Privacy Policy
Article 1 – Preamble
This Privacy Policy forms an integral part of the General Terms and Conditions of Sale applicable to Customers, as well as the General Terms and Conditions of Use of the Website.
The purpose of this Privacy Policy is to inform Users about how their Personal Data is collected via the Website, how such data is processed by Kaviari, where applicable in the context of the Services, and the rights they have in relation to such processing.
Article 2 – Definitions
For the purposes of this Privacy Policy, including its Preamble, the capitalised terms used herein, whether in singular or plural form, shall have the following meanings:
• “Interim Archiving”: refers to the transfer of Personal Data that still holds administrative value for Kaviari (for example, in the event of litigation and/or where a legal obligation applies) into a separate database, logically or physically segregated and, in any case, with restricted access. This archive constitutes an intermediate step before the deletion of the relevant Personal Data or their anonymisation;
• “Terms and Conditions of Use” or “T&Cs”: refers to the Terms and Conditions of Use applicable to Users and available by clicking here. The Privacy Policy forms an integral part of the T&Cs;
• “Terms and Conditions of Sale” or “T&Cs”: refers to the Terms and Conditions of Sale applicable to Customers and available by clicking here. The Privacy Policy forms an integral part of the T&Cs;
• “Customer”: refers to the User, who is of legal age and legally capable, acting as a consumer within the meaning of the French Consumer Code, who purchases one or more Products on the Website;
• “Order”: refers to the purchase of a Product by a Customer on the Website, in accordance with the T&Cs;
• “Account”: refers to the personal account of a User, accessible only with a personal and specific login and password created by the User using their personal information on the Website. This account allows the User to place Product orders and access certain Services;
• “Recipient”: refers to the person authorised to receive communication of data recorded in a file or processing system due to their function;
• “Personal Data”: refers to any information relating to an identified or identifiable natural person;
• “Kaviari”: refers to KAVIARI SAS, a simplified joint-stock company with a share capital of €308,880, whose registered office is located at 13 rue de l’Arsenal, 75004 Paris, registered with the Paris Trade and Companies Register under number 315 734 194, represented by Ms Karin Nebot acting in her capacity as Managing Director;
• “User”: refers to all Internet users visiting the Website, whether Customers or not;
• “Partners”: refers to the various commercial partners of Kaviari;
• “Privacy Policy”: refers to this Privacy and Personal Data Protection Policy implemented by Kaviari, which forms an integral part of the T&Cs and Terms of Use;
• “Personal Data Regulation”: refers to Law No. 78-17 of 6 January 1978 on data processing, files and individual liberties, as amended on 7 October 2016, as well as any applicable data protection regulation, in particular Regulation (EU) 2016/679 of 27 April 2016, published in the Official Journal of the European Union on 4 May 2016, relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data;
• “Services”: refers to the features and services defined in Article 5 of the Terms of Use made available to Users via the Website and, for certain services, subject to the prior creation of an Account;
• “Website”: refers to the website operated by Kaviari, accessible notably at the following URL: www.kaviari.com;
• “Terminal”: refers to the hardware device (computer, tablet, smartphone, telephone, etc.) used by the User to access or view the Website and/or any other digital medium published by a third party;
• “Processing”: refers, within the meaning of the Personal Data Regulation, to any operation or set of operations performed or not using automated processes and applied to Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Article 3 – Purposes, Legal Bases and Data Retention Periods
Kaviari applies the following purposes, legal bases and data retention periods for processing activities:
Purpose: Contract management / loyalty programmes
(order management, product delivery, etc.)
Legal basis: Performance of a contract
Retention period: Duration of the contractual relationship
Accounting management
(accounting obligations, tax requirements, etc.)
Legal basis: Compliance with a legal obligation to retain data
(e.g. identity verification via supporting documents)
Retention period: Interim archiving for the statutory period (e.g. accounting obligation of 10 years). Identity documents are retained for the time strictly necessary to verify the identity of the data subject. A copy of an identity document may be retained for up to 6 years where necessary for evidentiary purposes or to comply with a legal obligation.
Customer relationship management – satisfaction surveys
Legal basis: Legitimate interest of the organisation or consent*
Retention period: For the time necessary to achieve the purpose of the survey or until the right to object / withdrawal of consent is exercised
Claims management
Legal basis: Performance of a contract
Retention period: Duration of the contractual relationship
After-sales service
Legal basis: Performance of a contract
Retention period: Duration of the contractual relationship
Customer selection / studies / surveys
(product quality studies / product testing / sales statistics)
Legal basis: Legitimate interest of the organisation or consent*
Retention period: For the time necessary to achieve the purpose or until the right to object / withdrawal of consent is exercised
Commercial prospecting activities (advertising messages, competitions, referral programmes, promotions, etc.)
• via electronic means (email, SMS, etc.) for products/services not previously purchased
• postal mail or automated/human-assisted telephone calls
• electronic communications for similar products or services already purchased
Legal basis:
• Consent (email, SMS, non-purchased goods/services)
• Consent (postal mail or telephone calls)
• Legitimate interest (similar products or services already purchased)
Retention period: Until consent is withdrawn or up to 3 years from the last contact with the organisation
Disclosure to third parties for advertising purposes
Legal basis: Consent
Retention period: Until consent is withdrawn or up to 3 years from the last contact
Article 4 – Storage of Personal Data
The Website is hosted by Groupe Profileo, whose contact details are available by clicking here.
All necessary precautions have been taken to store Users’ Personal Data in a secure environment and to prevent it from being altered, damaged, or accessed by unauthorised third parties.
For this purpose, Personal Data collected via the Website is hosted by Groupe Profileo, whose contact details are available by clicking here.
Unless expressly consented by the User, Personal Data provided by the User will never be disclosed to third parties for commercial purposes, nor sold or exchanged, other than within the contractual framework of the General Terms and Conditions of Sale.
Article 5 – Collection of Personal Data on the Website
The personal data collected by Kaviari includes the following:
Type of data – Identification data
Examples: surname, first name, title, position, internal identifier, online identifier, postal address, telephone number, professional or personal email address, date of birth, customer code, internal processing code, etc.
Type of data – Professional life data
For business customers: employer, job title, department, authorisations, professional contact details, commercial relationship history, data arising from exchanges with customers or prospects.
Type of data – Economic and financial data
Data relating to the Customer’s financial situation: invoices, payments, unpaid amounts, discounts, transaction history.
Type of data – Contractual relationship data
Contract number, order history, subscribed services, complaints, incidents, correspondence, customer support information.
Type of data – Connection and browsing data
Login logs, IP addresses, technical identifiers, data relating to the use of an online service or mobile application, cookies and trackers (in compliance with applicable regulations).
Type of data – Marketing and prospecting data
History of participation in promotional activities, communication preferences, survey responses, competitions, referral programmes, targeted marketing actions.
Type of data – Purchase data
Purchased products or services, purchase history, amounts spent, order frequency, product-related complaints.
Article 6 – Security of Online Transactions
The Website uses the technology of Payplug to secure banking transactions between Customers and Kaviari.
Thus, when making a payment on the Website, the Customer’s banking details are entered directly on the payment platform operated by Payplug, without Kaviari being able to access them.
Kaviari does not collect the Customer’s full credit card number or security code (CVV).
To exercise their rights, as set out in Article 9, relating to their payment card data, concerned Users are invited to contact Payplug directly.
Article 7 – Recipients or Categories of Recipients
Kaviari may transfer Users’ or Customers’ Personal Data to certain of its subcontractors or data processing Partners, solely for the purposes of operations carried out on behalf of Kaviari, namely the provision of Services or the processing of Orders and the delivery of ordered Products.
Article 8 – Rights of Users
In accordance with the Personal Data Regulations, Users may, at any time, exercise the following rights:
right of access
right to rectification
right to erasure (right to be forgotten)
right to restriction of processing
right to data portability
right to object
post-mortem directives
right to withdraw consent
8.1 Right of Access
Users have the right to obtain from Kaviari confirmation as to whether or not Personal Data concerning them is being processed and, where that is the case, access to such Personal Data, as well as the following information:
a) the purposes of the processing;
b) the categories of Personal Data concerned;
c) the recipients or categories of recipients to whom the Personal Data have been or will be disclosed;
d) where possible, the envisaged storage period for the Personal Data or, where not possible, the criteria used to determine that period;
e) the existence of the right to request from Kaviari rectification or erasure of Personal Data, or restriction of processing of Personal Data, or the right to object to such processing;
f) the right to lodge a complaint with the CNIL;
g) where Personal Data are not collected directly from the User, any available information as to their source;
h) the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the User.
Where Personal Data are transferred to a third country or to an international organisation, the User has the right to be informed of the appropriate safeguards relating to such transfer.
Kaviari shall provide a copy of the Personal Data undergoing processing.
Kaviari may charge a reasonable fee based on administrative costs for any additional copies requested by the User.
Where the request is made electronically, the information shall be provided in a commonly used electronic format, unless the User requests otherwise.
The User’s right to obtain a copy of their Personal Data must not adversely affect the rights and freedoms of others.
8.2 Right to Rectification
Users have the right to obtain from Kaviari, without undue delay, the rectification of inaccurate Personal Data concerning them.
They also have the right to have incomplete Personal Data completed, including by providing a supplementary statement.
8.3 Right to Erasure
Users have the right to obtain from Kaviari the erasure of Personal Data concerning them without undue delay where one of the following grounds applies:
a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by Kaviari;
b) the User has withdrawn consent on which the processing is based and there is no other legal ground for the processing;
c) the User objects to the processing under the conditions set out below and there are no overriding legitimate grounds for the processing;
d) the Personal Data have been unlawfully processed;
e) the Personal Data must be erased to comply with a legal obligation;
f) the Personal Data have been collected in relation to the offer of information society services to a child.
8.4 Right to Restriction of Processing
Users have the right to obtain from Kaviari the restriction of processing of their Personal Data where one of the following applies:
a) Kaviari is verifying the accuracy of the Personal Data following a challenge by the User regarding their accuracy;
b) the processing is unlawful and the User opposes the erasure of the Personal Data and requests instead the restriction of their use;
c) Kaviari no longer needs the Personal Data for the purposes of processing, but they are still required by the User for the establishment, exercise or defence of legal claims;
d) the User has objected to the processing under the conditions set out above, and Kaviari is verifying whether the legitimate grounds pursued override those of the User.
8.5 Right to Data Portability
Users have the right to receive from Kaviari the Personal Data concerning them, in a structured, commonly used and machine-readable format, where:
a) the processing of Personal Data is based on consent or on a contract; and
b) the processing is carried out by automated means.
When exercising their right to data portability, Users also have the right to obtain that Personal Data be transmitted directly by Kaviari to another data controller designated by the User, where technically feasible.
The right to data portability shall not adversely affect the rights and freedoms of others.
8.6 Right to Object
Users may object at any time, on grounds relating to their particular situation, to the processing of Personal Data concerning them that is based on the legitimate interests of Kaviari.
In such case, Kaviari will no longer process the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User, or unless the data are necessary for the establishment, exercise or defence of legal claims.
8.7.Directives post-mortem
L’Internaute a la possibilité de communiquer à Kaviari des directives relatives à la conservation, à l’effacement et à la communisation de ses Données Personnelles après son décès, lesquelles directives peuvent être enregistrées également auprès «d’un tiers de confiance numérique certifié». Ces directives, ou sortes de «testament numérique» peuvent désigner une personne chargée de leur exécution; à défaut, les héritiers de l’Internaute seront désignés.
En l’absence de toute directive, les héritiers de l’Internaute peuvent s’adresser à Kaviari afin de/d’ :
-accéder aux traitements de Données Personnelles permettant «l’organisation et le règlement de la succession du défunt»;
-recevoir communication des «biens numériques» ou des «données s’apparentant à des souvenirs de famille, transmissibles aux héritiers»;
-faire procéder à la clôture du compte de l’Internaute sur le Site et s’opposer à la poursuite du traitement de ses Données Personnelles.
En tout état de cause, l’Internaute a la possibilité d’indiquer à Kaviari, à tout moment, qu’il ne souhaite pas, en cas de décès, que ses Données Personnelles soient communiquées à un tiers.
8.8 Withdrawal of Consent
Users may withdraw their consent at any time, either via a dedicated feature on the Website, or by contacting Kaviari under the conditions set out in Article 10 below.
Article 9 – Procedures for Exercising Users’ Rights
These rights may be exercised at any time by contacting Kaviari:
• By post at the following address:
Ally Avocats
27 boulevard de Courcelles – 75008 Paris
• By email at the following address:
dpo@kaviari.fr
A response will be provided to the User within a maximum period of one (1) month from receipt of the request.
Where necessary, this period may be extended by two (2) additional months, taking into account the complexity and/or number of requests, by Kaviari, which will inform the User of such extension within the initial one-month period.
In order to exercise their rights under the conditions set out above, Users must prove their identity by providing their surname, first name, email address, and a copy of their identity document.
In the event that a User requests the deletion of their Personal Data and/or exercises their right to erasure, Kaviari may nevertheless retain such data in intermediate archiving form, for as long as necessary to comply with legal obligations or for evidentiary purposes within the applicable limitation period.
Users may also lodge a complaint with the competent supervisory authority in France (the CNIL).
Article 10 – Password Security
Kaviari takes all appropriate measures to ensure the secure storage of Users’ passwords.
However, password security also depends on how it is designed by the User.
Users are reminded that, to be effective, their password must consist of at least 8 characters and include at least 3 of the following 4 character types: uppercase letters, lowercase letters, numbers, and special characters.
Kaviari may block multiple unsuccessful login attempts using any appropriate method (temporary account lock after several failed attempts, CAPTCHA, account lock after 10 failed attempts, etc.).
Mnemonic techniques can be used to create strong passwords, such as:
• keeping only the first letters of each word in a sentence; for example, the sentence “Un Jour un Caviar avec Kaviari, quelle chance !” becomes the password 1J1C@KQC!
• retaining punctuation marks (e.g. !)
• representing numbers using digits from 0 to 9 (e.g. “Un” → 1)
• using uppercase letters for consonants and lowercase letters for vowels
To assist with password creation, Users may also use randomly generated passwords from tools such as generateurdemotdepasse.com.
Article 11 – Cookies Stored on the User’s Device Following Navigation on the Website
Kaviari and its partners use cookies in order to display personalised advertising based on Users’ browsing behaviour and profile, to allow content sharing on social networks, and to obtain website usage statistics.
To customise, accept or refuse cookies, Users may click the icon located at the bottom left of the screen to access the CookieFirst module.
Latest update: October 2025 – correction of typographical errors and updates related to regulatory developments and data processing by Kaviari.