Go to homepage
FIND US
CH
EU
UK
Go to homepage
CH
EU
UK

Privacy Policy

Website: https://www.caviarhouse.com/uk/en/

PREAMBLE

This privacy policy (hereinafter the "Policy") is intended to inform users of the website https://www.caviarhouse.com/uk/en/ (hereinafter the "Website") of the conditions under which their personal data are collected and processed, in accordance with:

  • the UK General Data Protection Regulation ("UK GDPR") as it results from the European Union (Withdrawal) Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019;
  • the Data Protection Act 2018 ("DPA 2018");
  • the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended ("PECR"), and in particular Regulation 6 on cookies and Regulation 22 on marketing by electronic means.

As the Website is operated by a company established in Switzerland, this Policy is intended to apply to users residing in the United Kingdom. For users residing in Switzerland, the European Union or any other country, the specific privacy policies are accessible on the corresponding websites of the Caviar House & Prunier group.

Users are invited to read this Policy carefully before using the Website and in particular before transmitting any personal data.

1. IDENTITY OF THE DATA CONTROLLER

The processing of personal data described in this Policy is carried out jointly by the following two companies (hereinafter together the "Joint Controllers"), within the meaning of Article 26 of the UK General Data Protection Regulation (UK GDPR):

First Joint Controller — CHP UK City Limited

Private limited company incorporated under English law

Registered office: 161 Piccadilly, London, England, W1J 9EA

Companies House registration number: 10832834

Place of registration: Registered in England and Wales

VAT number: GB 272 3993 75 [to be verified — see gov.uk/check-uk-vat-number or customer invoice]

Telephone: +44 (0)208 191 2208

Email address: info.uk@caviarhouse.com

CHP UK City Limited commercially operates the Website, collects payments from customers and manages the commercial and logistical relationship within the United Kingdom.

Second Joint Controller — CAVIAR HOUSE & PRUNIER (France)

SASU, with a share capital of €500,000

Registered with the Paris Trade and Companies Register under number 399 465 319

Registered office: 20 avenue Victor Hugo – 75016 Paris

Caviar House & Prunier France defines the editorial strategy of the Website, coordinates the selection of products and manages the cross-functional contractual arrangements of the group with the main technical service providers (in particular the hosting provider and audience measurement tools).

Joint controllership regime:

The two companies above jointly determine the purposes and means of processing personal data collected via the Website. They therefore act as Joint Controllers of the processing.

Single point of contact for data subjects:

To facilitate the exercise of their rights, the Joint Controllers have designated a single point of contact.

2. SCOPE AND COMMITMENTS

This Policy applies to all users of the Website, whether simple visitors, prospects or customers of Caviar House & Prunier Holding SA.

The data controller undertakes to comply with the principles set out in Article 5 of the UK GDPR:

  • lawfulness, fairness and transparency;
  • purpose limitation: only data strictly necessary for the defined purposes is collected;
  • data minimisation;
  • accuracy and keeping data up to date;
  • storage limitation;
  • integrity and confidentiality through appropriate security measures;
  • accountability.

3. DATA COLLECTED, PURPOSES, LEGAL BASES AND RETENTION PERIODS

Caviar House & Prunier Group SA collects users' personal data in the following circumstances:

  • when browsing the Website (automatic collection of technical navigation data);
  • when creating and using a customer account;
  • when placing an order on the Website;
  • when sending a message via the contact form, by email, telephone or post;
  • when subscribing to the newsletter;
  • when participating in a competition or promotional campaign, where applicable.

Purpose: Management and fulfilment of orders

Data processed: Identity, contact details, order history, billing data, payment method data

Legal basis: Performance of a contract – Art. 6(1)(b) UK GDPR

Recipients: Internal departments, carriers, payment service providers (Saferpay – SIX Payment Services SA, PayPal Europe S.à.r.l.)

Retention period: Duration of the contractual relationship + 6 years (Limitation Act 1980, section 5)

Purpose: Customer account management

Data processed: Login credentials, hashed password, preferences, internal account browsing history

Legal basis: Performance of a contract – Art. 6(1)(b) UK GDPR

Recipients: Internal departments; hosting provider

Retention period: Duration of account activity; deletion upon request or after [TO BE COMPLETED: generally 3 years] of inactivity

Purpose: Management of requests submitted via the contact form, by email, telephone or post

Data processed: Identity, contact details, message content, correspondence history

Legal basis: Consent – Art. 6(1)(a) UK GDPR; or legitimate interest in responding to requests – Art. 6(1)(f) UK GDPR

Recipients: Customer service

Retention period: Duration necessary for processing, then 3 years from the last contact

Purpose: Sending of the newsletter and commercial communications by electronic means

Data processed: Email address, title, first name, declared areas of interest, email open and click history

Legal basis: Prior consent – Regulation 22 PECR and Art. 6(1)(a) UK GDPR; for existing customers: soft opt-in – Regulation 22(3) PECR

Recipients: Marketing department; email service provider [TO BE COMPLETED]

Retention period: Until withdrawal of consent or 3 years after the last contact for prospects

Purpose: Audience measurement and statistical analysis (Google Analytics)

Data processed: IP address (anonymised), navigation data, pages visited, duration of visit, device used, technical identifiers

Legal basis: Prior consent – Regulation 6 PECR and Art. 6(1)(a) UK GDPR

Recipients: Marketing department; Google LLC (United States)

Retention period: Maximum 13 months (ICO recommendation)

Purpose: Targeted advertising and conversion tracking (Google Ads, Meta Pixel, retargeting)

Data processed: IP address, advertising identifiers, navigation events, third-party account identifiers if logged in

Legal basis: Prior consent – Regulation 6 PECR and Art. 6(1)(a) UK GDPR

Recipients: Google LLC, Meta Platforms Inc. (United States), affiliate partners [TO BE COMPLETED]

Retention period: Maximum 13 months

Purpose: Website security, fraud prevention and abuse detection

Data processed: IP address, connection logs, payment data (transaction token)

Legal basis: Legitimate interest of the controller – Art. 6(1)(f) UK GDPR; legal obligations – Art. 6(1)(c) UK GDPR

Recipients: Internal departments; payment service provider; competent authorities upon requisition; Cloudflare

Retention period: 12 months for logs; 13 months for payment data

Purpose: Compliance with legal, tax and accounting obligations

Data processed: Billing data, customer identity and contact details

Legal basis: Legal obligation – Art. 6(1)(c) UK GDPR; Companies Act 2006, section 388; HMRC record-keeping requirements

Recipients: Internal departments (accounting); auditor; HMRC upon requisition

Retention period: 6 years from the close of the financial year (HMRC requirements)

Purpose: Exercise and defence of legal rights

Data processed: Any data necessary for the relevant dispute

Legal basis: Legitimate interest – Art. 6(1)(f) UK GDPR

Recipients: Internal departments; legal counsel; competent courts

Retention period: Duration of the applicable limitation period (Limitation Act 1980)

Where the provision of certain data is mandatory, the corresponding fields are indicated by an asterisk (*) or equivalent notice. Failure to provide mandatory data prevents the relevant processing from being carried out.

4. COOKIES AND TRACKERS

4.1. Definition and legal framework

Cookies are text files deposited and stored on the user's device when browsing the Website. The depositing and reading of cookies is governed in the United Kingdom by Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). Consent must comply with the requirements of Articles 4(11) and 7 of the UK GDPR.

4.2. Categories of cookies used on the Website

  • Strictly necessary cookies: essential for the operation of the Website; no consent required.
  • Preference and functionality cookies: subject to the user's prior consent.
  • Analytics cookies: subject to the user's prior consent.
  • Marketing and advertising cookies: subject to the user's prior consent.

4.3. Collection and withdrawal of consent

The user may at any time modify their choices by accessing the cookie management module available at the bottom of each page of the Website. Choices are retained for a period of six (6) months; the lifespan of the cookies themselves does not exceed thirteen (13) months.

5. THIRD-PARTY TOOLS AND PLUGINS

5.1. Google Analytics

Service provided by Google LLC and Google Ireland Ltd. The IP address anonymisation feature is enabled.

5.2. Google Ads and conversion tracking

Measures the effectiveness of advertising campaigns.

5.3. Meta Pixel

Provided by Meta Platforms Ireland Ltd.

5.4. YouTube

Extended data protection mode is enabled.

5.5. Google Fonts

Hosted locally on the Website's servers.

5.6. Social media plugins

Facebook, Instagram, X. Configured in "two-click" mode.

5.7. Cloudflare

Content Delivery Network (CDN) and cyberattack protection service. The transfer of data to the United States is covered by the UK Extension to the EU-U.S. Data Privacy Framework.

6. PAYMENT SERVICE PROVIDERS

6.1. Stripe

Card payments.

6.2. PayPal

Processed by PayPal (Europe) S.à.r.l. et Cie, S.C.A., Luxembourg.

6.3. Payment data

Caviar House & Prunier Group SA retains neither the card number in clear text nor the security code (CVV).

7. RECIPIENTS OF DATA

Data is intended for the departments of CHP UK City Limited and CAVIAR HOUSE & PRUNIER, SASU, as well as processors, payment service providers, third-party tool providers and competent authorities.

8. INTERNATIONAL DATA TRANSFERS

Transfers are governed by the following safeguards: adequacy decision (Switzerland), adherence to the UK Extension to the EU-U.S. Data Privacy Framework (United States), Data Processing Agreement, IDTA or UK Addendum.

9. DATA SECURITY AND CONFIDENTIALITY

Technical and organisational measures in compliance with Article 32 of the UK GDPR. Notification to the ICO in the event of a data breach within 72 hours.

10. RIGHTS OF DATA SUBJECTS

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Right to withdraw consent
  • Rights related to automated decision-making and profiling

11. RIGHT TO LODGE A COMPLAINT WITH THE ICO

Independently of any other administrative or legal remedy, any data subject has the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office (ICO)

Wycliffe House, Water Lane

Wilmslow, Cheshire, SK9 5AF

United Kingdom

12. MINORS

Services are reserved for adults. The minimum age of consent is set at 13 years in the United Kingdom.

13. AMENDMENTS TO THIS POLICY

The Joint Controllers reserve the right to amend this Policy at any time.

14. CONTACT

Single point of contact:

Mr Ludovic Maulucci

20 avenue Victor Hugo

75116 – Paris, France

Email address: info.uk@caviarhouse.com (subject: "Data Protection")