The Federation of Migros Cooperatives is based in Switzerland and attaches great importance to protecting your privacy and personal data, as well as the use of necessary data protection measures. Your personal data will be collected, processed and used exclusively in accordance with the following principles and the provisions of the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection, and the German Federal Data Protection Act applicable to this website. The basis for the applicability of the GDPR and the German Federal Data Protection Act is the provision of services and goods on chocolatfrey.com to customers in Germany, i.e. the European Union.
I. Name and address of the Controller
II. Your personal data
III. General provisions on data processing
IV. Provision of the website and creation of log files
V. Use of cookies
VI. Email contact and use of the contact form
VII. Web analytics services
VII.1 Google Analytics
VIII. Plug-ins & tools
VIII.1 Use of Google reCAPTCHA
IX. Rights of the data subject
X. Links to other websites
XI. Security
XII. Availability and changes
The Controller as defined in the EU General Data Protection Regulation (“GPDR”), other national data protection laws of EU member states and other data protection provisions applicable to the operation of the chocolatfrey.com website (“Website”) is as follows:
Delica AG
Bresteneggstraße 4
5033 Buchs
Schweiz
Tel.: + 41 800 84 0848
E-Mail: info@delica.com
Website: chocolatfrey.com
(hereinafter the “company” or “we”).
Should you object to the collection, processing or use of your data by us in accordance with this Privacy Policy, either in general or with regard to individual measures, you can raise your objection by sending an email or letter to the aforementioned contact details or our data protection officer. You can also use the aforementioned contact details to obtain information about your personal data free of charge at any time.Address of data protection officer and EU/EEA representativeThe data protection officer of the Controller can be contacted at the following address:
Delica Datenschutz
datenschutz@delica.com
(hereinafter “DPO”).
The EU/EEA representative of the Controller can be contacted at the following address:
Delica Deutschland GmbH
Königsallee 63 - 65
40215 Düsseldorf
Deutschland.
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”). You do not need to provide personal data in order to visit our website. Personal data (such as your name, telephone number, address and email address, and date of birth) is only collected if you submit such data voluntarily or have agreed to its collection. For information on essential data required for technical reasons, please refer to “V. Provision of the website and creation of log files” and “VI. Use of cookies”.
1. Scope of personal data processing
We process the personal data (hereinafter also “data”) of data subjects (i.e. users of the website) only insofar as this is required to provide a functional website and ensure the provision of our content and services. The personal data of our users is as a rule only processed with the prior consent of the user. An exception to this applies in cases where processing of the data is permitted by legal regulations, or is necessary for the fulfilment of a contract or technical reasons.
2. Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, the legal basis is Art. 6 para. 1, point (a) of the GDPR.
In case of the processing of personal data required for the performance of a contract to which the data subject is a party, the legal basis is Art. 6, para. 1, point (b) of the GDPR. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is required to fulfil a legal obligation to which our company is subject, the legal basis is Art. 6 para. 1, point (c) of the GDPR.
In the event that the vital interests of the data subject or another natural person require the processing of personal data, the legal basis is Art. 6, para. 1, point (d) of the GDPR.
If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not outweigh the aforementioned interest, the legal basis for processing is Art. 6, para. 1, point (f) of the GDPR.
3. Erasure of data and retention periodThe personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. The data may be stored beyond this period if this is permitted by the European or national legislator in EU regulations, laws or other provisions to which the Controller is subject. The data will also be deleted or blocked from further processing upon the expiry of a statutory retention period, unless there is a need for further storage of the data for the performance of a contract.
1. Description and scope of data processing
When using the website for informational purposes only, we only collect the personal data that your browser sends to our server or provider and that is technically necessary for the purpose of displaying our website and ensuring its stability and security.
We have commissioned M-Industrie Deutschland GmbH, Rudolf-Diesel-Straße 24, 64625 Bensheim, Germany (hereinafter “MID”) to be responsible for the hosting, technical provision and maintenance of our website. MID undertakes to guarantee the necessary protection of your data and to process your data in accordance with the applicable data protection regulations exclusively on our behalf and in accordance with our instructions.
The following data is stored in log files for processing:1. Information about the browser type and version used (insofar as you have consented to the sending of such data in your browser settings); 2. The operating system;3. Date and time of the server request;4. The number of visits;5. The length of time spent on the website;6. The website you visited before visiting our website (insofar as you have consented to the sending of such data in your browser settings; and7. The user’s IP address.
The data is hosted on certified Google Cloud servers belonging to the Google Cloud Platform, an offer of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter “Google”). The data is hosted in the Google Cloud in Germany, specifically in the region of Frankfurt am Main. Please note that Google works with a multi-tenant environment, meaning that data is replicated between multiple geographically dispersed data centres. The transmission of the log files mentioned herein to countries outside the EU only takes place within the context of hosting this website. The legal basis for this is the EU standard contractual clauses that have been made available by Google (see https://cloud.google.com/secur...).
MID uses this information for the stated purpose on our behalf, and to optimize services. MID will not use the data independently or make an unauthorized data transfer to third parties. This data will not be stored together with other personal data of the user.
2. Legal basis for data processingThe legal basis for the temporary storage of data and log files is Art. 6, para. 1, point (f) of the GDPR.3. Purpose of data processing
The temporary storage of IP addresses by the system is necessary to enable the website to be delivered to the user’s end device. This requires the user’s IP address to remain stored for the duration of the session.
The aforementioned information ((1) – (7)) is stored in log files in order to ensure the functionality of the website. This data also enables us to optimize the website and ensure the security of our information technology systems. The data is not analysed for marketing purposes.4. Duration of storage
The IP addresses of users will be deleted as soon as they are no longer necessary to fulfil the purpose for which they were collected. This is the case at the end of the respective user session, after which the user cannot be identified.
The log files will be stored for the aforementioned purposes for a maximum of 30 days.5. Right to objection and erase
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, the user does not have the right to object to the collection of such data.
1. Description and scope of data processing
Our website uses cookies. Cookies are text files which are stored in the web browser or by the web browser on the user’s computer system. Cookies cannot run programs or transfer viruses to your computer. When a user accesses a website, a cookie can be stored on the user’s end device. This cookie contains a characteristic string of characters, which enable the browser to be identified when the website is accessed again. Some of the cookies we use are deleted at the end of the browser session, i.e. when you close your browser (so-called “session cookies”). Other cookies remain on your end device and allow us to recognise your browser upon your next visit, provided that you have given your consent to this.
When you visit our website, we will inform you about the use of cookies via an onscreen banner (strictly necessary cookies and statistics cookies), and provide the necessary consent options for the use of cookies requiring consent in accordance with data protection regulations. With the exception of strictly necessary cookies, prior consent is always required for the use of cookies on your end device. The same applies to other technical measures, such as the use of Google Analytics on our website. The onscreen banner will also refer the user to this Privacy Policy.
The following section provides an overview of the cookies we use, their retention period and your opt-out choices. In addition, please note that you can adjust your cookie settings and revoke your consent at any time with effect for the future.
a. Strictly necessary cookies:
We use cookies in order to make our website more user friendly. Some functions of our website require that the browser can be identified even after the user moves to a different page.
If you provide your consent to the use of cookies, the following strictly necessary cookies will be stored on your end device and transmitted to us each time you access one of our web pages:
1. consentCF (validity: 1 year);
2. essentiellCF (validity: 1 year); and
3. statistikenCF (validity: 1 year).
These cookies do not contain any personal data and cannot be used to identify you personally.
b. Statistics cookies:
We also use statistics cookies on our website, which allow us to analyse the surfing habits of our users.The following data may be transmitted using statistics cookies:1. Entered search terms2. Frequency of page views3. Use of website functions4. Duration of visitThe user data collected for these purposes will be anonymized using technical means so that the data cannot be used to identify the corresponding user. The data will not be stored together with other personal data of the user.
Statistics cookies are used for the purpose of improving the quality of our website and its contents. By using statistics cookies, we can ascertain how the website is used and continue to optimize our service offering. For more information on these cookies, their functionality, purpose and your rights to object to their use, please refer to the information in section “VII. Website analytics services”.2. Legal basis for data processing
The legal basis for the processing of personal data using strictly necessary cookies (see (a)) is Art. 6, para. 1, point (f) of the GDPR.
The legal basis for the processing of personal data using statistics cookies (see (b)) is your consent in accordance with Art. 6, para. 1, section (a) of the GDPR.3. Purpose of data processing
The purpose of using strictly necessary cookies is to enable you to use our website. Some functions of our website cannot be provided without the use of cookies. For these functions, the browser must be able to be identified even after the user moves to a different page. The user data collected by strictly necessary cookies is not used to create user profiles.
For more information on the purpose of statistics cookies (see (b)) and your rights to object to their use, please refer to section “VII. Website analytics services”.
4. Duration of storage and possibilities to opt-out of or delete cookies
Cookies are saved on the user’s computer and transmitted from there to our site. As the user, you have full control over the use of cookies. You can change your Internet browser settings to disable or limit the transmission of cookies. Previously saved cookies can be deleted at any time. This may also be done automatically. If you disable cookies for our website, it may no longer be possible to access all of the website’s functions.
You can change your cookie settings that you configured via our cookie banner at any time by clicking here: Cookie settings. Unchecking the check box in the upper-right corner disables the respective cookies.
1. Description and scope of data processing
On our website, you can contact us or provide feedback on our products via a specified email address or contact form. In all cases, the personal information transmitted by the user will be saved. The scope of the processed personal data and the type of personal data that is processed in each case may vary depending on the contact form or method of contact. In particular, this includes the following data:
Your title;
Your first name* and surname*’
Your contact details (email address*, phone number);
The subsequent correspondence*.
When you choose to provide product feedback, we will also process the information you provide on our product. This includes the product name*, an image* of the product, the product weight*, the product expiry date* and batch number*, and the place of purchase*.
Your data and the subsequent correspondence will be processed exclusively by us. In some cases, it may be necessary to forward your data to one of our business or product partners in order to process your query. However, there will be no further transfer of your data to third partners. The data will be used exclusively for the conversation initiated by the user in order to contact you by telephone, mail or email regarding your query. Mandatory (*) and voluntary fields are indicated in the contact forms.2. Legal basis for data processing
The legal basis for the processing of data transmitted in the course of sending an email or via the contact form is Art. 6, para. 1, point (a) of the GDPR. If the user’s correspondence relates to the conclusion of a contract, the legal basis for the processing is Art. 6, para. 1, point (b) of the GDPR.3. Purpose of data processing
The personal data you send to us on a voluntary basis by email or the online contact form is only used to establish contact or process your product feedback.4. Duration of storage
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data sent by email or via our contact form, this is the case when the respective correspondence with the user has been concluded. The information you provide in our contact form will be deleted by our web server after seven days. The correspondence shall be deemed concluded when it can be inferred that the facts in question have been definitively clarified.5. Right to objection and erasure
As the user, you may revoke your consent to the processing of your personal data at any time. If you contact us by email or via the contact form, you may object to the storage of your personal data at any time, in which case the correspondence cannot be continued. You may raise your objection using the contact details in sections I. and II. Also refer to the information in section “IX. Rights of the data subject”. In this case, all personal data stored during the course of making contact with us will be deleted.
VII. Website analytics services
Our website uses Google Tag manager to incorporate functions of Google Analytics, a website analytics service which is provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter “Google”). Google Analytics uses so-called “cookies” or “third-party cookies”. These are text files which are stored on your computer or end device (tablet, smartphone, etc.) and allow us to analyse how you use our website (see section “VI. Use of cookies”).
The following cookies are used for this purpose:
By using the functions of these website analytics services, Google is able to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus analyse the activities of a pseudonymous user across devices.
The information generated by the cookie about your use of this website (including your IP address) will also be transmitted to and stored on Google servers. It is possible that data may be processed in countries which are not governed by EU law. Google uses this information in order to evaluate your use of the website, compile reports on website activities for the website owner, and to provide other services related to website and Internet usage. Google may also transmit this information to third parties when required to do so by law, or where such third parties process this information on Google’s behalf. Due to the use of IP anonymization on our website, Google will truncate your IP address before transmission within member states of the European Union or in states which are party to the Agreement on the European Economic Area in order to exclude the possibility of identifying you personally. IP anonymization is not enabled by Google outside the European Union or European Economic Area.
You may object to the collection, storage and use or information by Google at any time with effect for the future by installing the opt-out add-on provided by Google.
We have concluded the Data Processing Addendum with Google in accordance with Article 28 of the GDPR, in which Google undertakes to protect the data of our users and to process this data exclusively on our behalf in accordance with the applicable data protection regulations.
More information on how Google Analytics handles user data can be found in Google’s privacy policy: https://support.google.com/ana.... Purpose and legal basis for data processing
The legal basis for the processing of personal data using analytical and statistics cookies and functions of Google Analytics for the purpose of analysing and optimising our website is your consent to the cookie settings/our cookie banner in accordance with Art. 6, para. 1, point (a) of the GDPR. The information obtained through the use of Google Analytics is used in particular to better understand the use of our website and to improve its content, functionality and accessibility. As the website owner, we have an interest in analysing your user behaviour in order to improve both our website and our advertising.
3. Duration of storage
By default, sessions end after 30 minutes of inactivity, and campaigns end after six months. The maximum time limit for campaigns is two years.4. Right to objection and erasure
You can object to the collection, storage and use of information by Google at any time with effect for the future by using the following methods:
You can object by installing the opt-out add-on provided by Google. For more information, please visit https://tools.google.com/dlpag....
Alternatively, you can prevent the storage of cookies used by Google by configuring the appropriate settings in your browser software.
You can change the cookie settings that you configured in our cookie banner at any time via the cookie settings. Under “Statistics”, you can change the checkbox to object to the use of the relevant cookies or use of Google Analytics. However, please note that if you opt out of these cookies, you may not be able to access the full range of functions on the website.
1. Description and scope of data processing
We use Google reCAPTCHA on our website and contact form to verify interactions and prevent access by automated programs, e.g. by bots. This is a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter “Google”).
This service enables Google to determine which website a request is sent from and which IP address you use to access the reCAPTCHA input box. In addition to your IP address, Google may collect other additional information that is necessary for offering and maintaining this service.
Google is responsible for the processing of data. Further information on Google’s general handling of your user data is available at https://policies.google.com/pr.... Purpose and legal basis for data processing
The legal basis for the use of Google reCAPTCHA is Art. 6, para. 1, point (f) of the GDPR. Our legitimate interest lies in the security of our online presence and in the prevention of unwanted, automated access (e.g. spam), and therefore also serves to ensure secure access by our users.3. Right to objection and erasure
You may object to the collection, storage and use of information by Google at any time with effect for the future via the following opt-out link https://adssettings.google.com..., or by unsubscribing from the Google service.
If your personal data is processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the responsible authority or controller:1. Right of accessYou shall have the right to obtain from the controller confirmation as to whether or not personal data concerning you is being processed by us. In this event, you may request access to the following information from the controller:
(1) the purposes for which the personal data is processed; (2) the categories of personal data that is processed;(3) the recipients or categories of recipients to whom the personal data concerning you was or will be disclosed; (4) the envisaged period for which the personal data concerning you will be stored, or, if not possible, the criteria used to determine such period;(5) the existence of the right to request from the controller rectification, erasure, or restriction of processing of personal data concerning you or the right to object to such processing;(6) the right to lodge a complaint with a supervisory authority.
You shall also have the right to request information on whether the personal data concerning you is transferred to a third country or an international organisation. In this regard, you may request to be informed of the appropriate safeguards pursuant to Art. 46 of the GDPR relating to the transfer.
To exercise your right to obtain the aforementioned information free of charge, please contact us via the contact details on the Legal Notice page, or contact our data protection officer (see section I and II).2. Right to rectificationYou shall have the right to obtain from the controller without undue delay the rectification of inaccurate or incomplete personal data concerning you.
3. Right to restriction of processingWhere one of the following applies, you shall have the right to request the restriction of processing of personal data concerning you:
(1) You contest the accuracy of the personal data concerning you for a period that enables the controller to verify the accuracy of the personal data;(2) The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use;(3) The controller no longer needs the personal data for the purposes of the processing, but the data is required by you for the establishment, exercise or defence of legal claims; or(4) You have objected to processing pursuant to Art. 21, para. 1 of the GDPR pending verification whether the legitimate grounds of the controller override those of you.
Where the processing of personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. If the processing was restricted in accordance with the aforementioned requirements, you will be informed by the controller before the restriction is lifted.
4. Right to erasure
a. Obligation to erase
You may request the controller to erase personal data concerning you without undue delay. In this case, the controller shall have the obligation to erase such data without undue delay where one of the following grounds applies:
(1) The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.(2) You withdraw your consent on which the processing is based according to Art. 6, para. 1, point (a) of the GDPR, and there is no other legal basis for the processing;
(3) You object to the processing pursuant to Art. 21, para. 1 of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21, para. 2 of the GDPR.
(4) The personal data concerning you was processed unlawfully.(5) The personal data concerning you has to be erased in order to comply with a legal obligation in Union or Member State law to which the controller is subject.
(6) The personal data concerning you was collected in relation to the offer of information society services referred to in Art. 8, para. 1 of the GDPR.
b. Sharing of information with third parties
Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17, para. 1 of the GDPR to erase such data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing such personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, this personal data.c. ExceptionsThe right of erasure shall not apply to the extent that processing is necessary (1) for exercising the right of freedom of expression and information;(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;(3) for the establishment, exercise or defence of legal claims.5. Right to information
If you have exercised the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate any rectification or erasure of personal data concerning you or restriction of processing to each recipient to whom the personal data was disclosed, unless this proves impossible or involves disproportionate effort. You shall also have the right to request the controller to inform you about these recipients.
6. Right to data portability
You shall have the right to receive the personal data concerning you and which you provided to the controller, in a structured, commonly used and machine-readable format. In addition, you shall also have the right to transmit such data to another controller without hindrance from the controller to which the personal data was provided, where:
the processing is based on consent pursuant to Art. 6, para. 1, point (a) of the GDPR; and
the processing is carried out by automated means.
In exercising this right, you shall also have the right to have the personal data concerning you transmitted directly from one controller to another, provided that this is technically feasible. This shall not adversely affect the rights and freedoms of others.
The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.7. Right to object
You shall have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which is based on points (e) or (f) of Art. 6, para. 1 of the GDPR.
The controller shall stop processing the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or processing is required for the establishment, exercise or defence of legal claims.
Right to withdraw your consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. Withdrawal of your consent shall not affect the lawfulness of processing that has taken place on the basis of your consent up until the time of revocation.
2. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint was lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.The supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
This privacy policy applies exclusively to the website chocolatfrey.com. The webpages on this website may contain links to websites of products of the Federation of Migros Cooperatives or third parties. Our privacy policy does not extend to these websites. When you leave our website, we recommend that you carefully read the privacy policy of each website that collects personal data.
We take the necessary security measures to protect your personal data from unlawful or unintentional access or erase, modification or loss, and against unauthorized disclosure. We encrypt your data during transmission via our website and use so-called SSL (Secure Socket Layer) and TLS (Transport Layer Security) connections. We secure our website, other systems and personal data using appropriate technical and organisational measures, in particular against loss, destruction, unauthorised access, modification or disclosure to third parties.
You can view this Privacy Policy at Privacy Policy (chocolatfrey.com). You can also save or print this Privacy Policy by using the corresponding functions of your browser.
We reserve the right to change this Privacy Policy from time to time or adapt it to legal requirements, and therefore ask you to read the up-to-date version of the privacy policy each time you visit our website.
Version: July 2021
