Privacy Policy
Version dated [11 August 2026]
Through this privacy policy, KRISPY KREME DOUGHNUTS FRANCE provides all information relating to the processing of personal data that it implements – on its own behalf and that of its subsidiaries – in particular to ensure you an optimal experience.
EU Regulation no. 2016/679 of 27 April 2016, known as the “GDPR” defines personal data as “any information relating to an identified or identifiable natural person.” In particular, personal data includes both your name and an email address or a customer account number.
Who processes your personal data?
Your data is processed by KRISPY KREME DOUGHNUTS FRANCE SAS, a simplified joint-stock company with share capital of €3,001,000, whose registered office is located at 21 rue de Rocroy 75010 Paris, registered in the Paris Trade and Companies Register under number 918 527 557 (the “Company”).
The Company therefore acts, in the context of processing your personal data, as a controller.
The Company is thus the one that determines the purposes and means devoted to the treatments implemented.
The Data Protection Officer can be contacted for any questions regarding the processing of your personal data by email at the following address: dpo@krispykreme.fr or by post: KRISPY KREME DOUGHNUTS FRANCE SAS – Personal data – 21 rue de Rocroy – 75010 Paris.
Which data are we processing and for what purposes?
The data collected
The data concerning you includes the following:
Identification data: last name*, first name*, date of birth*,
Contact data: email address*, phone number*
Location data: zip code*
Data related to past orders: last name, first name, email address, place of delivery, mobile phone number
The data followed by an asterisk are those subject to mandatory collection upon registration in the loyalty program.
Please note that measures are in place to ensure your safety in our sales areas, as the company responsible for operating them may use a video surveillance and image capture system. In doing so, you may be filmed for security purposes during your visit.
The purposes pursued
We process your data to enable you to:
Create a customer account in order to allow the processing of your orders (online), manage and process your orders, communicate with you about this management, refund you if applicable, issue invoices, manage and process deliveries);
Ensure the follow-up of customer relations, particularly in managing your complaints and requests;
Manage your participation in the loyalty program;
Apply to job offers, in order to study your application and be able to contact you if an opportunity arises in our network or a position becomes available or is created in our company;
To apply for the opening of a franchise point of sale;
Locate the nearest point of sale;
Receive satisfaction surveys;
To receive, within the limits of the choices made, our newsletters, our promotional offers and news including commercial communications sent in particular via messaging services;
Make you win gifts through contests;
Develop reports, sales statistics, market and behavioral studies, in particular with the aim of improving our products and best meeting your expectations by offering you products tailored to your needs;
Manage your requests for the right to access, rectify, and object to your data;
Keep your data in compliance with accounting standards for the legal period necessary, in order to respond to requests from tax administrations and social organizations if needed.
We are committed to collecting your data by limiting ourselves to the data strictly necessary for the purpose of the envisaged processing, in order to be able to process your requests and offer you the services offered on our website.
The processing of your data also allows the Company and its subsidiaries to:
Provide the required services;
Improve its services by allowing it to provide audience measurement statistics in particular;
Carry out employee recruitment operations;
Comply with compliance with their legal obligations.
The legal basis for processing
The treatments implemented are based on:
The execution of contractual or pre-contractual measures;
Our legitimate interest;
Your consent;
Compliance with legal obligations.
How long is your data kept?
We only keep your personal data for a period not exceeding that necessary in view of the purposes for which it is processed.
| PURPOSES OF PROCESSING | PROCESSED DATA | EXPIRATION DATE |
| Your account information | Identification data Contact details | Three (3) years from your last login to your customer account |
| Customer rewards program | Identification data Contact details | Duration of the contractual agreement. |
| Orders | Data relating to orders placed | Five (5) years from the date of the order. Then, archiving for the applicable legal period, particularly for invoices and delivery notes. |
| Sending newsletters | Email address | Until the withdrawal of your consent or up to three (3) years from your last contact |
| Sending a satisfaction survey | Email address | No data retention |
| Location of points of sale (store locator) | Location data | No data retention |
| Payment | Bank details | Transaction duration |
| Job applications |
| Two (2) years from our last contact. In case of recruitment, the data will be kept in accordance with the mandatory rules in this area. |
| Application for the franchise |
| Two (2) years from our last contact. In the event of the opening of a franchise, the application thus received may be retained for the duration of the contractual relationship. |
| Statistics | Audience measurement | Thirteen (13) months |
| Accounting | Data related to past orders (invoices, delivery notes) | Ten (10) years from the date of issue of the invoice or delivery note. |
Who processes your data?
The data we collect is processed by the relevant internal departments of the Company as well as by our operating subsidiaries – to enable the preparation of your orders – namely:
DOUGHNUTS MANUFACTURING & RETAIL, a simplified joint-stock company with share capital of €10,000, whose registered office is located at 21 rue de Rocroy – 75010 Paris, registered in the Paris Trade and Companies Register under number 980 498 901.
The Company may also be required to disclose the data transmitted to its service providers in charge of services requiring the communication of such data, notably for payment services, order processing, website hosting, email and mail delivery, localization, delivery of products and services, analytical services.
Other service providers, including email service providers, may also assist us with your consent where required by applicable law, to evaluate, develop and provide you with promotions and special offers that may be of interest to you, to administer contests, sweepstakes and events or for any other promotional purpose.
The information concerning you that we collect may be transferred, stored or hosted in countries where the company has the necessary infrastructure to carry out the aforementioned purposes or where its service providers and, if applicable, subsequent service providers are located.
It is therefore possible that your data may be transferred to third countries outside the European Union. Where appropriate, we ensure that the appropriate protection mechanisms are in place to guarantee satisfactory security of the data you entrust to us.
To date, the service providers to whom we are required to communicate your data are notably the following:
PROVIDER NAME | PURPOSES |
SMG Service Management Group, LLC, 1737 McGee Street, Kansas City, MO 64108. Le numéro de téléphone de SMG est le 1-800-764-0439. | Sending out satisfaction surveys |
COLLECTIF HARSENE SAS located 24 rue | Website maintenance and development |
MIAM COMPANY (DOOD) SAS located at 66 cours Charlemagne – 69002 Lyon RCS of LYON under the number 838 455 525 | Development, management, maintenance of the application |
Obypay (2BEVENTS) 74970 MARIGNIER | Management of orders placed at a point of sale using the order terminal |
Cashpad 28 RUE REAUMUR 75003 PARIS RCS Paris 525 151 429 | Checkout system |
SRT GROUP (Stuart) Simplified joint-stock company with a capital of 4,200,183.33 EUROS RCS Paris: 808 233 399 43-45 Avenue de Clichy 75017 Paris – France | Delivery of orders |
Uber Direct Uber B.V. limited liability company established in the Netherlands with a capital of 1 euro registered with the Amsterdam Chamber of Commerce under number 56317441 having its offices at : Burgerweeshuispad 301 1076 HR Amsterdam (Netherlands). | Delivery of orders |
Stripe Stripe Payments Europe, Ltd. (SPEL) 10 Boulevard Haussmann 75009 Paris – France | Online payment provider |
Trackers and cookies
We also use cookies to analyse your use of the website. The cookies used, their purpose and retention period are specified in the cookie use policy available here: https://krispykreme.fr/en/cookie-policy/.
Your rights:
In accordance with the applicable regulations, you have the following rights:
Right to withdraw your consent: as your consent is never final, you can decide at any time to withdraw the consent you have given us. However, any processing previously carried out on this basis will remain valid.
Right of access: you can ask us whether we hold data about you and, if necessary, request its disclosure.
Right of rectification: to enable us never to process erroneous information, you have the right to rectify and/or complete any inaccurate or incomplete information that we may have in our possession.
Right to erasure: you can ask us to delete your personal data.
Right to limit processing: in certain limited cases provided for by the GDPR, you can ask us to temporarily suspend the use of some of your data.
Right to object: you can object to all or part of the processing of your data.
Right to portability: when the processing of your personal data is based on consent or on the execution of a contract or pre-contractual measures, and when the processing is carried out using automated processes, you can ask us to retrieve this data in a format that is easily usable.
To exercise your rights, you can send a written request by email to the following address: dpo@krispykreme.fr or by post to the following address: KRISPY KREME – Personal Data Protection – 21 rue de Rocroy – 75010 Paris.
Your request must specify your identity. In case of reasonable doubt as to the applicant’s idea, an identity document may be required.
We will endeavour to respond to your requests within a maximum of one month. However, complex requests may be processed within a maximum of three months.
You also have the possibility to file a complaint with the National Commission on Informatics and Liberties (CNIL).