Privacy Policy

Website: www.caviarhouse.com/eu

PREAMBLE

This privacy policy (hereinafter the "Policy" or "Datenschutzerklärung") is intended to inform users of the website www.caviarhouse.com/eu (hereinafter the "Website") of the conditions under which their personal data are collected and processed, in accordance with:

Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR" / "DSGVO");
the Bundesdatenschutzgesetz of 30 June 2017, as amended by the Act of 23 June 2021 ("BDSG");
the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz of 23 June 2021, as amended on 14 May 2024 ("TDDDG", formerly TTDSG), and in particular its § 25 on cookies and trackers;
the Gesetz gegen den unlauteren Wettbewerb ("UWG"), and in particular its § 7 on commercial prospecting by electronic means;
the applicable provisions of the Digitale-Dienste-Gesetz of 14 May 2024 ("DDG", formerly TMG) regarding prior information to users.

The Website is operated by CAVIAR HOUSE & PRUNIER City GmbH and is addressed to users residing in Germany and more generally in the European Economic Area. Accordingly, the GDPR and German data protection law apply in full to the processing carried out by the Website, pursuant to Article 3(2) GDPR.

Users are invited to read this Policy carefully before using the Website and in particular before transmitting any personal data.

1. IDENTITY OF THE DATA CONTROLLER

The processing of personal data described in this Policy is carried out jointly by the following two companies (hereinafter together the "Joint Controllers" or "gemeinsam Verantwortliche"), within the meaning of Article 26 of the General Data Protection Regulation (GDPR):

First Joint Controller — Caviar House & Prunier City GmbH

Gesellschaft mit beschränkter Haftung incorporated under German law

Registered office: Redcarstr. 2a, D-53842 Troisdorf

Registered with the commercial register (Handelsregister) of the local court (Amtsgericht) of Caviar House & Prunier city GmbH under number HRB 14601

VAT identification number: DE 313721542

Legal representative (Vertretungsberechtigter): Mr Serdal Akyildiz, Geschäftsführer / Managing Director

Telephone: +49 2241 944970

Email address: info.de@caviarhouse.com

Caviar House & Prunier City GmbH commercially operates the Website, collects payments from customers and manages the commercial and logistical relationship for all effectively served Member States of the European Union.

Second Joint Controller — Caviar House & Prunier France

CAVIAR HOUSE & PRUNIER, SASU, with a share capital of €500,000

Registered with the Paris Trade and Companies Register under number 399 465 319

Registered office: 20 avenue Victor Hugo – 75016 Paris

Caviar House & Prunier France defines the editorial strategy of the Website, coordinates the selection of products and manages the cross-functional contractual arrangements of the group with the main technical service providers (in particular the hosting provider and audience measurement tools).

Joint controllership regime:

The two companies above jointly determine the purposes and means of processing personal data collected via the Website. They therefore act as Joint Controllers of the processing.

Single point of contact for data subjects:

To facilitate the exercise of their rights, the Joint Controllers have designated a single point of contact: info.de@caviarhouse.com

2. SCOPE AND COMMITMENTS

This Policy applies to all users of the Website, whether simple visitors, prospects or customers of Caviar House & Prunier City GmbH.

The data controller undertakes to comply with the principles set out in Article 5 of the GDPR:

lawfulness, fairness and transparency;
purpose limitation;
data minimisation;
accuracy of data;
storage limitation;
integrity and confidentiality through appropriate security measures;
accountability ("Rechenschaftspflicht").

3. DATA COLLECTED, PURPOSES, LEGAL BASES AND RETENTION PERIODS

Caviar House & Prunier City GmbH collects users' personal data in the following circumstances:

when browsing the Website (automatic collection of technical navigation data);
when creating and using a customer account;
when placing an order on the Website;
when sending a message via the contact form, by email, telephone or post;
when subscribing to the newsletter;
when participating in a competition or promotional campaign, where applicable.

The table below summarises, for each processing purpose, the categories of data processed, the legal basis for processing under the GDPR, BDSG and TDDDG, the recipients of the data and their retention period.

Purpose: Management and fulfilment of orders (processing, delivery, invoicing, after-sales service)

Data processed: Identity (title, surname, first name), contact details (postal address, delivery address, telephone, email), order history, billing data, payment method data

Legal basis: Performance of a contract – Art. 6(1)(b) GDPR; § 26(1) BDSG where applicable

Recipients: Internal departments (sales, logistics, accounting, customer service); carriers; payment service providers (Saferpay – SIX Payment Services SA, PayPal Europe S.à.r.l.)

Retention period: Duration of the contractual relationship + 10 years (§ 257 HGB, § 147 AO)

Purpose: Customer account management

Data processed: Login credentials, hashed password, preferences, internal account browsing history

Legal basis: Performance of a contract – Art. 6(1)(b) GDPR

Recipients: Internal departments; hosting provider

Retention period: Duration of account activity; deletion upon request or after 3 years of inactivity

Purpose: Management of requests submitted via the contact form, by email, telephone or post

Data processed: Identity, contact details, message content, correspondence history

Legal basis: Consent – Art. 6(1)(a) GDPR; or legitimate interest – Art. 6(1)(f) GDPR

Recipients: Customer service

Retention period: Duration necessary for processing, then 3 years from the last contact

Purpose: Sending of the newsletter and commercial communications by electronic means

Data processed: Email address, title, first name, declared areas of interest, email open and click history

Legal basis: Prior consent – Art. 6(1)(a) GDPR; § 7(2) UWG; for existing customers: § 7(3) UWG (analogous products)

Recipients: Marketing department; email service provider Brevo (France)

Retention period: Until withdrawal of consent or 3 years after the last contact for prospects

Purpose: Audience measurement and statistical analysis (Google Analytics)

Data processed: IP address (anonymised), navigation data, pages visited, duration of visit, device used, technical identifiers

Legal basis: Prior consent – § 25(1) TDDDG; Art. 6(1)(a) GDPR

Recipients: Marketing department; Google LLC (United States); Google Ireland Ltd

Retention period: Maximum 13 months

Purpose: Targeted advertising and conversion tracking (Google Ads, Meta Pixel, retargeting)

Data processed: IP address, advertising identifiers, navigation events, third-party account identifiers if logged in

Legal basis: Prior consent – § 25(1) TDDDG; Art. 6(1)(a) GDPR

Recipients: Google LLC, Meta Platforms Inc. (United States)

Retention period: Maximum 13 months

Purpose: Website security, fraud prevention and abuse detection

Data processed: IP address, connection logs, payment data (transaction token)

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR; legal obligations – Art. 6(1)(c) GDPR

Recipients: Internal departments; payment service provider; competent authorities upon requisition; Cloudflare (US-hosted, compliant)

Retention period: 12 months for logs; 13 months for payment data

Purpose: Compliance with legal, tax and accounting obligations

Data processed: Billing data, customer identity and contact details

Legal basis: Legal obligation – Art. 6(1)(c) GDPR; § 257 HGB; § 147 AO

Recipients: Internal departments (accounting); auditor; tax authority upon requisition

Retention period: 10 years from the close of the financial year

Purpose: Exercise and defence of legal rights

Data processed: Any data necessary for the relevant dispute

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR

Recipients: Internal departments; legal counsel; competent courts

Retention period: Duration of the applicable limitation period (§§ 195 et seq. BGB; 3 years as a general rule, 10 years for specific contractual claims)

Where the provision of certain data is mandatory, the corresponding fields are indicated by an asterisk (*) or equivalent notice. Failure to provide mandatory data prevents the relevant processing from being carried out.

4. COOKIES AND TRACKERS

4.1. Definition and legal framework

Cookies are text files deposited and stored on the user's device when browsing the Website. The term "cookies" is used here, by extension, to refer to all trackers deposited or read on the user's device.

The depositing and reading of cookies is governed in Germany by § 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz ("TDDDG"), which transposes Directive 2002/58/EC and requires the user's prior consent for any depositing or reading of information on their device, with the exception of cookies strictly necessary for the provision of an information society service expressly requested by the user (§ 25(2) TDDDG).

Consent must comply with the requirements of Articles 4(11) and 7 of the GDPR: freely given, specific, informed and unambiguous, demonstrated by a clear affirmative act, and revocable at any time with the same ease as it was given.

This requirement applies regardless of whether the data concerned are personal or not (CJEU, 1 October 2019, Planet49, C-673/17).

4.2. Categories of cookies used on the Website

Technically necessary cookies

These cookies are essential for the operation of the Website and the provision of services requested by the user (shopping basket management, session identification, CSRF security token, caching, memorisation of the selected shop and currency). They are deposited on the basis of § 25(2)(2) TDDDG and do not require the user's consent.

Preference and functionality cookies

These cookies memorise the user's choices (language, currency, wish list). They are subject to the user's prior consent (§ 25(1) TDDDG).

Audience measurement and statistics cookies

These cookies are used to analyse Website traffic and visitor behaviour. The Website uses in particular Google Analytics. These cookies are subject to the user's prior consent.

Advertising and marketing tracking cookies

These cookies enable personalised advertisements to be displayed to the user, to measure their effectiveness and to manage an affiliate programme. The Website uses in particular Google Ads, Meta Pixel and Google Tag Manager. These cookies are subject to the user's prior consent.

4.3. Collection and withdrawal of consent

Upon their first visit to the Website, the user is presented with an information banner enabling them to accept, refuse or configure their choices by cookie category. Refusing is as simple as accepting, in accordance with the requirement for freely given consent under Article 7(4) GDPR and as confirmed by the Datenschutzkonferenz (guidance of 20 December 2021).

The user may at any time modify their choices by accessing the cookie management module available at the bottom of each page of the Website.

The user's choices are retained for a period of six (6) months; the lifespan of the cookies themselves does not exceed thirteen (13) months.

5. THIRD-PARTY TOOLS AND PLUGINS

5.1. Google Analytics

The Website uses Google Analytics, an analytics service provided by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States).

The IP address anonymisation feature is enabled: the IP address of the user located within the European Union or the European Economic Area is truncated by Google prior to any transfer to the United States.

In accordance with the position of the Datenschutzkonferenz (resolution of 12 May 2022) and German case law, the depositing of Google Analytics cookies is subject to the user's prior and express consent. The user may at any time withdraw their consent or object to the collection of their data via Google Analytics by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout?hl=en or by modifying their choices in the Website's cookie management module.

5.2. Google Ads and conversion tracking

The Website uses Google Ads and Google conversion tracking. These tools deposit cookies on the user's device only after their prior consent has been collected. For further information: https://policies.google.com/privacy

5.3. Meta Pixel (Facebook Pixel)

The Website uses Meta Pixel, provided by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) and Meta Platforms, Inc. (United States). This tool tracks users' interactions with advertisements displayed on Facebook and Instagram and enables the creation of custom audiences. Its use is subject to the user's prior consent, in accordance with German case law (LG Bonn, 29 November 2022; LG Berlin, 13 June 2023). Meta privacy policy: https://www.facebook.com/privacy/policy

5.4. YouTube

The Website integrates video content hosted by YouTube, a service operated by Google Ireland Ltd. and Google LLC. The extended data protection mode ("erweiterter Datenschutzmodus") is enabled: YouTube does not deposit cookies on the user's device as long as the user does not play a video. However, playing a video will result in YouTube depositing cookies and establishing a connection with Google's servers. The user's consent is obtained prior to any playback involving a data transfer.

5.5. Google Fonts

The Website uses Google Fonts typefaces to ensure consistent display of content across all browsers and users' devices. Font files are hosted locally on the Website's servers, in accordance with recommendations derived in particular from German case law (LG München I, 20 January 2022, 3 O 17493/20). This configuration avoids any unnecessary transfer of users' IP addresses to Google's servers located in the United States. No personal data is transmitted to Google as a result of loading the fonts.

5.6. Social media plugins

The Website contains links or plugins to the social networks Facebook (Meta Platforms Ireland Ltd.), Instagram (Meta Platforms Ireland Ltd.) and X (X Corp.).

In accordance with the CJEU judgment in Fashion ID (29 July 2019, C-40/17) and subsequent German case law, these plugins are configured in "two-click" mode ("Shariff" solution): no data is transmitted to the relevant social networks until the user has activated the corresponding button by clicking on it voluntarily.

Once activated by the user, these plugins may collect data such as the IP address, the page visited and, if the user is logged into their account on the relevant social network, the association of the visit with their profile. Users are invited to consult the privacy policies of the relevant social networks.

5.7. Cloudflare

The Website uses the services of Cloudflare, Inc., whose registered office is at 101 Townsend Street, San Francisco, CA 94107, United States, as a Content Delivery Network (CDN) and protection service against cyberattacks. Cloudflare performs the following functions:

accelerating the loading of Website content by making available servers geographically close to the user;
protection against distributed denial-of-service (DDoS) attacks and attempted cyberattacks;
filtering of illegitimate traffic and malicious bots.

The use of Cloudflare involves the processing by that company of the following data: IP address (truncated), browser user-agent, page requested, request timestamp. This truncation of the IP address constitutes a data minimisation measure in compliance with data protection regulations.

The processing is based on the legitimate interest of the Joint Controllers in ensuring the security, availability and performance of the Website.

Cloudflare acts as a data processor within the meaning of Article 28 of the GDPR [UK GDPR]. A Data Processing Agreement compliant with the requirements of that article has been concluded between the Joint Controllers and Cloudflare.

The transfer of data to the United States resulting from the use of Cloudflare is covered by the EU-U.S. Data Privacy Framework, recognised by the European Commission by adequacy decision of 10 July 2023.

The user may consult Cloudflare's privacy policy at: https://www.cloudflare.com/privacypolicy/

6. PAYMENT SERVICE PROVIDERS

6.1. Saferpay (SIX Payment Services SA)

Card payments made on the Website are processed via the Saferpay platform, operated by SIX Payment Services SA (Hardturmstrasse 201, 8005 Zurich, Switzerland). Saferpay is compliant with the PCI DSS standard. Privacy policy: https://www.six-payment-services.com/de/services/legal/privacy-statement.html

6.2. PayPal

PayPal payments are processed by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

6.3. Payment data

Card data is transmitted directly, in encrypted form, to payment service providers. Caviar House & Prunier City GmbH retains neither the card number in clear text nor the security code (CVV).

7. RECIPIENTS OF DATA

Personal data collected on the Website is intended for authorised personnel within the departments of Caviar House & Prunier City GmbH. It may also be disclosed to the following categories of recipients:

processors ("Auftragsverarbeiter") acting on behalf of and for the controller, pursuant to processing agreements compliant with Article 28 GDPR, including in particular the hosting provider, email service providers, carriers, the auditor, and publishers of marketing and analytics tools;
payment service providers (Saferpay, PayPal);
third-party tool providers (Google LLC, Meta Platforms Inc., X Corp.) where the user has consented via the cookie banner;
competent administrative or judicial authorities, where the data controller is legally required to do so.

The detailed list of processors may be communicated to any data subject who requests it from the Data Protection Officer.

8. INTERNATIONAL DATA TRANSFERS

Certain tools used on the Website (in particular Google Analytics, Google Ads, Meta Pixel, YouTube) involve the transfer of data to the United States or to other third countries that do not afford a level of data protection equivalent to that of the European Union.

These transfers are governed by the following safeguards, in accordance with Articles 44 to 49 of the GDPR:

for transfers to Switzerland, the place of establishment of the data controller: adequacy decision of the European Commission of 26 July 2000 (still in force);
for transfers to the United States: the recipient's adherence to the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023);
failing that, conclusion of standard contractual clauses adopted by the European Commission on 4 June 2021 (Decision 2021/914);
additional technical and organisational measures in accordance with EDPB Recommendations 01/2020 of 18 June 2021 (encryption, pseudonymisation, access restrictions, transfer impact assessments).

The user may obtain a copy of the safeguards implemented by submitting a request to the Data Protection Officer.

9. DATA SECURITY AND CONFIDENTIALITY

Caviar House & Prunier City GmbH implements appropriate technical and organisational measures ("geeignete technische und organisatorische Maßnahmen") to ensure the security and confidentiality of personal data and to protect them against any accidental loss, alteration, disclosure or unauthorised access, in accordance with Article 32 GDPR and §§ 64 et seq. BDSG.

These measures include in particular:

encryption of communications using SSL/TLS protocols;
limitation of access to data to authorised personnel only;
physical and logical security of servers and information systems;
implementation of backup and business continuity procedures;
training and awareness of staff;
contractual commitment of processors to maintain an equivalent level of security.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, Caviar House & Prunier City GmbH notifies this breach to the competent supervisory authority within seventy-two (72) hours, and where applicable to the data subjects, in accordance with Articles 33 and 34 GDPR.

10. RIGHTS OF DATA SUBJECTS

In accordance with Articles 12 to 22 of the GDPR and §§ 32 to 37 of the BDSG, data subjects have the following rights over their personal data:

Right to information and access ("Auskunftsrecht" – Art. 15 GDPR; § 34 BDSG): to obtain confirmation that data are being processed and to receive a copy.
Right to rectification ("Recht auf Berichtigung" – Art. 16 GDPR): to have inaccurate or incomplete data rectified.
Right to erasure ("Recht auf Löschung" – Art. 17 GDPR; § 35 BDSG): to obtain erasure of data in the cases provided for by law.
Right to restriction of processing ("Recht auf Einschränkung der Verarbeitung" – Art. 18 GDPR): to obtain restriction of processing.
Right to data portability ("Recht auf Datenübertragbarkeit" – Art. 20 GDPR): to receive data in a structured, commonly used and machine-readable format.
Right to object ("Widerspruchsrecht" – Art. 21 GDPR; § 36 BDSG): to object, on grounds relating to their particular situation, to processing based on the legitimate interest of the controller, as well as unconditionally to any processing for direct marketing purposes.
Right to withdraw consent ("Widerruf der Einwilligung" – Art. 7(3) GDPR): to withdraw consent given at any time, without such withdrawal affecting the lawfulness of prior processing.
Right to human review of automated decisions (Art. 22 GDPR): not to be subject to a decision based solely on automated processing. Caviar House & Prunier City GmbH does not make use of such automated decisions on the Website.

To exercise these rights, the user may contact the Data Protection Officer at the contact details set out in Articles 2 and 3 of this Policy.

The controller responds to the request within one (1) month of receipt, extendable by two (2) further months in the event of complexity, with the user being informed of the extension and its reasons (Art. 12(3) GDPR).

11. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Independently of any other administrative or legal remedy, any data subject has the right to lodge a complaint with the competent supervisory authority, in accordance with Article 77 GDPR and § 19 BDSG.

The competent German federal supervisory authority is:

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)

Graurheindorfer Straße 153

53117 Bonn

Telephone: +49 (0)228 997799-0

Email address: poststelle@bfdi.bund.de

Website: www.bfdi.bund.de

The user may also contact the data protection authority of their Land of habitual residence, workplace or the place where the alleged data breach occurred. The list of Land authorities is available on the Datenschutzkonferenz website (www.datenschutzkonferenz-online.de).

12. MINORS

The services offered on the Website are not intended for minors. The creation of a customer account and the placing of an order are reserved for persons with full legal capacity (§§ 104 et seq. BGB), having regard in particular to the regulations applicable to the sale of alcohol (Jugendschutzgesetz).

In accordance with Article 8 GDPR, the minimum age of consent to the processing of data by an information society service provider is set in Germany at sixteen (16) years. Below this age, consent must be obtained from the holder of parental responsibility.

In the event that data relating to a minor is collected by mistake, Caviar House & Prunier Group SA undertakes to delete it as soon as possible upon notification.

13. AMENDMENTS TO THIS POLICY

Caviar House & Prunier City GmbH reserves the right to amend this Policy at any time in order to take account of legislative, regulatory, case-law or technical developments.

Any material amendment will be brought to the attention of users by any appropriate means prior to its entry into force.

Users are invited to consult this Policy regularly.

14. CONTACT

For any question relating to this Policy or the exercise of the rights provided for by the nFADP, the user may contact the Joint Controllers through the designated single point of contact:

Mr Ludovic Maulucci

20 avenue Victor Hugo75116 – Paris, France

Email address: info.de@caviarhouse.com (subject: "Data Protection")

You may also contact either of the Joint Controllers directly at the contact details set out in Article 1 of this Policy.