Privacy Policy

The terms listed below have the following definitions:

    – “Review”: refers to the rating and comment posted by a Customer for a Product after placing an Order.

    – “Customer”: means any individual or legal entity acting in a professional capacity who accesses the Platform as a registered user and may place an Order for Products with a Seller.

    – “Order ”: means any purchase of Products made by a Customer on the Platform.

    – “Login Credentials”: refers to a User’s email address and the password chosen by the User upon registration (or changed during the User’s use of the Platform).

    – “Platform ”: refers to the online platform accessible at the following address: https://www.grandsmoulinsdeparis.com/, as well as its subdomains. The Platform comprises all web pages, Services, and features offered to Users.

    – “Payment Service Provider” or “PSP”: refers to the company, which holds a banking license, that provides payment services to Sellers through GRANDS MOULINS DE PARIS, acting as the Operator, to enable Sellers to collect payments.

The Payment Service Provider for GRANDS MOULINS DE PARIS, acting as the Operator, is WEBHELP PAYMENT SERVICES, a simplified joint-stock company with a capital of 3,968,100 euros, registered with the Chambéry Trade and Companies Register under number 330 423 815, with its registered office at 450 rue Félix Esclangon – P.O. Box 22 / 73291 La Motte Servolex CEDEX, identified and registered with the Register of Financial Agents (REGAFI) as a payment institution under number 49786.

    – “Product”: refers to all products related to the baking industry that fall within the categories authorized for sale on the Platform. Products may be food items (flour, groceries, etc.) or non-food items (baking equipment).

    – “Applicable Regulations”: means any regulations or laws applicable to the processing of personal data carried out in connection with the use of the Platform, including Regulation (EU) 2016/679 of April 27, 2016 (the “GDPR”) and the French Data Protection Act of January 6, 1978 (hereinafter the “LIL”), as well as any new laws or regulations that would amend or replace them, the decrees and orders issued for their implementation, and all resolutions, opinions, and guidelines that have been adopted or may be adopted by the competent data protection authorities.

    – “Services ”: refers to all services offered by GRANDS MOULINS DE PARIS to Sellers or Customers through the Platform, including, in particular, intermediary services.

    – “User”: refers to any person who accesses and browses the Platform, whether as a Seller, Customer, or general internet user.

    – “Seller”: means any sales professional who has subscribed to the Services offered by GRANDS MOULINS DE PARIS on the Platform.

For more information: 

What is personal data?
“Personal data” (or “Personal Information”) refers to any information relating to a natural person that allows that person to be identified, either directly or indirectly.
A person’s first and last names or a photo allow for direct identification. An email address allows for indirect identification.

What is processing?
The term “processing” refers to any operation or set of operations performed on personal data, regardless of the method used (collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, alignment or combination, restriction, erasure, or destruction…).

The operation of the Platform and the provision of the Services involve several categories of data processing.

This Privacy Policy applies to the processing activities carried out or implemented by GRANDS MOULINS DE PARIS, in its capacity as data controller or joint data controller.

Users who would like more information about the processing activities carried out by Sellers (except in cases of joint liability) or PSPs should contact them directly.

    – Grands Moulins de Paris as an independent data controller

GRANDS MOULINS DE PARIS will act as an independent data controller for all processing activities related to:

– The provision of information regarding GMP’s institutional website (https://entreprise.grandsmoulinsdeparis.com/);
– The provision of its Platform (https://www.grandsmoulinsdeparis.com/);
– Managing User requests (contact, etc.) and business relationships;
– Providing Services, including connecting Customers and Sellers;
– Sending newsletters and marketing communications to Users;
– Managing requests to exercise Users’ rights.

As such, GRANDS MOULINS DE PARIS is the data controller for the purposes described in the section titled “Why Is Personal Data Collected?” of this Privacy Policy.

    – Grands Moulins de Paris as a joint data controller

GRANDS MOULINS DE PARIS acts as a joint data controller with the Sellers operating on the Platform for the purpose of fulfilling sales of Products ordered through the Platform.

This purpose includes the management of Customer data for the processing of payments for Products, involving the PSP.

In order to organize the implementation of this processing and, in particular, to define the respective obligations of each joint controller, GRANDS MOULINS DE PARIS has entered into a joint controller agreement with the Seller in accordance with Article 26 of the GDPR.

The main provisions of the joint liability agreement may be made available to the User upon request.

Learn more: 

The data controller, as defined by the French Data Protection Act, is the person who determines the means and purposes of the processing.

When two or more legal entities jointly determine the purposes and means of processing, they are joint controllers (or co-controllers).

A processor is a person who processes personal data on behalf of the controller; the processor acts under the authority of the controller and in accordance with the controller’s instructions.

The Data Protection Officer (DPO) of GRANDS MOULINS DE PARIS (hereinafter referred to as the “DPO”) is responsible for responding to Users’ requests regarding their Personal Data, including any requests to exercise their rights.

Any user can contact him:

– Through the dedicated form available at this link 

– By mail to:

GRANDS MOULINS DE PARIS
Data Protection Officer
99 rue Mirabeau
94200 Ivry-sur-Seine

Learn more: 

The Data Protection Officer is responsible for informing, advising, and monitoring GRANDS MOULINS DE PARIS’s compliance with data protection regulations regarding the processing operations carried out via the Platform.
In accordance with data protection regulations, the DPO serves as the point of contact:

– With respect to the individuals concerned, for all matters relating to data processing carried out by GRANDS MOULINS DE PARIS or the exercise of Users’ rights;

– With the CNIL as part of its cooperation efforts. The DPO may also contact this authority to request an opinion or prior consultation on any matters concerning the protection of personal data;

– In relation to other DPOs appointed by participating data processors or data controllers.

GRANDS MOULINS DE PARIS may collect and process all or part of the following Personal Data:

– Personal information;

– Order data;
– Platform activity data;
– Electronic identification data collected through cookies and other trackers.

Learn more: 

GRANDS MOULINS DE PARIS does not collect or process Personal Data related to credit cards.

Transactions are processed entirely by payment service providers.

Personal Data may be voluntarily provided to GRANDS MOULINS DE PARIS by the User. With regard to the Sellers’ staff, their Personal Data may be provided by other employees working within the same organization or on behalf of which they are acting.

Personal Data may also be collected through cookies and other online trackers.

In this regard, GMP encourages Users to review its cookie policy (“Cookie Policy”).

The provision of certain features or Services requires the collection of Personal Data in order to fulfill them (for example, the Customer’s name and address for delivery). The User acknowledges that if this Personal Data is not provided, GRANDS MOULINS DE PARIS will not be able to respond to the User’s request or provide the Services in question.

The Platform includes features that enable open discussion areas, such as communication channels (messaging) or comments on Reviews.

Users are therefore asked to provide only information that is appropriate, relevant, and necessary in the given context. They must not post excessive or insulting comments, nor disclose Personal Data considered sensitive under Article 9 of the GDPR (racial or ethnic origin, political opinions

Users are therefore asked to provide only information that is appropriate, relevant, and necessary in light of the context. They must not post excessive or insulting comments, nor disclose Personal Data considered sensitive under Article 9 of the GDPR (racial or ethnic origin, political, philosophical, or religious opinions, trade union membership, data concerning health or sex life, criminal offenses, convictions, or security measures).

GRANDS MOULINS DE PARIS may collect various types of Personal Data for the purposes and on the legal bases detailed in the following table:

GRANDS MOULINS DE PARIS may also use this Personal Data to comply with its legal or regulatory obligations (such as retaining and archiving invoices and contractual documents, etc.).

Certain Personal Data may also be retained for evidentiary purposes, to protect against potential litigation, in accordance with the legitimate interests of GRANDS MOULINS DE PARIS.

In any event, and for each specified purpose, GRANDS MOULINS DE PARIS will use all means at its disposal to ensure the security and confidentiality of the Personal Data entrusted to it, in accordance with Applicable Regulations.

The Personal Data collected by GRANDS MOULINS DE PARIS is intended, depending on the circumstances and purposes as described in the previous section, for authorized personnel within its internal departments (customer service; accounting, marketing, sales, media, legal, administrative, finance, etc.), within the limits of their responsibilities and to the extent necessary for the purposes pursued.
GRANDS MOULINS DE PARIS may also disclose Personal Data to Sellers as well as to any service providers (processors and subprocessors, if applicable), when necessary for the performance of the Services.
In particular, Personal Data may be disclosed to the following third parties:
– The Platform’s technical service providers (technical solution provider; audience measurement service providers; technical hosting providers; etc.);

– Potential business partners;

– Salespeople;

– Third parties that may place cookies or other trackers on the User’s devices (subject to obtaining consent when required). For more information, Users are encouraged to review the Cookie Policy.

– Where applicable, the relevant courts, mediators, certified public accountants, auditors, attorneys, bailiffs, debt collection agencies, and police or gendarmerie authorities in the event of theft or judicial seizure.

Learn more: 

In particular, the following service providers have access to Personal Data:

The technical service provider (provider of the Platform solution)

IZBERG (RCS Nanterre: 750 230 393)
Carré Champerret
28 rue Jacques Ibert – 92300 LEVALLOIS PERRET

The Payment Service Provider: see “Some Details Regarding Payment Services” below.

The Platform’s host:
The publication, operation, and direct, permanent storage of this website are provided by the aforementioned company, GRANDS MOULINS DE PARIS S.A.

Personal Data is not shared, sold, or rented to anyone other than those mentioned above.

Personal Data is retained for the period strictly necessary to fulfill the purposes described in this Privacy Policy.

At the end of the periods listed below, Personal Data is either deleted or anonymized.

As an exception, particularly in the event of litigation or pre-litigation proceedings, all or some of the Personal Data may be retained for an extended period if necessary to resolve the dispute or conflict.

For reference, the main retention periods are as follows:

    – Purposes of Data Processing

A Customer wishing to place an Order on the Platform must use the Payment Services provided by the Payment Service Provider.

The amounts due under the Order are collected by GRANDS MOULINS DE PARIS through the PSP.

To provide payment services, the PSP is legally required to conduct anti-money laundering, counter-terrorist financing, and anti-fraud checks.

Consequently, the PSP and the Operator are required to process Customers’ Personal Data in connection with the financial transaction related to the Order in accordance with the following terms:

Data processing for the implementation of control procedures:

The Payment Service Provider has a legal obligation to process the data necessary to carry out the control procedures.

In this regard, the PSP must be considered the data controller for the processing of Personal Data carried out in connection with the fulfillment of its legal obligations as a payment service provider, including the fight against fraud and money laundering.

Processing of payment data to facilitate transactions

With regard to the processing of payment data for the purpose of carrying out transactions, the PSP must be considered the processor, performing the processing on behalf of the users of its Payment Services (the Operator).

For more information, Users are invited to contact the PSP directly or visit its website: https://webhelp.com/fr/.

    – Collection and Processing of Banking Data

As part of the operation of the Platform, GRANDS MOULINS DE PARIS collects Personal Data related to payments.

This Personal Data is processed in accordance with the purposes specified at the time of collection.

Whether the provision of Personal Data is mandatory or optional, and the potential consequences of failing to provide such data, are specified at the time of collection.

Personal Data related to payments that GRANDS MOULINS DE PARIS or the Payment Service Provider (PSP) may collect and process includes, in particular, Sellers’ bank account numbers (RIB/IBAN) or credit card information.

It is expressly agreed that GRANDS MOULINS DE PARIS, the PSP, and any other potential party (subcontractor):

– Will not process data in a manner that is incompatible with the defined purposes;

– Will take all technical and organizational measures to ensure the security and confidentiality of the User’s personal data in accordance with Applicable Regulations and standards regarding the retention of banking data.

    – Retention period for payment data

Except as provided in the following paragraphs, bank account information will no longer be retained once the transaction has been processed by GRANDS MOULINS DE PARIS and the Payment Service Provider, that is, once full payment for the desired reservation has been received by the Seller and the fourteen (14)-day withdrawal period has expired.

Sellers’ bank account information (RIB/IBAN, account number) is retained for the purpose of facilitating the payment of amounts due under the contracts throughout the duration of the contractual relationship for the performance of Payment Services (or until the Seller deletes or modifies the data).

It should be noted that for payments made by credit card, such data may be retained as evidence in the event of a dispute regarding the transaction. This data is stored in temporary files for a period of thirteen (13) months (or fifteen (15) months if the payment is deferred) from the date the charge is processed.

In any case, the visual cryptogram is not subject to this retention policy, and bank account information is deleted upon expiration of the date indicated above.

While browsing the Platform, Users can click on links that take them to GRANDS MOULINS DE PARIS’s social media pages.

Social media helps make the Platform more user-friendly and promotes it through sharing.

When Users click these buttons, GRANDS MOULINS DE PARIS may have access to personal information that Users have marked as public and accessible from their profiles on these social media platforms.

However, GRANDS MOULINS DE PARIS does not create or use any databases from these social media platforms and does not process any data relating to Users’ privacy through these channels.

Our website offers informative videos to our Users through third-party cookies integrated by YouTube. These cookies allow YouTube to track Users’ preferences and are subject to their consent. These cookies may be declined at any time. Declining these cookies may result in issues viewing the video in question. For more information, Users are invited to review our Cookie Policy.

Learn more: 

To limit third-party access to Personal Data posted on social media, Users can configure their profiles and/or the visibility of their posts through the dedicated settings on the relevant social media platforms in order to control who can access them and their audience.

The Platform and the Services are not intended for minors.

Under no circumstances does GRANDS MOULINS DE PARIS intentionally collect Personal Data from minors under the age of fifteen (15).

Learn more: 

The processing of Personal Data belonging to a child under the age of fifteen (15) is lawful only if consent has been given by the person with parental authority.

Any parent or guardian who believes that their child has provided Personal Data to GRANDS MOULINS DE PARIS without their consent should contact GRANDS MOULINS DE PARIS via the dedicated form available at this link or by mail at GRANDS MOULINS DE PARIS – Data Protection Officer, 99 Avenue Mirabeau – 94200 Ivry-sur-Seine.

GRANDS MOULINS DE PARIS uses its Platform to record connection data (date, time, IP address, visitor’s computer protocol, page viewed) and cookies (small files stored on Users’ devices (tablets, computers, etc.) that, where applicable, allow for the identification of Users, the tracking of pages viewed, and the collection of audience metrics and statistics for the Platform.

Depending on the purpose, Users may consent to, refuse, or choose whether certain types of cookies are stored on their devices.

The procedures for setting cookies and the rights available to Users are set forth in the Platform’s Cookie Policy.

Learn more: 

A cookie is used to store browsing data and information about online behavior.

Storing these files on the User’s device requires the User’s prior consent, unless the cookies in question are strictly necessary for the Platform to function properly, or unless they are exempt due to their nature.

To learn more about cookies (how to manage, delete, and identify them), Users are encouraged to visit:

– The Platform’s Cookie Policy;
– The CNIL website: http://www.cnil.fr/Vos-droits/Vos-traces/les-cookies/#c5554.

In certain electronic communications sent to Users, GMP may use tracking pixels, which are small, invisible images embedded in emails.

When activated upon opening the email, these pixels may collect certain technical information related to the receipt or viewing of the message, such as whether the email was opened, the date and time it was opened, as well as certain technical data related to the device or email software used.

These pixels may be used, as appropriate, to ensure the proper delivery of electronic communications, to measure their audience, or to tailor communications sent to Users.

When the use of these pixels requires the User’s prior consent in accordance with Applicable Regulations, such consent is obtained before they are activated.

The User may withdraw their consent at any time in accordance with the procedures provided in the relevant communications or in this Policy.

When these pixels are strictly necessary for the provision of a service expressly requested by the User or for the technical transmission of the communication, they may be used without prior consent, within the limits set forth in the Applicable Regulations.

The “Join Us” section of the Platform allows Users to access, via a redirect link, an external page dedicated to viewing job openings and submitting applications.

When the User accesses this page, the Personal Data they provide—including their identity, contact information, resume, cover letter, and any other information they choose to submit—is processed for the purposes of managing applications, evaluating profiles, and conducting the recruitment process. This data is processed in accordance with Applicable Regulations.

Users may exercise their rights regarding their Personal Data in accordance with the procedures described in the relevant section of this Policy, including via this link

As part of its customer service and telesales activities, GRANDS MOULINS DE PARIS wishes to inform Users that telephone calls may be monitored or recorded for the purpose of training its teams and improving the monitoring of the quality of services provided. Recordings will be accessible only to authorized personnel within GRANDS MOULINS DE PARIS’s internal departments or to duly authorized authorities and may be retained for up to six (6) months.

In accordance with the Applicable Regulations, every User has the following rights:

• Right to withdraw consent at any time (Article 7 of the GDPR);
• Right of access (Article 15 of the GDPR);
• Right to rectification (Article 16 of the GDPR), including through the updating of Personal Data;
• Right to erasure of Personal Data when it is no longer necessary for the purposes for which it was collected or processed; in the event of withdrawal of consent if consent constitutes the legal basis for the processing; in the event of objection to the processing pursuant to Article 21; in the event of unlawful processing; or to comply with a legal obligation (Article 17 of the GDPR);
• Right to restriction of processing if the accuracy of the Personal Data is contested; in the event of unlawful processing; if GRANDS MOULINS DE PARIS no longer needs the Personal Data but it must be retained to enable the User to exercise their rights; or if the User has objected to the processing pursuant to Article 21, for the duration of the verification as to whether the legitimate interests of GRANDS MOULINS DE PARIS override those of the User (Article 18 of the GDPR);
• Right to data portability for the Personal Data provided, when the Personal Data is subject to automated processing (Article 20 of the GDPR)
• Right to object to processing (Article 21 of the GDPR);
• Right to determine the fate of Personal Data after death and to designate (or not) a person to carry out these instructions (Article 85 of the French Data Protection Act). In the event of death and in the absence of instructions from the User, GRANDS MOULINS DE PARIS undertakes to delete the Personal Data, with the exception of that which is necessary to meet its legal obligations or for evidentiary purposes.
These rights may be exercised—or for any questions regarding the processing of Personal Data—by contacting the Data Protection Officer at GRANDS MOULINS DE PARIS:

• Via the dedicated link at this link.
• By mail to:

GRANDS MOULINS DE PARIS
Data Protection Officer
99 rue Mirabeau
94200 Ivry-sur-Seine
Finally, any User may also file a complaint with the supervisory authorities, including the CNIL (https://www.cnil.fr/fr/plaintes).

As a matter of principle, GRANDS MOULINS DE PARIS processes and stores Personal Data exclusively within the European Union, or in a jurisdiction recognized by the European Commission as providing an adequate level of protection equivalent to that provided for by the Applicable Regulations.

In the event of a transfer of Personal Data to a country not recognized as having an adequate level of protection, GRANDS MOULINS DE PARIS undertakes to put in place all appropriate safeguards and to ensure that data subjects have enforceable rights and effective legal remedies prior to any transfer.

In particular, GRANDS MOULINS DE PARIS may rely on the standard data protection clauses adopted by the European Commission.

In the event of a transfer of Personal Data to a country outside the European Union or to a country for which no adequacy decision has been issued, any User may request a copy of or access to the appropriate and suitable safeguards that will be implemented.

GRANDS MOULINS DE PARIS and all of its subcontractors are committed to implementing all necessary technical and organizational measures to ensure the security of the processing and the confidentiality of Personal Data, in particular to prevent it from being distorted, damaged, or accessed by unauthorized third parties.

To this end, GRANDS MOULINS DE PARIS takes the necessary measures to ensure the security of browsing on the Platform, as well as of all data processing, through physical, electronic, and administrative procedures (physical security of the premises; user authentication via login credentials; logging of connections; encryption of certain data where applicable; etc.).

This Privacy Policy is subject to change, particularly in response to changes in laws and regulations or in the event of changes to the Services.

The update will be available for viewing directly on the Platform.