Cookie Management Policy

In brief

The table below summarises the categories of cookies and trackers that may be placed on the Site. Details of each tracker are set out in Article 3.

You may accept, refuse or configure these cookies at any time via the "Cookie management" link in the footer of the Site.

Article 1 : What is a cookie?

A cookie (also referred to as a "tracker" or "connection marker") is a small text file placed on the user's device (computer, tablet, smartphone) when browsing a website. It is stored by the browser and enables the site, or third parties, to recognise the device, store information relating to browsing and provide various functionalities.

For the purposes of this Policy, the term "cookie" refers more broadly to all trackers subject to the same regulations: HTTP cookies, browser local storage ("localStorage"), invisible pixels, tags, or technical identifiers generated by scripts.

Cookies do not, in themselves, contain directly identifying information such as your surname, first name or bank details. They may, however, contain unique identifiers and data relating to your browsing, your preferences or your basket, which constitute personal data where they can be linked to you.

The purpose of this Cookie Management Policy (hereinafter "the Policy") is to inform users of the Toque360 platform (hereinafter "the Site"), operated by EuroChef, a simplified joint-stock company registered under SIREN number 452 401 540, with its registered office at 50 avenue Louis Luc, 94600 Choisy-le-Roi (hereinafter "EuroChef" or "the Company"), about the cookies and trackers placed on their device, their purposes and how to exercise their rights.

Article 2 : Legal and regulatory framework

This Policy is established in accordance with the following texts:

- Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, known as the "General Data Protection Regulation" (GDPR);

- French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended, known as the "French Data Protection Act", and in particular Article 82 thereof;

- Directive 2002/58/EC of 12 July 2002, known as the "ePrivacy" Directive, as amended by Directive 2009/136/EC, transposed into the aforementioned Article 82;

- the guidelines (deliberation No. 2020-091) and the recommendation (deliberation No. 2020-092) of the French Data Protection Authority (CNIL) of 17 September 2020 relating to cookies and other trackers;

- the guidelines of the European Data Protection Board (EDPB), in particular Guidelines 05/2020 on consent.

Pursuant to these texts, the placement and reading of cookies that are not strictly necessary for the operation of the Site are subject to obtaining the user's prior consent, which must be freely given, specific, informed and unambiguous, and be capable of being withdrawn as easily as it was given.

Article 3 : The different categories of cookies used

3.1 : Strictly necessary cookies (exempt from consent)

These cookies are essential for the operation of the Site and the provision of the services expressly requested by the user (browsing, basket, customer account, security). Disabling them would prevent normal use of the Site. In accordance with Article 82 of the French Data Protection Act, they do not require the user's consent but are covered by this information notice.

3.2 : Audience measurement and performance cookies

These cookies enable Toque360 to measure traffic to the Site, analyse browsing journeys and improve its performance as well as the content offered. The data collected is pseudonymised and used solely for statistical purposes.

Legal basis: user's consent (Article 82 of the French Data Protection Act and Article 6.1.a of the GDPR).

The statistical data derived from these cookies is retained for a maximum period of twenty-five (25) months, in accordance with CNIL recommendations.

3.3 : Functional and personalisation cookies

These cookies enhance ease of use of the Site by storing certain preferences or information entered during previous visits.

Legal basis: user's consent.

3.4 : Targeting and advertising cookies

These cookies are placed by third-party partners in order to display, on the Site or on other sites and platforms, advertising tailored to the interests inferred from browsing, and to measure the effectiveness of advertising campaigns. For certain operations, their issuers act as independent data controllers; their respective privacy policies apply.

Legal basis: user's consent.

Note: as Toque360 is a professional (B2B) platform, LinkedIn cookies are mainly used to reach professionals in the catering and hospitality sectors as well as corporate buyers.

3.5 : Social media and embedded content cookies

These cookies are placed by sharing modules and third-party content embedded in the Site (sharing buttons, product demonstration videos). They allow the platforms concerned to track the user's browsing, whether or not the user has an account with them. Videos are loaded, and these trackers placed, only after the user's consent or an explicit action on their part (clicking on the video).

Legal basis: user's consent.

Article 4 : Retention period for cookies and consent

In accordance with CNIL recommendations:

- the lifespan of cookies subject to consent is limited to a maximum of thirteen (13) months from their first placement; this period is not automatically extended upon subsequent visits;

- the choices expressed by the user, whether acceptance or refusal, are stored for six (6) months, after which they are requested again;

- the information collected by means of cookies is retained for a maximum period of twenty-five (25) months;

- session cookies are automatically deleted when the browser is closed;

- strictly necessary cookies have a lifespan proportionate to their technical function.

The lifespan specific to each cookie is set out in the tables in Article 3.

Article 5 : Consent management

5.1 : Consent banner

On the first visit to the Site, an information banner is presented to the user. It enables the user:

- to accept all non-necessary cookies in a single click ("Accept all");

- to refuse all non-necessary cookies in a single click ("Reject all");

- to configure their choices purpose by purpose, via the "Manage my preferences" button.

In accordance with CNIL requirements, the refusal button is presented at the same level and in a form as visible as the acceptance button. Continuing to browse, closing the banner or scrolling the page does not constitute consent. Until the user has expressed their choice, no cookie subject to consent is placed.

The user's choices are transmitted to the partners concerned (in particular Google, by means of "Consent Mode") so that they adapt their operation accordingly.

5.2 : Amendment and withdrawal of consent

The user may amend their choices or withdraw their consent at any time, as easily as it was given:

- via the "Cookie management" link in the footer of each page of the Site;

- via their browser settings (see Article 5.3 below).

Withdrawal of consent does not affect the lawfulness of processing carried out previously on the basis of that consent.

5.3 : Browser settings and partner tools

The user may also configure their browser to accept or refuse cookies, systematically or on a case-by-case basis, and delete those already stored:

- Google Chrome: Settings > Privacy and security > Third-party cookies;

- Mozilla Firefox: Settings > Privacy and security > Cookies and site data;

- Apple Safari: Settings > Privacy > Block all cookies;

- Microsoft Edge: Settings > Cookies and site permissions.

Opt-out tools are also offered by certain partners and professional bodies: the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout), the Google ad settings centre (myadcenter.google.com) and the cross-industry platform Your Online Choices (www.youronlinechoices.com/fr).

Blocking all cookies, including strictly necessary cookies, may prevent access to certain functionalities of the Site, such as the basket, quotation requests or the customer account.

Article 6 : Data transfers outside the European Union

Certain third-party providers whose cookies are placed on the Site (in particular Google, Meta and LinkedIn) may transfer personal data outside the European Union, in particular to the United States.

These transfers are governed by appropriate safeguards within the meaning of Chapter V of the GDPR, in particular:

- the European Commission's adequacy decision of 10 July 2023 relating to the EU-US Data Privacy Framework, for providers certified under that framework;

- failing that, the Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where appropriate by additional measures.

EuroChef ensures that transfers carried out through its providers benefit from a level of protection compliant with GDPR requirements.

Article 7 : Users' rights

In accordance with the GDPR and the French Data Protection Act, every user has the following rights in respect of data processed by means of cookies:

- right of access: to obtain confirmation that data concerning them is being processed and to obtain a copy thereof;

- right to rectification: to obtain the correction of inaccurate or incomplete data;

- right to erasure: to obtain the deletion of their data in the cases provided for by Article 17 of the GDPR;

- right to restriction of processing: to obtain the suspension of processing in the cases provided for by Article 18 of the GDPR;

- right to object: to object to the processing of their data for commercial prospecting purposes, or where processing is based on legitimate interest;

- right to portability: to receive the data provided in a structured, commonly used and machine-readable format;

- right to withdraw consent at any time, under the conditions set out in Article 5.2;

- right to issue directives concerning the fate of their data after their death (Article 85 of the French Data Protection Act).

These rights may be exercised:

- by email at: admin@toque360.com;

- by post at: EuroChef - Toque360 - Data protection officer - 50 avenue Louis Luc, 94600 Choisy-le-Roi.

In the event of reasonable doubt as to the identity of the applicant, proof of identity may be requested. The Company undertakes to respond within one (1) month of receipt of the request; this period may be extended by two (2) months given the complexity or number of requests, the user being informed thereof within the initial period.

If, after contacting the Company, the user considers that their rights are not being respected, they may lodge a complaint with the CNIL:

- online: www.cnil.fr/fr/plaintes;

- by post: CNIL - 3 place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07.

Article 8 : Data controller and data protection contact

Data controller: EuroChef, a simplified joint-stock company, SIREN 452 401 540, Créteil Trade and Companies Register, with its registered office at 50 avenue Louis Luc, 94600 Choisy-le-Roi, publisher and operator of the Toque360 Site.

Data protection contact: in the absence of the appointment of a Data Protection Officer (DPO) within the meaning of Article 37 of the GDPR, requests relating to personal data are handled by the Company's data protection representative, who can be reached at admin@toque360.com.

Article 9 : Cookies and professional users (B2B)

The Toque360 Site is a professional platform intended for operators in the catering, hospitality, bakery and pastry, and institutional catering sectors. A significant proportion of its users therefore act in the course of their professional activity.

This status does not alter the regime applicable to cookies: Article 82 of the French Data Protection Act covers any "subscriber or user" of an electronic communications service, without distinguishing according to whether they act in a private or professional capacity. The consent requirements described in this Policy therefore apply to all users of the Site, including when they connect from a professional device.

Furthermore, data relating to a professional who is a natural person (name, professional email address, login credentials, browsing history) constitutes personal data within the meaning of the GDPR. Data collected via cookies in this context, in particular purchasing habits, products viewed or quotation requests, is processed within the framework of the commercial relationship and in compliance with this Policy.

Article 10 : Security and confidentiality

EuroChef implements appropriate technical and organisational measures to guarantee the security and confidentiality of data collected by means of cookies, in particular:

- encryption of communications using the HTTPS protocol (TLS certificate);

- use of the "Secure" and "HttpOnly" security attributes for cookies that allow it;

- use of the "SameSite" attribute in order to prevent CSRF attacks;

- restriction of access to data to authorised persons only;

- regular auditing of the cookies and trackers placed on the Site;

- the conclusion, with processors, of contracts compliant with Article 28 of the GDPR imposing appropriate security safeguards.

Article 11 : Updating the Policy

This Policy may be amended at any time, in particular in order to reflect changes in regulations, in the technologies used on the Site or in Toque360's cookie practices.

The date of the last update always appears at the top of this document. In the event of a substantial change, in particular the addition of a new purpose or a new partner, the user's consent will be obtained again by means of the consent banner.

Users are advised to consult this Policy regularly in order to keep informed of the cookies placed on the Site and of their rights.

Article 12 : Contact

For any question relating to this Policy or to the protection of your personal data, you may contact Toque360:

- by email: contact@toque360.com;

- by post: EuroChef - Toque360 - Legal department - 50 avenue Louis Luc, 94600 Choisy-le-Roi;

- via the contact form available at: www.toque360.com/contact.