Privacy Policy

Website: www.caviarhouse.com/ch

Preamble

The purpose of this privacy policy (hereinafter the “Policy”) is to inform users of the website www.caviarhouse.com/ch (hereinafter the “Site”) of the conditions under which their personal data is collected and processed.

The Site is operated by Caviar House & Prunier (Suisse) SA, a company incorporated under Swiss law and established in Geneva. In accordance with the applicable general terms and conditions of sale, the products offered on the Site are sold exclusively to persons residing in Switzerland and delivered exclusively within Swiss territory.

This processing is therefore governed by Swiss law, and in particular by:

the Federal Act on Data Protection of 25 September 2020 (hereinafter the “FADP”), which entered into force on 1 September 2023;

the Data Protection Ordinance of 31 August 2022 (“DPO”);

Article 45c of the Telecommunications Act of 30 April 1997 (“TCA”) concerning cookies and similar processing;

the Federal Act against Unfair Competition of 19 December 1986 (“UCA”), in particular Article 3 let. o concerning commercial canvassing by electronic means.

Users are invited to read this Policy carefully before any use of the Site and, in particular, before transmitting any personal data.

1. Identity of the controller

The processing of personal data described in this Policy is carried out jointly by the two following companies (hereinafter together the “Joint Controllers”).

First joint controller: Caviar House & Prunier Suisse SA

A public limited company incorporated under Swiss law. Share capital: CHF 1,800,000, fully paid up. Entered in the Commercial Register of the Canton of Geneva under company identification number (UID) CHE-105.991.842.

Registered office: Rue du Rhône 30, 1204 Geneva, Switzerland.

Telephone: 02 27 81 02 37.

Email address: info.ch@caviarhouse.com.

Represented by Cyril Baron, Managing Director.

Second joint controller:

CAVIAR HOUSE & PRUNIER, SASU, with a share capital of EUR 500,000, entered in the Trade and Companies Register of Paris under number 399 465 319, whose registered office is located at 20 avenue Victor Hugo, 75016 Paris.

Caviar House & Prunier France defines the site's editorial strategy, coordinates the selection of products and manages the group's cross-functional contracting with the principal technical service providers (in particular the host and the audience-measurement tools).

Joint responsibility regime:

The two companies above jointly determine the purposes and means of the processing of personal data collected via the site. In this respect, they act as joint controllers of the processing.

Single point of contact for data subjects:

To make it easier for data subjects to exercise their rights, the Joint Controllers have designated a single point of contact (see Article 14 below).

2. Scope and undertakings

This Policy is addressed to all users of the Site, whether they are mere visitors, prospects or customers of Caviar House & Prunier Holding SA.

The controller undertakes to comply with the principles set out in Article 6 FADP:

the lawfulness of the processing (Art. 6 para. 1 FADP);

good faith and proportionality (Art. 6 para. 2 FADP);

the specified and recognisable purpose of the processing (Art. 6 para. 3 FADP);

the accuracy of the data and its updating (Art. 6 para. 5 FADP);

the appropriate security of the data (Art. 8 FADP).

3. Data collected, purposes, legal bases and retention periods

Caviar House & Prunier Suisse SA collects users' personal data in the following situations:

when the Site is browsed (automatic collection of technical browsing data);

when a customer account is created and used;

when an order is placed on the Site;

when a message is sent via the contact form, by email, by telephone or by post;

when subscribing to the newsletter;

when taking part in a prize draw or a promotional operation, where applicable.

The table below summarises, for each processing purpose carried out by Caviar House & Prunier Holding SA, the categories of data processed, the legal basis for the processing under the FADP, the recipients of the data and its retention period.

Where the provision of certain data is mandatory (for example in order to place an order), the corresponding fields are indicated by an asterisk (*) or an equivalent mention at the time of collection. Failure to provide the mandatory data prevents the processing concerned from being carried out.

4. Cookies and trackers

4.1. Definition and legal framework

Cookies are text files, often small in size, placed and stored on the user's device (computer, tablet, smartphone) when the Site is browsed. The term “cookies” here designates, by extension, all trackers placed or read on the user's device.

The placing and reading of cookies is governed under Swiss law by Article 45c TCA, which requires the user to be given clear prior information about the purpose of the processing and the means of objecting to it.

For cookies involving the processing of sensitive personal data or high-risk profiling within the meaning of the FADP, the user's prior and express consent is required (Art. 6 para. 7 FADP).

The controller has chosen to apply the prior-consent regime to all cookies that are not strictly necessary for the operation of the Site, in the interest of transparency and in accordance with the recommendations of the FDPIC.

4.2. Categories of cookies used on the Site

Strictly necessary cookies

These cookies are essential to the operation of the Site and to the provision of the services requested by the user (shopping-basket management, session identification, CSRF security token, caching, storage of the selected store and currency). They do not require the user's consent. Disabling them makes the Site unusable.

Preference and functionality cookies

These cookies make it possible to remember the user's choices (language, currency, wish list, closing of pop-ups) and to improve the browsing experience. They are subject to the user's prior consent.

Audience-measurement and statistics cookies

These cookies make it possible to analyse traffic on the Site and the behaviour of visitors in order to improve its usability and content. The Site uses, in particular, Google Analytics (Google LLC, United States), which places analytics cookies. These cookies are subject to the user's prior consent.

Advertising and marketing-tracking cookies

These cookies make it possible to serve the user personalised advertising on the Site or on third-party sites, to measure its effectiveness and to run an affiliate programme. The Site uses, in particular, Google Ads, Meta Pixel (Facebook Pixel) and Google Tag Manager. These cookies are subject to the user's prior consent.

4.3. Obtaining and withdrawing consent

On their first visit to the Site, the user is presented with an information banner allowing them:

to accept all cookies (“Accept all”);

to refuse all cookies that are not strictly necessary (“Reject”);

to set their choices by cookie category (“Configure”).

Refusing is as simple as accepting, in accordance with the recommendations of the FDPIC.

The user may change their choices at any time by accessing the cookie-management module available at the bottom of every page of the Site.

The user's choices are kept for a period of six (6) months; at the end of this period, the user will again be invited to express their preferences. The lifetime of the cookies themselves does not exceed thirteen (13) months.

4.4. Browser settings

The user may also configure their internet browser to block cookies, to be notified when they are placed, or to delete them. The procedure varies depending on the browser used:

Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac

Google Chrome: https://support.google.com/chrome/answer/95647

Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

Microsoft Edge: https://support.microsoft.com/en-gb/microsoft-edge

5. Third-party tools and plugins

5.1. Google Analytics

The Site uses Google Analytics, an analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States).

The IP-address anonymisation function is enabled. The placing of Google Analytics cookies is subject to the user's prior consent, expressed via the cookie banner. The user may at any time withdraw their consent or object to the collection of their data via Google Analytics by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout or by changing their choices in the Site's cookie-management module.

5.2. Google Ads and conversion tracking

The Site uses Google Ads and Google conversion tracking, which make it possible to measure the effectiveness of online advertising campaigns. These tools place cookies on the user's device only after their prior consent has been obtained. Google privacy policy: https://policies.google.com/privacy

5.3. Meta Pixel (Facebook Pixel)

The Site uses Meta Pixel, provided by Meta Platforms Inc. (United States). This tool makes it possible to track users' interactions with the advertising served on Facebook and Instagram and to build custom audiences. Its use is subject to the user's prior consent.

5.4. YouTube

The Site embeds video content hosted by YouTube, a service operated by Google LLC. The enhanced data-protection mode is enabled: YouTube does not place cookies on the user's device as long as the user does not start a video. Starting a video, however, results in the placing of cookies by YouTube and the establishment of a connection with its servers.

5.5. Google Fonts

The Site uses Google Fonts to ensure a consistent display of content across all users' browsers and devices. The font files are hosted locally on the Site's servers, in accordance with the recommendations. This configuration avoids any unnecessary transfer of users' IP addresses to Google's servers located in the United States. No personal data is transmitted to Google as a result of loading the fonts.

5.6. Social-media plugins

The Site contains links or plugins to the social networks Facebook (Meta Platforms), Instagram (Meta Platforms) and X (X Corp.). These plugins are configured in “two-click” mode: no data is transmitted to the social networks concerned until the user has activated the corresponding button by deliberately clicking on it.

5.7. Cloudflare

The Site uses the services of Cloudflare, Inc., whose registered office is located at 101 Townsend Street, San Francisco, CA 94107, United States, as a content delivery network (CDN) and as a protection service against cyberattacks. In this capacity, Cloudflare performs the following functions:

accelerating the loading of the Site's content by providing servers geographically close to the user;

protection against distributed denial-of-service (DDoS) attacks and against attempted intrusions;

filtering of illegitimate traffic and malicious bots.

The use of Cloudflare entails the processing by that company of the following data: IP address (truncated), browser user-agent, page requested, timestamp of the request. This truncation of the IP address constitutes a data-minimisation measure compliant with data-protection legislation.

The processing is based on the legitimate interest of the Joint Controllers in ensuring the security, availability and performance of the Site.

Cloudflare acts as a processor within the meaning of Article 28 GDPR. A data processing agreement compliant with the requirements of that article has been concluded between the Joint Controllers and Cloudflare.

The transfer of data to the United States resulting from the use of Cloudflare is covered by the Swiss-U.S. Data Privacy Framework, recognised by the Swiss Federal Council on 14 August 2024.

The user may consult Cloudflare's privacy policy at the following address: https://www.cloudflare.com/privacypolicy/.

6. Payment service providers

6.1. Saferpay (worldline.ch)

Card payments made on the Site are processed via the Saferpay platform, operated by SIX Payment Services SA (Hardturmstrasse 201, 8005 Zurich, Switzerland). Saferpay is compliant with the PCI DSS standard (Payment Card Industry Data Security Standard). SIX privacy policy: https://www.six-payment-services.com/en/services/legal/privacy-statement.html

6.2. PayPal

PayPal payments are processed by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg). PayPal privacy policy: https://www.paypal.com/ch/webapps/mpp/ua/privacy-full

6.3. Payment data

Card details are transmitted directly, in encrypted form, to the payment service providers. Caviar House & Prunier Suisse SA does not retain either the card number in clear text or the visual security code (CVV).

7. Recipients of the data

The personal data collected on the Site is intended for the authorised persons within the departments of Caviar House & Prunier Suisse SA (sales department, marketing department, customer service, accounting department, IT department) who need it for the purposes described in this Policy.

It may also be communicated to the following categories of recipients:

processors acting in the name and on behalf of the controller, in particular the Site's host, email-sending providers, carriers and delivery companies, the chartered accountant, and the publishers of the marketing and analytics tools used on the Site;

payment service providers (Worldline, PayPal);

third-party tool providers (Google LLC, Meta Platforms Inc., X Corp.) where the user has consented via the cookie banner;

the competent administrative or judicial authorities, where the controller is legally required to do so (formal request, injunction).

The detailed list of processors may be communicated to any data subject who requests it at the address of the data protection officer.

8. Communication of data abroad

Certain tools used on the Site (in particular Google Analytics, Google Ads, Meta Pixel, YouTube) involve a communication of data abroad, principally to the United States.

In accordance with Articles 16 and 17 FADP, these communications are governed by the following safeguards:

for communications to countries offering adequate protection according to the list in the Data Protection Ordinance (Annex 1 DPO): no additional measure is required;

for communications to the United States: the recipient's adherence to the Swiss-U.S. Data Privacy Framework recognised by the Swiss Federal Council on 14 August 2024;

failing that, the conclusion of standard contractual clauses recognised by the FDPIC, in particular the standard clauses adopted by the European Commission on 4 June 2021;

where applicable, additional technical and organisational measures (encryption, pseudonymisation, access restrictions).

The user may obtain a copy of the safeguards implemented by sending a request to the data protection officer.

9. Data security and confidentiality

Caviar House & Prunier Suisse SA implements the appropriate technical and organisational measures to ensure the security and confidentiality of personal data and to protect it against any accidental loss, alteration, disclosure or unauthorised access, in accordance with Article 8 FADP and Articles 1 to 6 DPO.

These measures include, in particular:

the encryption of communications by the SSL/TLS protocols;

restricting access to the data to authorised persons only, on the basis of the need-to-know principle;

the physical and logical securing of servers and information systems;

the implementation of backup and business-continuity procedures;

the training and awareness-raising of staff on data-protection requirements;

the contractual undertaking of processors to comply with an equivalent level of security.

In the event of a data-security breach likely to result in a high risk to the personality or fundamental rights of the data subjects, Caviar House & Prunier Suisse SA notifies this breach to the FDPIC as soon as possible, in accordance with Article 24 FADP, and informs the data subjects where the law so requires.

10. Rights of data subjects

In accordance with Articles 25 to 32 FADP, data subjects have the following rights over their personal data:

Right of access (Art. 25 FADP): to obtain from the controller confirmation that data concerning them is being processed and to receive the information necessary to assert their rights under the FADP.

Right to the handover or transfer of data (“right to data portability” - Art. 28 FADP): to receive the personal data that the data subject has provided to the controller, in a commonly used electronic format, or to request its direct transfer to another controller where this is technically possible.

Right to rectification (Art. 32 para. 1 FADP): to have inaccurate data corrected.

Right to object and right to erasure or destruction (Art. 32 para. 2 FADP): to object to the processing or to request the erasure or destruction of the personal data.

Right to prohibit communication to third parties (Art. 30 para. 2 let. b FADP): to prohibit the controller from communicating their personal data to specified third parties.

Right to withdraw consent (Art. 6 para. 6 FADP): to withdraw at any time the consent given. The withdrawal of consent does not affect the lawfulness of processing carried out beforehand.

Right relating to automated individual decisions (Art. 21 FADP): to be informed of a decision taken exclusively on the basis of automated processing that has legal effects for the data subject or significantly affects them, and to be able to state their point of view or to request that the decision be reviewed by a natural person. Caviar House & Prunier Suisse SA does not use such automated decisions on the Site.

To exercise these rights, the user may contact the data protection officer at the details set out in Article 1 of this Policy. A copy of an identity document may be requested in the event of reasonable doubt as to the identity of the applicant, in accordance with Article 19 DPO.

The controller responds to the request within thirty (30) days of its receipt. Where this time limit cannot be met, the controller informs the data subject and indicates the time within which the response will be provided, in accordance with Article 25 para. 7 FADP.

11. Right to report to the FDPIC

Independently of any other administrative or judicial remedy, every data subject has the right to submit a report to the Federal Data Protection and Information Commissioner if they consider that the processing of their personal data breaches the FADP:

Federal Data Protection and Information Commissioner (FDPIC)

Feldeggweg 1

3003 Bern

Telephone: +41 (0)58 462 43 95

Website: www.edoeb.admin.ch

12. Specific provisions applicable to minors

The services offered by the Site are not intended for minors. The creation of a customer account and the placing of an order are reserved for persons having full legal capacity within the meaning of Articles 13 and 17 of the Swiss Civil Code, in particular in view of the regulations applicable to the sale of alcohol (Federal Act on Foodstuffs and Utility Articles, Ordinance on Beverages and the applicable cantonal legislation).

In the event that the data of a minor is collected in error, Caviar House & Prunier Suisse SA undertakes to delete it as soon as possible upon notification.

13. Amendment of this Policy

Caviar House & Prunier Suisse SA reserves the right to amend this Policy at any time in order to take account of legislative, regulatory, case-law or technical developments.

Any substantial amendment will be brought to the attention of users by any appropriate means (in particular by a message displayed on the Site or by email for users with an account) before it enters into force.

Users are invited to consult this Policy regularly.

14. Contact

For any question relating to this Policy or to the exercise of the rights provided for by the FADP, the user may contact the Joint Controllers through the designated single point of contact: Mr Ludovic Maulucci, 20 avenue Victor Hugo, 75116 Paris - Email address: info.ch@caviarhouse.com (subject: “Data Protection”).

You may also contact one of the Joint Controllers directly, at the details indicated in Article 1 of this Policy.

Last updated: 6th August 2026