Privacy policy

Data controller

The data controller is LA BOX GOURMANDE - ETS GIRARDI, Activité en Nom Personnel, RCI 95P05763, 17 avenue de l'Annonciade, 98000 Monaco, represented by Souad Girardi.

Contact for any question about personal data: [email protected].

Applicable legislation

The business operates from Monaco. Processing is governed by law no. 1.565 of 3 December 2024 on the protection of personal data and supervised by the Autorité de Protection des Données Personnelles, the APDP.

Orders placed from the European Union, France first and foremost, are also governed by the General Data Protection Regulation. Both frameworks are applied together, with the more protective rule prevailing.

Data collected

Data is collected directly from you. No bank details are recorded by the site: card payments are processed by the bank.

• Order: surname, first name, email address, telephone, delivery address, contents and amount of the order.
• Order intended as a gift: recipient’s name, delivery address, message written on the card, requested delivery date.
• Contact form: name, email address, subject and content of the message.
• Business quote request: company name, contact name, email address, telephone, volume, budget, occasion, requested date and any list of recipients provided.
• Browsing: pages viewed, date and time, type of device and browser, IP address.

Purposes and legal bases

Each processing operation serves a specific purpose and rests on a legal basis:

• Processing the order, delivering it, issuing the invoice and providing after-sales service: performance of the contract.
• Replying to a contact request or a quote request: pre-contractual measure and legitimate interest.
• Keeping the accounts and meeting tax obligations: legal obligation.
• Sending offers to customers and to professionals in the sector: legitimate interest, with the option to object at any time.
• Sending the newsletter to those who have asked for it: consent.
• Measuring site audience: consent.

Mandatory information

The information needed for ordering, delivery and invoicing is mandatory. Without it, the order cannot be processed. All other information is optional.

Retention periods

Data is not kept for longer than necessary:

• Orders and delivery details: the duration of the commercial relationship, then archived for the limitation period of guarantee claims.
• Invoices and accounting records: ten years, under accounting obligations.
• Contact messages and quote requests: three years from the last exchange.
• Business contacts that did not lead to an order: three years from the last contact.
• Audience measurement data: thirteen months.

Recipients and processors

Data is neither sold nor rented. It is passed on only to the following recipients, to the extent they need it:

• The proprietor and the persons authorised to prepare and follow up orders.
• The carrier, for the data needed for delivery.
• The bank and the payment gateway, for collecting payment.
• The accounting firm, for accounting records.
• Pragma, the site’s technical provider, based in Monaco.
• Contabo GmbH, the site’s host, in Germany.
• PostHog, the audience measurement tool, the servers used being located in the United States.

Transfers outside the European Union

The site and its database are hosted within the European Union. Audience measurement, however, involves a transfer to the United States.

Audience measurement and cookies

The site uses PostHog to count pages viewed and visits. Session recording and online surveys are disabled. No advertising trackers are set.

Marketing communications

A customer may receive offers for products similar to those they have ordered. A professional may be contacted in connection with their business. Every message includes a simple, free way to object.

The newsletter is sent only to those who have asked for it, and consent may be withdrawn at any time.

Security

Exchanges with the site are encrypted. Access to the back office is protected by a personal account and a session verified by the server. Access to data is limited to the people who need it to process orders.

Your rights

You have the right of access, rectification, erasure, restriction and objection, the right to data portability, the right to withdraw your consent at any time and the right to set instructions on what happens to your data after your death.

These rights are exercised by email to [email protected] or by post to 17 avenue de l'Annonciade, 98000 Monaco. You will receive a reply within one month. Proof of identity may be requested where there is serious doubt about the identity of the person making the request.

Complaint to a supervisory authority

If you are not satisfied with the reply given, you may refer the matter to the Autorité de Protection des Données Personnelles of Monaco.

If you live in France, you may refer the matter to the Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Monaco Data Protection Authority (APDP), Le Concorde, 4th floor, 11 rue du Gabian, 98000 Monaco. Website: https://apdp.mc; email: [email protected].

Updates

This policy may be amended to reflect changes to the site or to the regulations. The applicable version is the one published on this page.