Atelier Privacy Policy & Data Integrity

1. Identity of the Data Controller

The entity responsible for processing personal data on this platform is:

Bouquetcamembrt SARL / Atelier Lisieux
24 Route de Normandie, Atelier 5B
14100 Lisieux, Normandy, France
Data Protection Officer Contact: [email protected]
Telephone: +33 2 31 62 00 14

2. Personal Data We Collect and Process

When you interact with our website, inquire about custom catering briefs, or place orders for our handcrafted floral Camembert platters, we collect data across several distinct channels:

A. Catering Briefs & Order Information

• Identity & Contact Credentials: Full name, company name (where applicable), contact phone number, email address.
• Recipient Coordinates: Recipient full name, physical delivery address, gate codes, special drop-off instructions, and delivery date schedule.
• Custom Event & Dietary Disclosures: Event type (wedding, gala, tasting), estimated guest count, botanical preferences (e.g. lavender, rose, pansy selections), wine pairing preferences, and severe food allergy notices (e.g., tree nuts, unpasteurized milk sensitivity).

B. Financial & Transactional Data

All online payment processing is routed through PCI-DSS Level 1 compliant gateway partners using 256-bit SSL/TLS encryption. Bouquetcamembrt does not hold, process, or retain raw credit card numbers or banking passwords on local servers.

C. Automated Technical & Session Data

• IP address, browser user-agent string, device operating system, referring URL header, and timestamp.
• Session state parameters, persistent basket build data, and interaction analytics within our interactive product drawers.

3. Legal Bases and Purposes of Data Processing

We process your personal information strictly according to the following lawful bases under GDPR Article 6:

• Contractual Performance (Art. 6(1)(b)): Fulfilling catering orders, crafting bespoke floral wheels, managing cold-chain shipping logistics, and responding to custom event briefs.
• Legal Compliance (Art. 6(1)(c)): Satisfying European food safety traceability regulations, tax obligations, and commercial accounting requirements.
• Legitimate Interests (Art. 6(1)(f)): Maintaining cold-chain quality assurance, preventing fraudulent transactions, and optimizing website usability and security.
• Explicit Consent (Art. 6(1)(a)): Storing non-essential analytical cookies and processing specific dietary allergy disclosures provided voluntarily by the user.

4. Cold-Chain Log & Food Traceability Data Retention

To comply with French health protocols (DGCCRF) and European Union food hygiene standards, cold-chain temperature logs and recipient dispatch addresses are maintained in encrypted audit archives for thirty-six (36) months from the date of delivery.

General contact inquiries and non-fulfilled catering briefs are deleted or anonymized after eighteen (18) months unless a continuing commercial relationship is established.

5. Disclosure of Data to Third Parties

We strictly limit third-party disclosures. Information is shared only with verified service partners necessary for fulfilling our artisanal offerings:

• Express Cold-Chain Logistics Carriers: Recipient delivery coordinates and phone contact numbers are shared with specialized temperature-controlled courier partners.
• Payment Infrastructure Providers: Encrypted payment tokens are transmitted directly to certified merchant processors.
• IT Infrastructure & Hosting Hosts: Secure cloud servers located within the European Economic Area (EEA).

We never sell, rent, or trade patron contact lists to third-party marketing brokers.

6. International Data Transfers

All primary database infrastructure is located within the European Economic Area. Where auxiliary services require data routing through non-EEA destinations, transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Rights of the Data Subject

Under GDPR and international privacy legislation, you have the following rights regarding your personal data:

• Right of Access: Obtain a copy of all personal records maintained by Atelier Lisieux.
• Right to Rectification: Request immediate correction of erroneous address or contact information.
• Right to Erasure ("Right to be Forgotten"): Demand deletion of personal data where retention is no longer required for food safety or legal compliance.
• Right to Restrict or Object: Limit processing for analytics or withdraw consent for marketing cookies at any time.
• Data Portability: Receive structured machine-readable export files of provided order data.

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond within thirty (30) days.

8. California Privacy Rights (CCPA / CPRA Disclosures)

California residents have specific additional rights under the California Consumer Privacy Act. Bouquetcamembrt does not sell personal information. California consumers may request disclosures regarding categories of personal data collected, categories of sources, and request erasure of personal data without discrimination.

9. Security Infrastructure

We deploy robust organizational and technical countermeasures, including 256-bit SSL encryption for data in transit, strict role-based access limits for atelier staff, periodic vulnerability scanning, and secure encrypted database storage.

10. Policy Amendments & Contact Info

Atelier Lisieux reserves the right to update this Privacy Policy to reflect changing regulatory requirements or operational upgrades. Revisions will be published on this page with an updated effective date. For privacy questions or formal data requests, write to [email protected] or send mail to Atelier 5B, 24 Route de Normandie, 14100 Lisieux, France.