. You can object, on grounds relating to your particular situation, to processing based on our legitimate interest. You can object at any time and without giving a reason to the use of your data for direct marketing purposes.

Right to data portability. For processing based on your consent or on the performance of a contract and carried out by automated means, you can request to receive the data you have provided to us in a structured, commonly used and machine-readable format. You can also request that it be transmitted directly to another controller where technically feasible.

Right to withdraw your consent. Where processing is based on your consent, you can withdraw it at any time. This withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

Right to lodge a complaint

You have the right to lodge a complaint with the Commission nationale de l’informatique et des libertés, the CNIL, in particular via its website: https://www.cnil.fr.

15. Exercising Your Rights

You can exercise your rights by contacting us:

Electronically: via the contact form

By post:
Le chocolat des Français
8 rue du Caire
75002 Paris
France

In order to protect your data, we may ask you for additional information to verify your identity.

We will respond to your request within one month of receiving it. This period may be extended by two months where the request is complex or where we receive a large number of requests. In that case, we will inform you of the extension and the reasons for it.

Exercising your rights is free of charge. However, reasonable fees may be charged, or a request may be refused, where it is manifestly unfounded or excessive, in particular because of its repetitive nature.

16. Links to Third-Party Websites

Our website may contain links to websites, services or platforms operated by third parties.

We do not control these services and are not responsible for their privacy practices, content or security.

When you leave our website, we invite you to read the privacy policy of the service concerned.

The presence of a link does not mean that we necessarily endorse the content or practices of the third-party website.

17. Changes to the Privacy Policy

We may amend this Privacy Policy to take into account:

  • changes to our Services;
  • the addition or removal of providers;
  • technical changes;
  • new processing practices;
  • legal or regulatory changes.

The updated version will be published on this page with the new update date.

Where the changes are substantial or where required by the regulations, we will inform you by appropriate means.

18. Supervisory Authority

The French authority responsible for data protection is:

Commission nationale de l’informatique et des libertés – CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France

Website: https://www.cnil.fr