Privacy policy
This translation is provided for convenience; the French version is the reference and prevails in case of any difference.
Data collected
When an order is placed, Biscotto Croc collects: name, telephone number, email address and, for a delivery, the delivery address. Creating an account is optional and additionally collects a password. The password is managed securely by our authentication provider and is never stored in plain text.
Why we collect this data
This data is used to process the order (preparation, delivery or pickup, confirmation by email), to answer a question and — if an account is created — to make a future order easier. It is never sold. If you have explicitly agreed to receive our news by email (a separate tick box, when creating an account or in your preferences), your email address, first name, surname and telephone number may also be used for sending it, including via a third-party provider -- see the next section. If you have not ticked this box, your data is used only for your orders and is never passed on to that provider.
Who has access to this data
The data is hosted via Supabase (database, European Union region). Confirmation emails are sent through Resend, a technical provider based in the United States which applies the legal safeguards required for this type of transfer. If you have agreed to receive our news by email, your email address, first name, surname and telephone number are also passed on to Sinan AI, our marketing automation provider, under a data processing agreement (DPA) which contractually commits it to use them only for sending that news and never to resell them or reuse them for any other purpose. None of this data is used by any provider for purposes other than those described here.
Cookies and audience measurement
The website uses technical local storage (cart, draft order, chosen language), which is necessary for the website to function and does not require consent. An audience measurement tool, Sinan AI (no cookies, no IP address retained, only an anonymous visitor identifier), is also used to understand how the website is used. It is only activated after explicit acceptance via the banner displayed at the bottom of the page, and can be refused at any time without affecting your use of the website. Should another audience measurement tool be added, this page would be updated accordingly.
Retention period
Data relating to an order is kept for as long as is necessary to process it and to comply with the applicable legal obligations (in particular accounting obligations). A customer account can be deleted simply on request.
Your rights
In accordance with the GDPR, you have the right of access, rectification, erasure and objection in respect of your personal data. To exercise these rights, contact contact@biscotto.eu.