Privacy Policy
What personal data we collect on zchocolat.com, why, and your rights. Last updated 14 September 2026.
Data controller
zChocolat, SAS with a share capital of €15,000, ZA Les Chalus, 04300 Forcalquier, France — SIRET 424 922 946 00027. Contact: zcontact@zchocolat.com, +33 (0)4 42 91 43 65.
Data, purposes and legal basis
Processing, paying for and delivering your order, including customs formalities — name, e-mail address, addresses, telephone number, company name and VAT number for businesses, order details and personalised messages, and the name, delivery address and telephone number of the gift recipient. Legal basis: performance of the contract.
Managing your account and handling your requests — account details and the content of your messages. Legal basis: performance of the contract.
Invoicing, accounting and tax obligations — order and billing data. Legal basis: legal obligation.
Preventing fraud and securing the site and payments — technical data (IP address, browser), order and payment data. Legal basis: legitimate interest.
Sending our newsletter and offers — e-mail address. Legal basis: your consent for subscribers; our legitimate interest for existing customers, with an unsubscribe link in every message.
Measuring the audience of the site and the results of our advertising — browsing data and cookies (see section 6). Legal basis: your consent; our legitimate interest for aggregated statistics.
Providing the data marked as required on our forms is necessary to place an order; without it we cannot process it. Card details are entered directly with our payment provider and are never stored by us. We do not take decisions based solely on automated processing that produce legal effects on you; our payment provider performs automated fraud screening on card payments.
Recipients
Your data is accessible to our staff on a need-to-know basis and to the service providers acting on our instructions: hosting (Evolix, France), payment (Stripe), delivery and customs (FedEx and the customs authorities of the destination country), e-mailing (Brevo), customer service (Freshworks), audience and advertising measurement (Google — Tag Manager, Analytics, Ads; Microsoft Clarity), affiliate programme (CJ Affiliate) and form protection (Cloudflare). We may also disclose data where the law requires it.
Transfers outside the European Union
Our data is hosted in France. Some providers process data in the United States (Google, Microsoft, Freshworks, Stripe); these transfers rely on the European Commission's adequacy decisions, including the EU-U.S. Data Privacy Framework, or on its Standard Contractual Clauses. Delivering a gift outside the European Union requires transmitting the recipient's details to the carrier and to the customs authorities of the destination country.
Retention
The data of customers who have ordered is kept for 10 years after their last order, then anonymised or deleted. The data of prospects and newsletter subscribers who have not ordered is kept for 3 years after their last interaction with us, then deleted. Customer-service requests are kept with the customer's file, 10 years for customers who have ordered and 3 years otherwise. Technical logs are kept for 12 months, and cookies for 13 months at most.
Cookies
The site uses cookies that are necessary for it to work (session, cart, language, payment security), and cookies for audience measurement (Google Analytics, Microsoft Clarity), advertising measurement (Google Ads, CJ Affiliate) and e-mail personalisation (Brevo). You can refuse or delete cookies at any time in your browser settings; refusing necessary cookies may prevent you from ordering.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw your consent at any time, and to set directions regarding your data after your death. To exercise these rights, write to zcontact@zchocolat.com or to the address in section 1; we may ask you to prove your identity. You may also lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.