Privacy policy

1. Data controller

SARL La Chocolaterie, 16 rue Sainte-Anne, 97400 Saint-Denis, La Réunion — Saint-Denis de La Réunion Trade and Companies Register 832 554 661.
For any question about your data: contact@lachocolaterie.re.

2. The data we collect and why

We only collect the data each service needs:

• Orders: first and last name, email, phone, delivery address or pickup shop, products ordered and amounts. Used to process, deliver and invoice the order (performance of the contract) and to meet our accounting obligations (legal obligation).
• Payment: processed directly by our provider Stripe. We only receive the outcome of the payment; your card details are never passed on to us.
• Customer account: first and last name, email and password, stored in an irreversibly encrypted form. Lets you find your orders and details (performance of the contract).
• Quotes: first and last name, email, phone, company and address, to draw up the quote you requested (pre-contractual steps).
• Contact form: first and last name, email, phone, subject and message, to answer your request (legitimate interest).
• Newsletter: email and phone, to send you our news and offers (consent, which you may withdraw at any time).
• Games and loyalty programmes: the information in the sign-up form, to manage your participation (consent).
• Technical data: IP address and connection information, processed by our host to keep the site secure and working (legitimate interest).
• Audience measurement: pages viewed, clicks and purchase journey, in pseudonymised form, to understand how the site is used and improve it (consent).

3. Recipients

Your data is intended for the La Chocolaterie team. It is never sold. We use the following providers, who process it on our behalf:

• Cloudflare: hosting of the site and its data, sending the site’s emails;
• Stripe: online payment;
• Google (Google Workspace): our mailbox, which receives your messages;
• Google (Google Analytics): audience measurement, with your consent;
• our delivery provider, with only the information needed to deliver your order.

Some of these providers may process data outside the European Union, in particular in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

4. Retention periods

• Orders and invoices: 10 years, as required by the French Commercial Code.
• Customer account: as long as it is used; deleted at your request or after 3 years of inactivity.
• Newsletter: until you unsubscribe, or 3 years after our last contact with you.
• Quotes and messages: 3 years after our last exchange.
• Technical connection data: 12 months at most.
• Audience measurement: cookies for 13 months at most, measurement data kept for 14 months at most.

5. Cookies

The site uses cookies that are necessary for it to work and, only with your consent, audience measurement cookies:

• panier: keeps your cart from one visit to the next (30 days);
• client: keeps you signed in to your customer account (30 days);
• cc_cookie: remembers your cookie choices (6 months);
• Stripe’s cookies, set on the payment page to secure the transaction and prevent fraud.
• _ga, _ga_*: Google Analytics, audience measurement, set only if you accept them (13 months).

Audience measurement is provided by Google Analytics 4 (Google Ireland Limited). Nothing is loaded until you accept analytics cookies; if you refuse or withdraw your consent, these cookies are deleted. IP addresses are not stored and we do no targeted advertising. You can review your choices at any time through the “Cookies” link at the bottom of every page.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to its processing, to withdraw your consent at any time and to give instructions about what happens to it after your death.

To exercise these rights, write to contact@lachocolaterie.re or to SARL La Chocolaterie, 16 rue Sainte-Anne, 97400 Saint-Denis, La Réunion. We reply within one month; proof of identity may be requested if in doubt. You can unsubscribe from the newsletter at any time, simply by asking.

If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

7. Security

The site is served exclusively over an encrypted connection (HTTPS). Passwords are stored in an irreversibly encrypted form, and access to data is limited to the people who need it.

Last update

Last update of this policy: 25 October 2026.