Privacy Policy

1. Data Controller

Cook-e SAS ("the Company," "we," "us," or "our") (14 Rue de la Banque, 75002 Paris, France) is the data controller for personal data processed through incook-e.com. The Company operates a standalone hot food cabinet that uses vision and timing control to hold doneness without cook oversight, deployed primarily at transit hubs, offices, and late-night food operator locations across France.

You can contact us at [email protected] for any data-protection matter, including to exercise the rights described in this Policy.

2. Personal Data We Process

Because incook-e.com is a product information and early-access enquiry site for a hardware product, we process a limited set of personal data:

• Identity and contact data you submit through the early-access or contact forms (your name, business email address, company name, and type of operator location);
• Communications content in messages you send us regarding Cook-e deployment enquiries;
• Technical data collected automatically when you visit the site (IP address, browser type, operating system, pages visited, and referring URL);
• Usage and analytics data, where you have given prior consent through our cookie banner.

We do not collect payment card data, health data, biometric data, or any special-category data under Article 9 GDPR through this site.

3. Purposes and Legal Bases (Article 6 GDPR)

4. Recipients and Transfers

Personal data is shared only with processors acting on our behalf under Article 28 GDPR data-processing agreements. These include hosting infrastructure, transactional email delivery, and (where consented) analytics providers. Where data is transferred outside the EU/EEA, the Company relies on Standard Contractual Clauses (Article 46 GDPR) and assesses additional safeguards as required by the Schrems II ruling of the Court of Justice of the European Union.

We do not sell personal data to third parties or use it for purposes other than those listed above.

5. Retention

We retain personal data only for as long as necessary for the purposes described. Enquiry and early-access form data is retained for 24 months after last contact, after which it is securely deleted or anonymised. Server access logs are retained for 90 days. Where a legal obligation requires a longer retention period (for example, French accounting law for business correspondence), we retain data for that mandatory period only and restrict further processing.

6. Your GDPR Rights

As a data subject under the General Data Protection Regulation, you have the following rights with respect to personal data the Company holds about you:

• Right of access (Art. 15): confirm whether we process your data and obtain a copy;
• Right to rectification (Art. 16);
• Right to erasure / "right to be forgotten" (Art. 17), subject to limited exceptions;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20);
• Right to object (Art. 21), including to direct marketing without further conditions;
• Right not to be subject to automated decision-making (Art. 22). The Company does not engage in automated decision-making with legal or similarly significant effects.

To exercise any right, email [email protected]. We will respond within one calendar month, extendable by two further months for complex or numerous requests.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. For data subjects in France, the supervisory authority is the Commission nationale de l'informatique et des libertes (CNIL), 3 Place de Fontenoy, 75007 Paris (www.cnil.fr). A full list of EU/EEA supervisory authorities is available at edpb.europa.eu.

8. Cookies

We operate under a prior-consent model consistent with the ePrivacy Directive. Non-essential cookies (analytics, preferences) are not set until you give your consent through the cookie banner that appears on your first visit. See our Cookie Policy for a full breakdown of cookie categories, lifetimes, and how to manage your choices.

9. Security

The Company implements technical and organisational measures appropriate to the risk, including TLS encryption in transit, encrypted storage at rest, restricted access controls, and periodic security review. Because incook-e.com is primarily an informational and enquiry site, the attack surface for personal data is limited; however, no transmission over the internet can be guaranteed to be completely secure.

10. Changes to This Policy

Material changes to this Privacy Policy will be reflected by an updated "Last updated" date at the top of this page. Where the change affects how we process your data, we will, where required under GDPR, request renewed consent or provide direct notice.

11. Contact