Personal Data Protection Policy

Privacy Charter - Data Protection & Privacy & Security: Version effective as of: 02/22/2026.

At MOUTTA FARM, the protection of Personal Data (PD) is at the heart of the relationship of trust we build with our customers, prospects, and employees. We are committed to protecting your personal information as effectively as possible and to complying with all applicable European and French data protection regulations.

Scope

This policy explains how MOUTTA FARM collects and processes your personal data, in particular through the website www.mouttafarm.com.

It applies to all processing carried out by MOUTTA FARM, or by one of its service providers acting on its behalf, on the personal data of its customers or prospects, regardless of their nationality or place of residence.

For simplicity, the individuals concerned by this policy will hereafter be referred to as “Customers”, “Prospects”, or “You”.

This policy also aims to inform you of your rights regarding the processing of personal data carried out by MOUTTA FARM, in particular your right to object, and of how you can exercise these rights.

To ensure compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, known as the General Data Protection Regulation (GDPR), MOUTTA FARM has appointed a Data Protection Officer (DPO).
The DPO ensures that the processing carried out complies with applicable law and serves the purposes set out in this policy.

Principles of Personal Data (PD) Collection 

2.1 – What personal data do we process?

Personal data is any information relating to an identified or identifiable individual, directly or indirectly, in particular by cross-referencing information.

For example, this may include a name, a photograph, a mailing address, an email address, a phone number, an IP address, a login ID, or even a voice recording.

The data we may process falls into the following main categories:

• Personal information: last name, first name, mailing address, email address, preferences, etc.
• Activity data: purchases, deliveries, participation in loyalty programs or contests, exchanges with customer service or after-sales service, etc.
• Banking information: data required to process payments (partial credit card numbers, transactions, etc.).
• Technical and browsing data: login credentials (password), IP address, browsing history, geolocation data, technical or application logs, etc.

We do not collect any so-called “sensitive” data as defined by the GDPR, such as data relating to health, political opinions, religious beliefs, sexual orientation, or trade union membership.

Furthermore, MOUTTA FARM does not carry out any processing specifically targeting minors.
It is the responsibility of parents or legal guardians to ensure that minors only make purchases or use MOUTTA FARM services with their permission and under their responsibility.
Where processing requires consent, it must be given or authorized by the minor's parents or legal guardians.

2.2 – How do we collect your data?

Your data may be collected at different points in your relationship with MOUTTA FARM, directly from you or through our partners, in particular when:

• You purchase products on the website www.mouttafarm.com;
• You create a customer account;
• You subscribe to our newsletter;
• You browse one of our websites that uses cookies or other internal or third-party trackers;
• You join a loyalty program. For loyalty offers that include financing, our financial partner only shares the status of your account with us (open, active, closed, inactive), never your financial information;
• You contact our customer service or after-sales service;
• You enter a contest or take part in a promotion;
• You have agreed to have your data shared with MOUTTA FARM by a partner;
• You interact with us on social media, in particular through the "Like", "Share", or "Tweet" buttons on our official pages (Facebook, Instagram, X, ...). These interactions may involve data exchanges between the social networks and MOUTTA FARM;
• You view our special offers, ads, or promotional emails;
• You leave a review of a product or a shopping experience;
• You fill out a questionnaire or a satisfaction survey.

When certain information is required to perform a contract or meet a legal obligation, this is indicated at the time of collection, usually with an asterisk (*).

Personal Data Protection Policy 

Processing refers to an operation, or set of operations, performed by automated or non-automated means and applied to personal data.

The personal data collected by MOUTTA FARM is processed by SAS FERME DU MOUTTA, whose registered office is located at 15 Avenue Gay-Lussac, 64140 LONS (France).

The Data Protection Officer (DPO) is MOUTTA FARM’s point of contact for any questions about personal data. You can reach the DPO:

• by mail at the following address: FERME DU MOUTTA, 15 avenue Gay-Lussac – 64140 Lons (France);
• or through the contact form available on the "Contact Us" page of the site.

3.1 – What is the legal basis for our processing?

MOUTTA FARM processes your data for lawful and legitimate purposes. Each processing activity is based on one of the following legal bases:

• the performance of a contract,
• the consent of the individual concerned,
• compliance with a legal obligation,
• or the legitimate interest of MOUTTA FARM or a third party.

a) Processing necessary for the performance of a contract or pre-contractual measures

This legal basis applies when processing is necessary for the performance of a contract between you and MOUTTA FARM, or to take pre-contractual steps at your request.

Examples of processing concerned:

• fulfilling your online purchases;
• managing services (warranties, insurance);
• managing quotes and reservations;
• tracking orders, deliveries, returns, or cancellations;
• managing after-sales service, claims, and contractual warranties;
• managing loyalty programs, gift cards, and store credit;
• participation in contests;
• product recalls;
• forwarding financing requests to our partners;
• managing billing, payments, and unpaid balances.

b) Processing based on consent

Where no other legal basis applies, some processing is based on your explicit consent.
This is the case in particular for:

• the management of cookies and marketing trackers, for:
• targeted advertising on behalf of MOUTTA FARM or third parties;
• personalizing the display and content of our website;
• the use of your data for marketing purposes:
• if you are a prospect, to receive offers from MOUTTA FARM by email, text message, or voice message;
• if you are a customer or prospect, to receive third-party offers through the same channels.

c) Processing based on MOUTTA FARM's legitimate interest

Certain processing activities are carried out on the basis of MOUTTA FARM's legitimate interest, provided that they do not infringe on your fundamental rights and freedoms.

These processing activities include in particular:

• audio recording of calls to customer service or after-sales service;
• improving our offers, products, and services;
• conducting satisfaction surveys and collecting customer reviews;
• marketing (email, text message, phone, mail) to customers for products similar to those they have already purchased;
• marketing by mail or phone, unless you have opted out via Bloctel;
• acquiring new customers through partners or affiliate programs;
• producing statistics and measuring site traffic;
• the physical security of our premises, staff, and visitors;
• IT security and fraud prevention;
• defending our legal interests in the event of a dispute or litigation.

d) Processing necessary to comply with a legal obligation

Certain processing is required by law, in particular for:

• keeping accounting and tax records;
• handling requests to exercise your rights (access, correction, deletion, etc.);
• complying with court or administrative orders.

3.2 – Do we make automated decisions?

MOUTTA FARM does not carry out automated decision-making within the meaning of the GDPR.

However, certain data may be processed by third parties (banks, financing companies, payment providers) to fight fraud or assess credit applications.

Such processing may result in the automatic refusal of certain suspicious transactions.
In that case, you can challenge the decision, submit comments, or request human review directly with these third parties.

Who do we share your data with?

In the course of its business, MOUTTA FARM may share certain personal data with service providers, suppliers, or partners, or give them access to it.
Such sharing is strictly limited to what they need to carry out their tasks, in accordance with the contractual agreements made with them and with applicable regulations.

4.1 – Sharing with our service providers and processors

We work with various service providers in the following areas:

• IT: hosting, maintenance, security, application support, monitoring, backup management, etc.;
• Logistics: order preparation, packaging, shipping, delivery, returns management, etc.;
• Customer relations: call centers, product review management, satisfaction surveys, polls, etc.;
• After-sales service: diagnostics, repairs, replacements, warranty returns processing, etc.;
• Marketing and communications: marketing campaigns on behalf of MOUTTA FARM (mail, email, text message, phone, voice messages, online campaigns), contest management, advertising networks, marketing studies, performance analysis, personalized recommendations, coupons, etc.;
• Financial transactions: payment processing (checks, credit cards, bank transfers, etc.).

Some of these providers carry out operations on behalf of MOUTTA FARM without determining their purposes; they then act as processors within the meaning of the GDPR.

We contractually require these processors to:

• maintain the confidentiality and security of the data processed,
• use the data only in accordance with our instructions,
• and retain it only for as long as necessary to carry out their tasks.

When providers determine the purposes or means of processing themselves, they are considered data controllers. In that case, MOUTTA FARM ensures by contract that your data is used in line with your expectations and with legal requirements.

4.2 – Sharing with partners and third parties

Your data may also be shared with business partners or third parties in the following cases:

• when we offer products or services in partnership with other companies (e.g., insurance, consumer credit, gift boxes, extended warranties, etc.);
• when partners carry out processing that MOUTTA FARM does not perform directly (e.g., handling or verifying payments by check or credit card, or financing requests);
• when your products are returned to the manufacturer under warranty;
• when we need to share information with our representatives (attorneys, court officers, experts) in connection with a dispute or legal proceedings;
• if you are a customer or prospect and your data is used for marketing or advertising (mail, phone, email, text message, online advertising) on behalf of third-party advertisers, in accordance with regulations and your consent choices.

4.3 – Legal obligations and exceptional transfers

Your data may also be disclosed to administrative or judicial authorities authorized by law, upon an explicit and justified request, in accordance with applicable legal provisions.

Finally, in the event of the full or partial sale of MOUTTA FARM or its assets, your personal data may be made available to those involved in the transaction (auditors, buyers, advisors, etc.) and included in the transferred assets.

Data Transfers Outside the European Economic Area 

MOUTTA FARM informs you that some of its service providers or partners may be located outside the European Economic Area (EEA). In this context, it may be necessary to give them restricted, controlled, and secure access to some of your personal data, solely so that they can carry out their tasks.

These transfers may involve providers located in particular in the United Kingdom or the United States, or more broadly in countries that do not offer a level of protection equivalent to that required by the European Union.

To guarantee the confidentiality and integrity of your data during these transfers, MOUTTA FARM implements appropriate safeguards, such as signing the Standard Contractual Clauses adopted by the European Commission, entering into strict contractual commitments with its providers, and, where necessary, additional technical measures such as encryption or pseudonymization. These measures ensure that your data benefits from a level of protection equivalent to that applied within the European Union, in accordance with the General Data Protection Regulation (GDPR).

How long do we keep your data? 

We make sure your personal data is not kept longer than necessary, based on the needs of the departments concerned, the contracts entered into, and legal or tax obligations. At the end of the retention or archiving periods, your data is deleted or anonymized.

Retention periods by purpose:

• Product and service purchases: data is kept for 5 years from the end of the business relationship.
• Marketing: data is kept until consent is withdrawn or for 3 years from the last contact, which may be the last purchase, the last email opened, the end of a service contract, the expiration of a warranty, or the date the data was collected.
• Call recordings: kept for 1 month from the date of the call.
• Statistical analysis: data is kept for the periods indicated above; after these periods, it is anonymized.
• Physical security: kept for 1 month from the date the data was created.
• Bank transactions: kept for the duration of the transaction and, where applicable, for the statutory dispute period, with truncated data (13 months maximum).
• IT security: data kept for 1 year.
• Accounting records and supporting documents: kept in accordance with applicable legal provisions. This also covers product recalls, the TV license fee, and the handling of your requests to exercise your rights.
• Legal or administrative proceedings: your data will be kept for the entire duration of the proceedings until a final decision is reached.

How do we protect your data? 

We make sure your data is processed with an appropriate level of security, through:

• Technical measures suited to the sensitivity of the processing and the data, such as traffic filtering, encryption, pseudonymization, and the physical security of our sites.
• Organizational measures, including the separation of duties and responsibilities, limiting access to operational needs only, defining retention periods, implementing controls, and staff training.

We pay special attention to the security of payments and your banking information: we never collect your full banking details (full card number, CVV, expiration date). Only part of the data is used to identify the card used for payment. All of your banking information is collected solely by our PCI-DSS certified payment providers, ensuring a level of security that meets payment card industry standards.

What is our cookie policy?

When you browse the mouttafarm.com site and its subdomains, cookies and trackers may be placed on your device by your browser or collected by our systems. For as long as they remain valid, they allow us to recognize your device on future visits. Partners or service providers of MOUTTA FARM, as well as third-party companies, may also place or collect cookies and trackers.

Some cookies and trackers are essential for secure browsing and for remembering your cart, your order, or your login details. Others are used to improve your user experience, offer services or deals that match your interests, or measure site traffic. All the purposes of the cookies and trackers used are detailed on our cookie management platform, accessible from any page of the mouttafarm.com site via the footer bar.

Only the issuer of a cookie or tracker can read or change the information it contains.

You can accept or refuse cookies and trackers at any time through our cookie management platform. Even if you have previously given your consent, you can withdraw it at any time.

What are your rights and how can you exercise them?

9.1 - Your rights

You have the following rights regarding your personal data:

• Access and correction: you can access your data and correct it if it is inaccurate.
• Objection and restriction: you can object to processing, particularly for marketing purposes, or request that processing be restricted in certain situations.
• Profiling: you can object to any automated processing intended to build a profile of you.
• Deletion: you can request that your data be deleted when it is no longer needed or where the law provides for it.
• Portability: you can obtain your data in a usable format when processing is based on your consent or a contract.
• Post-mortem instructions: you can specify how your data should be kept, deleted, or passed on after your death.
• Complaints: you can file a complaint with the CNIL (the French data protection authority) if you believe MOUTTA FARM is not handling your requests properly.
• Telemarketing: you can register for free on the Bloctel list to opt out of telemarketing calls.

You can exercise these rights at any time. We are committed to responding as quickly as possible and within one month at the latest, except in exceptional situations provided for by regulations, where an additional two months may apply.

9.2 - How to exercise your rights

You can exercise your rights as follows:

• by mail at the following address: FERME DU MOUTTA, 15 avenue Gay-Lussac – 64140 Lons (France);
• or through the contact form available on the "Contact Us" page of the site.

To ensure your request is handled quickly and securely, we may need certain information: last name, first name, email, mailing address, phone number, loyalty card number, etc. In some cases (right of access, portability, rights of heirs), you will be asked to provide proof of identity along with any relevant documents supporting your request.

For processing carried out by our service providers, you can also exercise your rights directly with them by mail, email, or online. A complete list of these providers is provided in the appendix.

Changes and Updates to the Personal Data Protection Policy 

This personal data protection policy may be changed or updated at any time. If changes are made, the revised version will be published on the mouttafarm.com website, along with the date of its last update.