In accordance with General Data Protection Regulation no. 2016/679/EU of 27 April 2016 (hereinafter "GDPR") and the Swiss Federal Data Protection Act of 19 June 1992 (hereinafter "DPA"), including any future amendments, Ladurée, in its capacity as data controller, guarantees respect for the privacy of Site Users.
1. Purpose of collecting Personal Data
As a User, natural person, you are hereby informed that the information you communicate through the Site is collected and processed on the basis of:
- your consent under the terms of Article 6(1)(a) of the GDPR;
- pre-contractual measures or the performance of a contract for the purposes of customer relationship management, under the terms of Article 6(1)(b) of the GDPR;
- the legitimate interest pursued by Ladurée in order to be able to respond to your requests,
and that it is intended for the authorised services of Ladurée and any processors in compliance with the purposes specified in the forms, under the terms of Article 6(1)(f) of the GDPR.
Users' Personal Data will be hosted at all times on Ladurée's servers located in France. In addition, all the aforementioned processors are located in the European Union. Ladurée therefore does not transfer Users' Personal Data outside the European Union. In the event that Users' Personal Data should be transferred to a country that does not guarantee an adequate level of personal data protection according to the European Commission and/or the Swiss Federal Data Protection and Transparency Commissioner, Ladurée will implement appropriate safeguards in accordance with the applicable legal requirements in order to ensure adequate protection of Users' Personal Data.
For each of the processing operations implemented, Ladurée undertakes to collect and use only adequate, relevant data limited to what is necessary with regard to the purposes for which they are processed.
During viewing of the Site or access to Ladurée's online services, Users may be asked to voluntarily communicate certain personal data (last name, first name, company, email, telephone number, identifiers). The collection forms on the Site specify the purpose, recipients, retention period and compulsory or optional nature of the data requested by an asterisk.
The personal data collected and processed on the Site are protected by appropriate technical and organisational measures in order to guarantee a level of security adapted to the risk.
2. Retention period of Personal Data
Ladurée ensures that the Personal Data of each User is only kept in a form that allows the identification of the data subjects for as long as is necessary for the purposes for which they are processed (unless legislation requires a longer retention period).
The retention periods that Ladurée applies to your Personal Data are proportionate to the purposes for which they were collected.
Ladurée will retain and use your Data to the extent necessary to comply with its legal obligations (such as the obligation to retain your information in accordance with applicable tax laws), resolve disputes and enforce contractual obligations.
3. Your rights regarding the collection of your Personal Data
Site Users are informed that they have the right to access, rectify, delete, limit, restrict (where applicable) and oppose the use of data concerning them. In addition, when the processing of Personal Data is based on the User's consent, the User may withdraw his consent at any time, without prejudice to the lawfulness of the processing of Personal Data carried out prior to the withdrawal of consent.
Nevertheless, these rights may be limited, in particular if the response to your request is likely to lead Ladurée to disclose the Personal Data of another User or if you request the erasure of information or withdraw your consent to the processing of information that Ladurée is legally bound to retain or for which it has a compelling interest in storing.
The User is also informed of the fact that his opposition or withdrawal of a previously given consent could prevent Ladurée from carrying out the operations necessary to achieve the intended purpose or prevent the User from benefiting from some of the services offered by Ladurée.
4. Exercising your rights
In accordance with the GDPR, the User may exercise these rights by contacting Ladurée's DPO service by post at the following address:
HOLDER Group – Compliance Department – For the attention of the DPO – Ladurée – 344 Avenue de la Marne
And by email to the DPO address: DPO@laduree.com.
Ladurée does not voluntarily process any Personal Data from minors under 16 years of age. If a User notices that a minor under the age of 16 is using the services of Ladurée without the consent of his/her legal representative, the User in question is requested to contact Ladurée's DPO using the above contact details.
Site Users also have the right to define guidelines regarding the fate of their personal data after their death. Consequently, the User has the right to stipulate – together with Ladurée's DPO – guidelines relating to the retention, erasure and communication of his data after his death.
In this respect, the User may designate a trusted third party who will be informed of the fate of these data and with whom the data will be deposited in the event of the User's death. The trusted third party may also have these instructions executed. The authorised third party is then entitled, in the event of the death of the holder of the accounts and data, to take note of the directives and request their implementation from the relevant data controllers.
In the absence of such instructions, the User's heirs may – after his death and by producing a death certificate – exercise the said rights over his personal data. The heirs may have the deceased's user accounts closed, oppose the further processing of personal data concerning him or have them updated.
The User and/or Heirs may exercise this right by writing and providing a copy of the identity document and death certificate, if applicable, to the following address
HOLDER Group – Compliance Department – For the attention of the DPO – Ladurée – 344 Avenue de la Marne
or by email to the following address DPO@laduree.com
The User also has the right to lodge a complaint with the competent data protection supervisory authority (e.g. the Swiss Federal Data Protection and Transparency Commissioner).
In addition, each email sent by Ladurée tells you how to stop receiving it.
Site Users are required to comply with the provisions of the GDPR and/or, if applicable, the DPA, in particular by refraining from any collection or misuse of the personal data to which they have access.
