Privacy Policy

(V.1 May 2026)

Gira’s Privacy Policy is available in English and French. You can request a copy of the French version by emailing contact@girafood.com.

Our philosophy and commitments

Girag & Associates SAS is committed to protecting your personal data and is dedicated to ensuring a high level of protection for your personal data in accordance with European Regulation 2016/679 and the French Data Protection Act No. 78-17.

Accordingly, you will find below our privacy policy, which explains, in particular, what personal data we collect, how it is processed and on what basis, how it is stored, and your personal rights. We invite you to read it carefully.

If you have any questions regarding the protection of personal data, please send an email to the following address: contact@girafood.com.

You can find the text of the applicable European Regulation here: https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679 or contact the regulatory authority (CNIL) via its website: www.CNIL.fr.

This version of the privacy policy may be amended by us where necessary. Any updates will be published on our website, http://www.girafood.com/.

Your data controller

Girag & Associates SAS is the data controller for your personal data; its contact details are as follows: 13B Chemin du Levant, 01210 Ferney-Voltaire; it is referred to herein by its name or as ‘We’.

Your personal data and its collection by Girag & Associates SAS

Your personal data may be collected during:

• your visit to our website,
• our communications,
• our marketing activities,
• the drafting or execution of our contracts.

We do not collect any data that is not necessary for the purposes of processing mentioned at the time of collection, nor any data prohibited by law or regulation.

The collection of certain data may be mandatory or optional, and you will be informed of which information is mandatory. Your personal data may be collected by third-party service providers or partners, who undertake to comply with European and national regulations on personal data.

Our policy is not to transfer your data outside the European Union; should we, exceptionally, proceed to do so, such a transfer may only take place to a country or organisation covered by an adequacy decision (Article 45 of the GDPR) or offering sufficient and appropriate safeguards (Article 46 of the GDPR).
We do not make any automated decisions.

We may collect the following personal data from you:

• Personal details, identity, contact details, images
• Economic and financial personal data
• Connection data

How we process your personal data

We process your personal data by entering it into databases; it is stored, retained and, where necessary, corrected, deleted, archived, anonymised or pseudonymised, or transferred to trusted third parties. We process your personal data for the following purposes or for purposes specified to you at the time of collection:

• To inform you about our commercial offers (products, services, etc.) and promotions – To communicate with you
We may use your personal data for marketing purposes, in particular to send you information about our products/services, our commercial and promotional offers, quotes and other pre-contractual documents, and our news via email, post or telephone.

• The execution of your current contracts and customer follow-up
We use your personal data to ensure the execution of current contracts in accordance with your requests. We may also send you information regarding your order or current contracts, their fulfilment, your invoices and contractual documents, advice, the fulfilment of our warranties where applicable, and our legal obligations. We also use your personal data to manage our customer relationship, your requests or complaints, any disputes where applicable, and to track your customer history.

• Improving the use of our services and enhancing our offerings
We process your personal data to enable you to make the best possible use of our services, to improve our offerings and products/services, and to track your user journey, conduct satisfaction surveys, polls and anonymous statistics.

• Your payments
Your bank details may be collected either directly by us or by a dedicated, selected service provider, who guarantees the complete confidentiality of your bank details; these details are retained only for the duration of the contractual relationship or within the limits of the law.

• Protection against fraudulent activities
The personal data collected may be used to combat fraud, particularly in relation to payments or direct debits made. In this regard, our payment security service providers may receive this data.

• Ensuring compliance with the law and court orders
Your Data may be used to:
o respond to a request from an administrative or judicial authority, a law enforcement officer or a court official, or to comply with a court order;
o ensure compliance with our general terms and conditions of sale/service;
o protect our rights and/or seek compensation for any damage we may suffer or limit the consequences thereof;
o prevent any conduct contrary to applicable laws, in particular in the context of fraud prevention.

We may also need to process your personal data for the following purposes:

• Business relations
o Sending marketing campaigns by email, post or telephone (including via a service provider)

• Security
o Protection of property and persons, and security via CCTV or access badges

• Miscellaneous
o Dissemination of administrative and scientific information
o Management of professional networks
o Calendar management
o Electronic signatures
o Enforcement of legal or contractual guarantees

• Internet
o Creating and managing your user account

• Cookie management (view Gira’s Cookie Policy for full details)
o Essential cookies – for the optimal use of the website (e.g. login, shopping basket, etc.)
o Performance cookies – (enabling the compilation of anonymous statistics and traffic levels on the site) and tracking and personalisation cookies collecting information about your use of the site and enabling us to tailor our offers to you,
o Analytical cookies – enabling us to understand and analyse your browsing behaviour on our site.

The legal basis for the processing of your personal data

In accordance with the regulations, our processing of your personal data is lawful if it is based on one of the following grounds:

• Your consent to the processing of your data by us: by providing your explicit consent, you agree to the processing of your personal data. You may withdraw your consent at any time by sending an email to: contact@girafood.com; or
• The existence of a contract between you and us: the processing of your data is necessary to carry out and complete the contract; or
• Our legitimate interest in processing your personal data, provided that this proportionate interest respects your fundamental rights and your privacy; or
• Applicable law or regulations where these require us to process and retain your personal data.

Terms and retention periods for your personal data

We manage your personal data in three phases:

• an active phase, during which data is retained for the period specified below in an ‘active’ database: your personal data is then accessible only to those who have an operational need to access it in order to carry out authorised processing
• an archiving phase (for a period in addition to the retention in the ‘active’ database) where a legitimate reason justifies it: your personal data is then archived with restricted access and for a limited period.
• a deletion or anonymisation phase: at the end of the additional archiving period within the timeframes set out below, your personal data is deleted or anonymised (so that it can no longer constitute personal data identifying you).

Your personal data is retained for as long as is necessary for the purposes of processing it, for our customer relationship where applicable, and for the execution of contracts, and within the limits specifically laid down by regulation; we may retain your personal data in an archive for the purposes of retaining accounting, tax or evidential supporting documents for the duration of the applicable limitation periods. By way of example, we set out below the retention periods applicable to the following processing activities (subject to any regulations requiring different retention periods):

Purpose of processing Legal basis for processing Retention of personal data in the “active” database Additional archiving
Marketing Your consent 3 years if you have not actively responded to any marketing communications. The period starts afresh if you actively engage with us. X
Fulfilment of our contractual obligations towards you / services Contract The time necessary to fulfil the contract and 3 years from the end of the commercial relationship (last activity, such as completion of the contract (purchase, service, etc.), or logging in to the website as a registered user) 5 years following the end of the contractual relationship
Customer relationship Contract 3 years from the end of the commercial relationship (your last activity with us) 5 years following the end of the contractual relationship

Withdrawal of your consent to the collection or processing of your personal data

You may withdraw the consent you have given for the collection of your personal data by sending an email to the following address: contact@girafood.com or by post to the addresses listed in the footer, stating your surname, first name, email address and postal address, along with the nature and specific purpose of your request to withdraw consent.

You may also send any comments regarding your personal data to Girag & Associates SAS, 13B Chemin du Levant, 01210 Ferney-Voltaire

Exercising your rights regarding your personal data

You have:

• The right of access, which allows you to obtain:
o Confirmation as to whether or not data concerning you is being processed;
o A copy of all personal data held by the data controller.

• The right to request the portability of certain data: This allows you to retrieve your personal data in a structured, commonly used and machine-readable format.

• The right to object: this allows you to opt out of receiving marketing communications from us or our partners, or, for reasons relating to your particular situation, to have the processing of your data for research and development, fraud prevention and detection purposes ceased.

• The right to rectification: this allows you to have information concerning you rectified where it is out of date or incorrect. It also allows you to have incomplete information concerning you completed.

• The right to erasure: this allows you to have your personal data erased, subject to statutory retention periods. This may apply, in particular, where your data is no longer necessary for processing.

• The right to restriction of processing: This allows you to restrict the processing of your data in the following cases:
o In the event of unlawful use of your data;
o If you dispute the accuracy of your data;
o If you need the data to establish, exercise or defend your rights.
The data will then no longer be subject to active processing and cannot be modified for the duration of the exercise of this right.

• The right to obtain human intervention: data controllers may use automated decision-making for the purpose of concluding or managing your contract. In this case, you may ask Girag & Associates SAS what criteria were decisive in the decision

You may exercise these rights by email: contact@girafood.com or by post to the following address: 13B Chemin du Levant 01210 Ferney-Voltaire, stating your surname, first name, address and email address (and your customer reference number, if applicable), as well as the subject of your request in clear and legible terms. Girag & Associates SAS undertakes to respond to your verified request within one month of receipt.

In the event of any difficulties, you may email contact@girafood.com directly or refer the matter to the Commission Nationale de l’Informatique et des Libertés (CNIL).

Our data processors and partners

Girag & Associates SAS may transfer your personal data to data processors providing services that involve the processing of your data, in accordance with the purposes set out herein; these subcontractors must treat your personal data with the same level of confidentiality as Girag & Associates SAS and have undertaken to comply fully with personal data regulations, in particular the GDPR.

We do not sell your personal data; if you would like to find out more and specifically know the identity of the service providers or partners to whom your personal data has been transferred, you can send an email to the following address: contact@girafood.com

Service providers or partners who may have access to your personal data may include:

• service providers who may manage outsourced services for the execution of our services and contracts;
• service providers who help us improve our services, carry out data analysis and optimise our offerings, and conduct surveys and compile statistics;
• statutory auditors, chartered accountants, consultants, solicitors, audit firms, IT and IT outsourcing service providers, and security service providers;
• investors and potential buyers.

We may also be required to disclose your personal data to French authorities, government bodies and courts, particularly in the context of legal proceedings or legal formalities requiring such disclosure.

Updates to this policy

Please note that this policy may be subject to change in line with changes in the law.

Last updated: May 2026