main-logo

PRIVACY POLICY

Updated on 24/12/2025

PERSONAL DATA PROTECTION POLICY

PREAMBLE

As part of making its mobile application and/or website available at the following address: www. chopstixnoodles.fr (hereinafter referred to as “the Website”) to users, and in connection with the creation, access, or use of the application and/or website by the user, CHOPSTIX France (a Single-Shareholder Simplified Joint-Stock Company with share capital of 100.000,00 Euros, whose registered office is located at Cap Sud – 106 Avenue Marx Dormoy 92120 Montrouge, registered with the Nanterre Trade and Companies Register under number 991 026 618) collects and processes users’ personal data.

CHOPSTIX France (hereinafter referred to as “CHOPSTIX” or “we”) acts as a data controller under the General Data Protection Regulation (GDPR).

This Personal Data Protection Policy aims to inform you about how your personal data are collected, processed, used, shared, and protected through the application and/or the website, the purposes pursued, and your rights in relation to your data.

BY CREATING AN ACCOUNT, CONNECTING TO, OR USING THE APPLICATION OR WEBSITE, YOU AGREE THAT YOUR PERSONAL DATA MAY BE COLLECTED AND PROCESSED IN ACCORDANCE WITH THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THESE TERMS, YOU MUST NOT CREATE AN ACCOUNT OR USE THE APPLICATION AND/OR WEBSITE.

This Personal Data Protection Policy is governed by French law. However, if the user is a consumer whose habitual residence is in another European Union member state, the mandatory provisions of that country shall also apply.

In case of disputes concerning this policy, French courts have jurisdiction. The aforementioned rule on consumer protection also applies to EU residents outside of France.

If any provision of this policy is found invalid by law, regulation, or court decision, the remaining provisions shall remain in effect.

We may amend this policy to reflect regulatory, legal, judicial, or technological developments. The effective version will always be available on the application and the website, with the update date clearly stated at the top of the policy.

 

Article 1: What is Personal Data?

“Personal Data” means any information relating directly or indirectly to an identified or identifiable individual (e.g. name, phone number, location data, etc.).

 

Article 2: Information about Personal Data Processing

CHOPSTIX implements all data processing activities in compliance with applicable regulations, including:

  • The General Data Protection Regulation (EU) 2016/679, effective May 25, 2018
  • The amended French Data Protection Act No. 78-17 of January 6, 1978

All personal data processing carried out through the website or application is guided by fairness, lawfulness, and transparency. CHOPSTIX is committed to providing clear, complete, and accessible information about these processes.

The following table outlines CHOPSTIX’s data processing purposes, legal basis, and data retention periods:

 

Purpose of the processing Personal data transmitted to CHOPSTIX Legal basis for the processing of personal data Retention period of your personal data
Management of users’ initial contact requests on the Website Name, Surname, Email, Address Legitimate interest of CHOPSTIX Retention for a period of 3 years after the last contact initiated by the user
Management of the creation of the loyalty account via the Application Name, Surname, Email Contractual performance between CHOPSTIX and the Application User Retention for a period of three (3) years from the User’s last interaction with CHOPSTIX
Management of the creation of the advanced profile via the Application Gender, Date of birth, Postal code, Country, Your CHOPSTIX product preference(s), Your preferred CHOPSTIX restaurant(s) Consent Retention for a period of three (3) years from the User’s last interaction with CHOPSTIX or until withdrawal of consent
Management of CHOPSTIX Customer Service Name, Surname, Order reference, IBAN Legitimate interest of CHOPSTIX Retention for the duration from the start to the end of the resolution of the User’s dispute. In the event of litigation, retention for the duration of all litigation phases, then deletion once all legal remedies have been exhausted
Management of the newsletter via the Application and/or the Website Email User’s consent to receive newsletters and promotional offers Retention for a period of three (3) years from the User’s last interaction with CHOPSTIX or until withdrawal of consent
Management of the recruitment of a new CHOPSTIX franchise restaurant via the Website Name, Surname, Email, Postal address, Telephone number, Date of birth, Professional background, CV, Proof of bank account status, Identity document Pre-contractual and contractual performance between CHOPSTIX and the franchise restaurant Retention for a period of 10 years after termination of the franchise agreement. If the profile is not selected at the opening of the new franchise restaurant, retention for a period of 6 months
Management of processing and responses relating to individual rights requests Name, Surname, Email Legal obligation of CHOPSTIX Retention for a period of 10 years from the closure of the individual rights request
Management of activity and traffic on the Website and the Application Mobile IP address, Internet browser type, Operating system, Mobile or tablet iOS, Connection URL address including associated date and time, Content accessed via the Application and the Website Legitimate interest of CHOPSTIX Retention for a maximum period of 13 months

Article 3: Data Storage and Transfers

CHOPSTIX may store and transfer your personal data to subcontractors for the following purposes:

  • Management of the hosting of the Website and the Application,
  • Management of initial contact requests from users on the Website,
  • Management of the CHOPSTIX customer service,
  • Management of the recruitment of new CHOPSTIX franchise restaurants,
  • Management of newsletters and promotional offers via the Website and/or the Application,
  • Management of IT resources and maintenance of the Website and the Application.

CHOPSTIX ensures that all processors comply with data protection laws and sign appropriate contractual agreements.

Data may also be shared internally with authorized CHOPSTIX employees and externally with legally authorized authorities.

If you consent, personal data may be transferred outside the EU for statistical or marketing purposes (e.g. newsletter distribution). In such cases, CHOPSTIX ensures compliance through one of the following safeguards:

  • Transfers to countries recognized by the EU as providing adequate protection
  • Use of European Commission standard contractual clauses (SCCs)
  • Any other appropriate safeguard under Article 46 of the GDPR

Article 4: Personal Data of Minors

In France, minors under 15 years old are not allowed to create an account on the application or website. Minors aged 15 or older may do so without parental consent.

If a parent or guardian becomes aware that a child has provided CHOPSTIX with personal data without consent, they should contact us as indicated in Article 10. We will delete the data in compliance with applicable laws.

 

Article 5: Security of Personal Data

CHOPSTIX takes all necessary precautions to ensure the security of your personal data, implementing appropriate technical and organizational measures (as per Article 32 of the GDPR) to ensure confidentiality, integrity, and availability.

Our staff are trained and made aware of data protection principles.

In the event of a data breach compromising the confidentiality, integrity, or availability of personal data, CHOPSTIX will notify the CNIL (French data protection authority) and, if necessary, other relevant national authorities as required by law.

 

Article 6: Your Rights

You may exercise the following rights at any time:

  • Access to your Personal Data in a clear and understandable format in order to know the information processed by CHOPSTIX concerning you,
  • Rectification leading to the modification of any incomplete or incorrectly processed Personal Data by CHOPSTIX,
  • Erasure of your Personal Data under conditions predetermined by the applicable Regulation,
  • Restriction of the processing of Personal Data under conditions predetermined by the applicable Regulation,
  • The possibility to object to data processing by providing legitimate reasons for which such objection must be satisfied,
  • Portability of Personal Data in a clear and machine-readable format, with the possibility to transmit such Data to another organization,
  • Determination of the fate of your Personal Data in the event of death, by providing specific instructions to CHOPSTIX.

You can exercise these rights by contacting us via:

  • Postal mail: Cap Sud – 106 Avenue Marx Dormoy 92120 Montrouge
  • Email: dpo@chopstix.fr (please mention “personal data” in the subject line)

CHOPSTIX may request proof of identity before processing your request. We will respond within 30 days, extendable to 60 in complex cases, and keep you informed of any delays. If you believe your

 rights have been violated, you may lodge a complaint with your local data protection authority, such as:

 

In France, complaints can be submitted to the CNIL at: CNIL – Service des plaintes, 3 place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 or online via https://www.cnil.fr/fr/plaintes.