Privacy Policy

1. Data controller

The data controller for personal data collected on baskio.fr and via the baskio service is FREYR, a French single-member limited liability company (EURL) registered with the Bordeaux Trade and Companies Register under SIREN number 931 953 483 (SIRET 931 953 483 00019), with share capital of €1,127,165, whose registered office is located at 19 rue du Sacré-Cœur, 33200 Bordeaux, France. Its NAF code is 66.30Z.

FREYR is managed by Maxence Coisne.

2. Data we collect

In providing the baskio service, we collect and process the following categories of personal data.

Identification and contact data. We collect your WhatsApp phone number, which is your primary identifier on the service. We also collect your first name to personalize our exchanges. You may optionally provide an email address. Your postal address is collected for the sole purpose of identifying the store closest to your home and offering you relevant drive-through grocery options.

Household composition. We collect the number of people in your household and, for each member, a portion size on a scale of 1 to 5 (from light eater to big eater). This lets us adapt the quantities in the menus we suggest. We do not collect the age of household members.

Special needs and dietary restrictions. We collect all information relating to your specific dietary needs: food allergies (peanuts, tree nuts, shellfish, etc.), intolerances (gluten, lactose, etc.), diets (vegetarian, vegan, halal, kosher, etc.), medical diets (diabetes, salt-free diet, etc.), baby-specific needs (diaper brand, infant formula brand and type, purée type, etc.), and any other personalised need you choose to tell us about.

Food preferences. We collect your favourite dishes, foods you want excluded, and your preferred level of cooking complexity. Your monthly grocery budget is also collected to tailor product suggestions.

Supermarket account credentials. To automatically fill your drive-through grocery cart, we collect your login credentials for your online grocery retailer. These credentials are always encrypted using the AES-256 standard via the Fernet protocol before storage. They are never stored in plain text and are only accessed while filling your cart.

Purchase history. With your permission, we import your purchase history from your drive account to refine our product and menu recommendations based on your actual buying habits.

Calendar data. If you choose to connect your calendar (via iCloud, Google Calendar or Outlook), we access it read-only to adapt your meal planning to your schedule (meals at home, absences, guests).

Browsing data. Via cookies placed on baskio.fr, subject to your prior consent through our tarteaucitron consent manager, we collect anonymised browsing data for statistical purposes (pages viewed, visit duration, device type).

3. Purposes of processing

Your personal data is processed for the following purposes: generating personalised weekly menus, tailored to your household composition, dietary restrictions, preferences and budget; automatically filling your cart with the drive-through retailer you have chosen; continuously improving the service, in particular by analysing your feedback and purchase history; producing anonymised statistics on how the service is used.

4. Legal basis for processing

Processing your data to provide the service is based on your consent, in accordance with Article 6(1)(a) of the General Data Protection Regulation (GDPR). You may withdraw this consent at any time by sending the command /delete on WhatsApp or by contacting us by email.

Processing your data for anonymised statistics is based on our legitimate interest in understanding and improving our service, in accordance with Article 6(1)(f) of the GDPR.

5. Retention period

Your personal data is kept for as long as your account is active. If you request deletion of your account, all of your data (including your supermarket account credentials) is deleted immediately and permanently.

If there is no interaction with the service for three years, your account and all of your personal data are automatically and permanently deleted, in line with the data minimisation principle. A warning message is sent to you 30 days before this automatic deletion; simply interacting with baskio during this period cancels it.

6. Sub-processors

In providing the service, we rely on the following sub-processors.

OpenAI is used to generate personalised menus. Data sent to OpenAI is anonymised: it never contains your name, phone number, or supermarket credentials.

Meta / WhatsApp handles delivery of messages exchanged between you and the baskio service. This processing is subject to Meta Platforms' terms.

Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) hosts the service's technical infrastructure.

Google Analytics is used to collect anonymised browsing statistics on baskio.fr, subject to your prior consent via tarteaucitron.

7. Transfers of data outside the European Union

Some of our sub-processors are based in the United States. These transfers are governed by the following safeguards.

Transfers to OpenAI are covered by standard contractual clauses adopted by the European Commission, guaranteeing an adequate level of protection for your data.

Transfers to Meta Platforms are covered by the EU-US Data Privacy Framework (DPF), which Meta has joined.

8. Your rights

Under the GDPR, you have the following rights over your personal data: the right of access, allowing you to confirm whether your data is being processed and to receive a copy of it; the right to rectification, allowing you to have inaccurate or incomplete data corrected; the right to erasure, allowing you to request deletion of your data; the right to portability, allowing you to receive your data in a structured, machine-readable format; the right to restrict processing; the right to object to the processing of your data.

You may exercise these rights at any time by sending the WhatsApp command my data (data export, Art. 15) or delete my account (erasure, Art. 17), or by emailing maxence.coisne@gmail.com. We commit to responding to your request within one month.

9. Cookies

baskio.fr uses the tarteaucitron consent manager to let you control cookies placed on your device.

The technical tarteaucitron cookie, which records your consent choices, is exempt from consent in line with CNIL recommendations, as it is strictly necessary for the consent manager to function.

Google Analytics (GA4) cookies are subject to your prior consent. They are only placed if you explicitly accept them via the tarteaucitron banner. They allow us to collect anonymised statistics on site traffic.

10. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Supermarket account credentials are encrypted using the AES-256 standard via the Fernet protocol. All communications between your browser and our servers are protected by the HTTPS protocol. Access to data is strictly limited to authorised personnel acting within their duties.

11. Data Protection Officer

For any question relating to the protection of your personal data, you may contact our Data Protection Officer at: maxence.coisne@gmail.com.

12. Complaints to the CNIL

If you believe that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority: www.cnil.fr.