Privacy policy

Data controller

C.H.R GOURMAND, trading as Café Gourmand — 9 Place de la Libération, 21000 Dijon, France.

Email

[email protected]

Phone

03 80 36 87 51

Data processed through booking requests

The booking form enables the team to process a request for a table. The data collected is:

• preferred date;
• preferred time;
• number of guests;
• name;
• phone number or email address;
• optional free-text message.

This data is used to record and process the request, check availability, contact the person concerned and manage the information needed to organise the visit.

Allergies and health information

A person may voluntarily provide information about an allergy or their health when communicating with the establishment. Information revealing a person’s health status may constitute health data, a special category of data subject to enhanced protection.

• providing information about an allergy remains optional;
• only the information strictly necessary to organise the meal is requested;
• access is limited to authorised persons;
• the retention period is limited to what is strictly necessary;
• transmission by email or another tool is assessed in light of the sensitivity of the data.

Group and event enquiries

For a group meal, seminar, business meal or event, the data submitted may include the identity and contact details of the contact person, their company or organisation, preferred date and times, number of attendees, nature of the event, equipment or logistical requirements, dietary requirements provided voluntarily and the content of subsequent correspondence.

This data is used solely to assess the enquiry, prepare a proposal and continue the discussions required to organise the potential event.

General enquiries

Information provided by email, phone or any general contact form is used to respond to and follow up the enquiry. The data collected is limited to what is genuinely necessary.

Recipients of the data

Data is accessible only to the people and service providers who need it for the purposes described here. Depending on the final technical architecture, this may include:

• authorised persons within Café Gourmand;
• the hosting provider;
• the service provider responsible for sending or receiving form messages;
• Cloudflare, Inc., for the anti-bot verification on the booking form: this tool does not place any cookies and is used solely to distinguish a visitor from an automated program;
• technical service providers working on the website, to the extent required for their work;
• audience measurement services or other third parties, depending on their configuration and, where required by law, after consent has been obtained.

Hosting and data transfers

The intended hosting arrangements are checked when the website goes live. If any service providers process or transfer data outside the European Economic Area, those transfers and the applicable safeguards are documented in this policy.

Cookies and other trackers

The website may use cookies or similar technologies to operate and, depending on the tools selected, to measure its audience or load third-party services.

Trackers strictly necessary to provide a requested service may be used without prior consent when they meet the requirements set out by law. All others are blocked until valid consent has been obtained.

• understand the purposes concerned;
• accept or refuse with comparable ease;
• make a choice where several purposes are offered;
• withdraw or change their choice at any time.

Embedded third-party services

Some features may use third-party services, such as maps, booking platforms, videos, analytics tools or anti-spam services. Before activation, it is necessary to determine what data is transmitted, to which provider, for what purpose, on what legal basis, whether trackers are placed, whether prior consent is required and whether data is transferred outside the European Economic Area.

Security

Café Gourmand and its service providers implement technical and organisational measures appropriate to the nature of the data processed and the associated risks. Additional care is taken with messages that may contain information about allergies or health.

Your rights

Depending on the processing concerned and the conditions set out in the GDPR, you may have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability where applicable;
• right to withdraw your consent at any time where processing is based on consent.

To exercise your rights: C.H.R GOURMAND / Café Gourmand, 9 Place de la Libération, 21000 Dijon — [email protected]. Proof of identity will be requested only where necessary and in a proportionate manner.

Complaint to the CNIL

If, after contacting Café Gourmand, you believe that your data protection rights have not been respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés — cnil.fr.

Updates to this policy

This policy is reviewed when changes are made to the forms, booking system, recipients, analytics tools, consent management platform or cookies, hosting, third-party services, retention periods or data controller.