Privacy Policy
Version as of [2 September 2025]
By this privacy policy, the company KRISPY KREME DOUGHNUTS FRANCE provides you with all the information related to the processing of your personal data that it implements – on its behalf and that of its subsidiaries – in particular to guarantee you an optimal experience.
The EU Regulation n°2016/679 of 27 April 2016, known as “GDPR” qualifies as personal data “any information relating to an identified or identifiable natural person”. In particular, constitutes personal data both your name and an email address or a customer account number.
Who processes your personal data?
Your data is processed by the company KRISPY KREME DOUGHNUTS FRANCE SAS, a simplified joint-stock company with a share capital of €3,001,000, whose registered office is located at 103 rue La Fayette 75010 Paris, registered in the Paris Trade and Companies Register under number 918 527 557 (the “Company”).
The Company therefore acts, in the context of processing your personal data, as a controller.
The Company is thus the one that determines the purposes and means devoted to the treatments implemented.
The Data Protection Officer can be contacted for any questions regarding the processing of your personal data by email at the following address: rgpd@krispykreme.fr or by post: KRISPY KREME DOUGHNUTS FRANCE SAS – Personal data – 103 rue La Fayette – 75010 Paris.
What data are processed by us and for what purposes?
The data collected
The data we collect about you includes:
Identification data: last name, first name*, date of birth,
The contact data: email address*, phone number*
The location data
Data related to placed orders: last name, first name, email address, delivery location, mobile phone number
The data followed by an asterisk are those subject to mandatory collection.
Please note that security measures are in place in our sales areas, including a video surveillance system. In doing so, you may be filmed for security purposes during your visit.
The purposes pursued
We process your data to allow you to:
- Create a customer account;
- Place order, pay, be delivered;
- Manage your participation in the loyalty program;
- Apply to job offers;
- To apply for the opening of a franchise sales outlet;
- Locate the nearest point of sale;
- Receive satisfaction surveys;
- Receive, within the limits of the choices expressed, our offers and news;
The processing of your data also allows the Company and its subsidiaries to:
- provide the required services;
- improve its services by allowing it to provide audience measurement statistics in particular;
- conduct employee recruitment operations;
- Comply with compliance with their legal obligations.
It is also specified that in order to ensure your safety during your visit to one of our points of sale, we, including the company in charge of operating the point of sale, may use a remote monitoring system capable of capturing your image.
The legal basis for processing
The treatments implemented are based on:
- the execution of contractual or pre-contractual measures,
- our legitimate interest,
- your consent,
- compliance with legal obligations.
How long is your data kept?
We only keep your personal data for a period not exceeding that necessary in view of the purposes for which they are processed.
| PURPOSES OF PROCESSING | PROCESSED DATA | EXPIRATION DATE |
| Your account information | Identification data
Contact details | three (3) years from your last login to your customer account |
| customer rewards program | Identification data
Contact details | Duration of the contractual agreement. |
| Orders | Data relating to orders placed | Five (5) years from the date of the order.
Then, archiving for the applicable legal period, particularly for invoices and delivery notes. |
| sending newsletters | email address | Until the withdrawal of your consent or up to three (3) years from your last contact |
| Sending a satisfaction survey | email address | No data retention |
| Location of points of sale (store locator) | location data | No data retention |
| payment | bank details | Transaction duration |
| Job applications |
| Two (2) years from our last contact. In case of recruitment, the data will be kept in accordance with the mandatory rules in this area. |
| Application for the franchise |
| Two (2) years from our last contact. In the event of the opening of a franchise, the application thus received may be retained for the duration of the contractual relationship. |
| statistics | audience measurement | Thirteen (13) months |
| accounting | Data related to past orders (invoices, delivery notes) | Ten (10) years from the date of issue of the invoice or delivery note. |
Who processes your data?
The data we collect is processed by the relevant internal departments of the Company as well as our operating subsidiaries – to enable the preparation of your orders – namely:
- The company DOUGHNUTS MANUFACTURING & RETAIL, a simplified joint-stock company with a share capital of €10,000, whose registered office is located at 103 rue La Fayette – 75010 Paris, registered in the Paris Trade and Companies Register under number 980 498 901
The Company may also be required to communicate the data transmitted to its service providers in charge of services requiring the communication of such data.
The information concerning you that we collect may be transferred, stored or hosted in countries where the company has the necessary infrastructure to carry out the aforementioned purposes or, where its service providers and, if applicable, subsequent service providers are located.
It is therefore possible that your data may be transferred to third countries outside the European Union. Where applicable, we ensure that adequate protection mechanisms are in place to ensure the satisfactory security of the data you entrust to us.
To date, the service providers to whom we are required to communicate your data are as follows:
PROVIDER NAME |
PURPOSES |
SMG
Service Management Group, LLC, 1737 McGee Street, Kansas City, MO 64108. Le numéro de téléphone de SMG est le 1-800-764-0439. | Sending out satisfaction surveys |
SHERBET YOUTH MARKETING (PTY) LIMITED Company incorporated under the laws of South Africa, registered under number 2020/436662/07 with its headquarters located at 16 Skeen Boulevard – Bedfordview – 2007 – South Africa | website development |
MIAM COMPANY (DOOD) SAS located at 66 cours Charlemagne – 69002 Lyon RCS of LYON under the number 838 455 525 | Development, management, maintenance of the application |
Obypay (2BEVENTS) 74970 MARIGNIER | Management of orders placed at a point of sale using the order terminal |
Cashpad 28 RUE REAUMUR 75003 PARIS RCS Paris 525 151 429 | checkout system |
SRT GROUP (Stuart) Simplified joint-stock company with a capital of 4,200,183.33 EUROS RCS Paris: 808 233 399 43-45 Avenue de Clichy 75017 Paris – France | delivery of orders |
Uber Direct Uber B.V. limited liability company established in the Netherlands with a capital of 1 euros registered with the Amsterdam Chamber of Commerce under number 56317441 having its offices at : Burgerweeshuispad 301 1076 HR Amsterdam (Netherlands). | delivery of orders |
Stripe Stripe Payments Europe, Ltd. (SPEL) 10 Boulevard Haussmann 75009 Paris – France | online payment provider |
The tracers and cookies
We also use cookies to analyse your use of the website. The cookies used, their purpose and retention period are specified in the cookie policy available here.
Your rights:
In accordance with the applicable regulations, you have the following rights:
Right to withdraw your consent: as your consent is never definitive, you can at any time decide to withdraw the consent you have given us. The treatments previously carried out on this basis will however remain valid.
Right of access: you can ask us whether we hold data about you and, if necessary, request its communication.
Right of rectification: to enable us never to process erroneous information, you have the right to rectify and/or complete the inaccurate or incomplete information that we would have in our possession.
Right to erasure: you can ask us to delete your personal data.
Right to restriction of processing: you may, in certain limited cases provided for by the GDPR, ask us to temporarily suspend the use of some of your data.
Right to object: you can object to all or part of the processing of your data.
Right to portability: when the processing of your personal data is based on consent or the performance of a contract or pre-contractual measures, and when the processing is carried out using automated processes, you can ask us to retrieve this data in an easily usable format.
To exercise your rights, you can send a written request by email to the following address: rgpd@krispykreme.fr or by postal mail to the following address: KRISPY KREME – Protection of Personal Data – 103, rue La Fayette – 75010 Paris.
Your request must specify your identity. In case of reasonable doubt as to the applicant’s idea, an identity document may be requested from you.
We will endeavor to respond to your requests within a maximum of one month. Complex requests may, however, be processed within a maximum period of three months.
You also have the possibility to file a complaint with the National Commission for Information and Freedoms (CNIL).