Privacy Policy
Constellation RFB Limited trading as Nicolas Rouzaud, Maison de Haute Patisserie understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits this website, www.nicolasrouzaud.com (“Our Site”) and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.
This Policy explains how We process personal data when you visit Our Site or contact Us through it. It is an information notice, not a request to consent to all processing. Separate choices apply to optional Cookies and marketing.
1 Definitions and Interpretation
In this Policy the following terms shall have the following meanings:
| “Cookie” | means a small file stored on your device; this Policy also refers to similar technologies such as local storage. See Part 14 and Our Cookie Policy. |
|---|---|
| “Cookie Law” | means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003; |
2 Information About Us
Our Site is owned and operated by Constellation RFB Limited, registered in England under company number 14819224 and trading as Nicolas Rouzaud, Maison de Haute Patisserie. We are the controller of personal data processed for the purposes described in this Policy.
Registered address: 67 Brook Street, London, United Kingdom, W1K 4NJ.
VAT number: 492327575.
Data protection contact: Nicolas Rouzaud.
Email address: info@nicolasrouzaud.com
Postal address: 67 Brook Street London United Kingdom W1K 4NJ
3 What Does This Policy Cover
This Policy covers Our information website at https://www.nicolasrouzaud.com and enquiries made through it, including related correspondence. Our Site links to separate services, including Le Café’s Shopify store and The Connaught’s Slerp ordering service. Orders, customer accounts and payments made on those services are covered by the notices displayed there. Clicking a link does not mean that those services’ Cookies are used on Our Site. Where We receive an enquiry and pass it to a relevant destination, Part 10 explains the sharing involved.
4 What Is Personal Data
Personal data is defined by the UK GDPR and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
5 What Are My Rights
Under the Data Protection Legislation, you have the following rights, subject to the conditions and exceptions that apply to each right:
- The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 15.
- The right to access the personal data we hold about you. Part 13 will tell you how to do this.
- The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 15 to find out more.
- The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us using the details in Part 15 to find out more.
- The right to restrict (i.e. prevent) the processing of your personal data.
- The right to object to us using your personal data for a particular purpose or purposes.
- The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
- The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
- Rights relating to automated decision-making and profiling, where applicable. Please see Part 7.
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 15.
It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.
You may complain directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. You may also contact Us using Part 15; doing so first is not a condition of making a complaint to the regulator.
6 What Data Do You Collect and How
We collect the information described below according to how you use Our Site. The contact form asks for your first and last name, email address, subject and message; a telephone number is optional. Please provide only information relevant to your enquiry. We do not ask for payment card details, passwords or dates of birth through this form. Cookie information is in Part 14 and https://www.nicolasrouzaud.com/cookie-policy. Our Site is not directed at children, and We do not knowingly collect their data for marketing. Please do not send health or other sensitive information unless it is necessary for your request.
| Data collected | Source |
|---|---|
| First and last name, email address, optional telephone number, enquiry subject and message. | You provide these through the contact form or in correspondence. |
| Business details or other context relevant to an enquiry. | You may include these voluntarily in your message or correspondence. |
| Technical and usage information, including IP address, browser, device and pages visited. | Website delivery and security systems, and optional analytics subject to consent. |
| Privacy choices and, where applicable, marketing preferences. | Your choices in the consent interface or separate marketing communications. |
| Sensitive information included in an enquiry, such as allergies or accessibility needs. | Only if you choose to disclose it. Please limit the information to what is necessary; further safeguards may be needed before We use it. |
7 How Do You Use My Personal Data
Under the Data Protection Legislation, We must always have a lawful basis for using personal data. The following table describes how We will use your personal data, and our lawful bases for doing so:
| Purpose | Data used | Proposed lawful basis |
|---|---|---|
| Respond to general enquiries, press requests and collaboration proposals. | Identity, contact and relevant message content. | Legitimate interests in answering enquiries and managing business relationships. |
| Take steps you request before a possible contract. | Identity, contact and information necessary for the request. | Steps at your request prior to entering into a contract. |
| Operate, maintain and secure Our website and contact form. | Necessary technical information and submission data. | Legitimate interests in delivering a reliable service and preventing abuse. |
| Measure website use with Google Analytics. | Online identifiers and usage information. | Consent for optional analytics technologies and associated processing. |
| Record and respect privacy choices. | Consent and preference records. | Legal obligations where applicable; legitimate interests in respecting and demonstrating your choices. |
| Send marketing you separately opt into. | Name, contact details and marketing choices. | Consent, unless another lawful basis and the applicable electronic-marketing rules permit the specific communication. |
| Address a request involving health or other special category information. | Only the sensitive information necessary for the request. | An Article 6 basis and an applicable Article 9 condition are both required. Explicit consent may be appropriate, but merely volunteering the information is not sufficient by itself. |
| Comply with legal duties or manage disputes. | Relevant correspondence and records. | Legal obligation where applicable; legitimate interests in establishing, exercising or defending legal claims. |
Where you separately request or consent to marketing from Us, We may use your name, contact details and preferences for that purpose. Submitting an enquiry does not by itself subscribe you to marketing. You can withdraw consent or object to direct marketing at any time using the unsubscribe link in a message, where provided, or by contacting Us. Any other basis for electronic marketing must satisfy the applicable legal requirements.
Google Analytics and any optional tracking technologies are subject to the choices described in Our Cookie Policy. Data collected through online identifiers can be personal data even where reports presented to Us contain aggregated statistics.
Our contact form uses automated checks to help detect spam, including a hidden field and a check for unusually rapid submissions. These checks may block a suspected automated submission. If you cannot submit the form, please email info@nicolasrouzaud.com. We do not use these checks to make decisions about you that have legal or similarly significant effects.
We will only use your personal data for the purposes for which it was originally collected unless We reasonably believe that another purpose is compatible with that or those original purposes and need to use your personal data for that purpose. If We do use your personal data in this way and you wish Us to explain how the new purpose is compatible with the original, please contact Us using the details in Part 15.
If We need to use your personal data for a purpose that is unrelated to, or incompatible with, the purpose(s) for which it was originally collected, We will inform you and explain the legal basis which allows Us to do so.
In some circumstances, where permitted or required by law, We may process your personal data without your knowledge or consent. This will only be done within the bounds of the Data Protection Legislation and your legal rights.
8 How Long Will You Keep My Personal Data
We keep personal data only for as long as needed for the relevant purpose. The following criteria guide retention. If information becomes part of a contract, complaint or legal claim, the relevant legal and record-keeping requirements also apply. We review records and delete or anonymise information when it is no longer needed.
| Record category | Retention criteria |
|---|---|
| Contact enquiries and correspondence. | Until the enquiry and necessary follow-up are resolved, then only for a justified period for business records, complaints or claims. A fixed operational period and review point must be set. |
| Records relevant to contracts, accounting or legal duties. | For the applicable legal or justified claims period, starting from the relevant event. A blanket seven-year rule does not apply to every website visitor or enquiry. |
| Technical and security records. | Only for the period needed for delivery, security, troubleshooting and incident investigation, according to the provider’s settings and Our documented retention schedule. |
| Analytics and consent records. | Browser storage periods are described in the Cookie Policy. Analytics event data and consent evidence have separate retention settings which must be documented. |
| Marketing preferences, if applicable. | While you remain subscribed or another lawful basis applies. After opt-out, keep only necessary suppression information and justified evidence of consent. |
| Special category information. | Only as long as needed for the specific request and permitted purpose, unless a separate lawful requirement justifies retention. Limit access and avoid copying it unnecessarily. |
9 How and Where Do You Store or Transfer My Personal Data
Our Site uses Webflow for hosting and website functions, and Google Analytics for optional audience measurement. Our service providers and their subprocessors may process information outside the UK, including in the United States. The country from which you access the website does not determine where all processing takes place.
Where personal data is transferred outside the UK to a country without an applicable UK adequacy regulation, We use an appropriate lawful safeguard, such as approved contractual clauses with the UK Addendum or the UK International Data Transfer Agreement, as applicable. Any reliance on an adequacy arrangement is limited to transfers and recipients covered by it.
For Webflow’s processing framework, see https://webflow.com/legal/dpa. You may contact Us for information about the safeguards relevant to your data and how to obtain a copy, subject to appropriate redactions.
The security of your personal data is essential to Us, and to protect your data, We take a number of important measures, including the following:
- limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality;
- procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where We are legally required to do so;
10 Do You Share My Personal Data
We share personal data only where needed for the purposes described in this Policy, with appropriate safeguards. This can include service providers supporting Our website, enquiry handling and communications, as described below.
If We sell, transfer, or merge parts of Our business or assets, your personal data may be transferred to a third party. Any new owner of Our business may continue to use your personal data in the same ways that We have used it, as specified in this Privacy Policy.
In some limited circumstances, We may be legally required to share certain personal data, which might include yours, if We are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
Webflow provides Our hosting and website form functionality. Providers of email, IT support and website maintenance may process enquiries or technical data on Our behalf. Google provides the analytics service described in Our Cookie Policy, subject to your consent. Our consent-management interface uses Finsweet technology to manage privacy choices.
Where necessary to answer your enquiry, We may share relevant details with the destination, business partner or group company concerned. We limit the information shared to what is necessary and explain any additional use where required. An operator receiving information as a separate controller is responsible for its own processing and privacy notice. Where a provider processes information on Our behalf, We require appropriate contractual and security commitments. International transfers are addressed in Part 9.
11 How Can I Control My Personal Data
You can contact Us to exercise your rights or update your preferences. You can object to direct marketing at any time and use the unsubscribe instructions in marketing communications. Cookie choices are managed separately through the consent preferences panel in the footer.
12 Can I Withhold Information
You can browse Our Site without submitting an enquiry. If you use the contact form, the required fields help Us understand and answer your request; the telephone field is optional. You may also contact Us by email. Technical data necessary to deliver and protect the website may still be processed when you browse.
You may refuse optional Cookies or withdraw consent through the consent preferences panel. See Part 14 and https://www.nicolasrouzaud.com/cookie-policy.
13 How Can I Access My Personal Data
If you want to know what personal data We have about you, you can ask Us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
You may make a subject access request verbally or in writing. The email and postal details in Part 15 can help you contact Us. Where necessary, We may ask for reasonable information to confirm your identity.
There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover Our administrative costs in responding.
We respond without undue delay and normally within one month, subject to adjustments permitted by law, for example where necessary identity verification or clarification is outstanding. If a request is complex or you have made several requests, the law may allow up to two additional months. We will explain an extension and its reasons within the applicable initial response period.
14 How Do You Use Cookies
Our Site uses Cookies and similar technologies to manage privacy preferences and, with consent, measure website use through Google Analytics. Online identifiers and browsing information may constitute personal data.
We ask for your consent before using optional analytics, personalisation or advertising Cookies and similar technologies. Continuing to browse, closing a notice or reading this Policy does not constitute consent. You can refuse optional Cookies and continue to use Our Site. Strictly necessary storage used to remember your privacy choices does not require consent.
You can reopen the consent preferences panel from the footer of Our Site. Choose “REJECT ALL” to decline optional categories, “ACCEPT ALL” to allow them, or select individual categories and choose “Save Preferences”. You may change or withdraw your consent at any time. Your choices apply to the browser and device you use; you may need to choose again on another device or after clearing browser data. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
For provider details, purposes and storage durations, see Our Cookie Policy at https://www.nicolasrouzaud.com/cookie-policy. That policy is the reference for the detailed inventory, so that two conflicting lists are not maintained.
15 How Do I Contact You
To contact Us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Nicolas Rouzaud):
Email address: info@nicolasrouzaud.com
Postal address: 67 Brook Street, London, United Kingdom, W1K 4NJ.
16 Changes to this Privacy Policy
We may review and update this Privacy Policy from time to time to ensure continued compliance with the law and best practice. This may be necessary, for example, if the law changes, or if We change Our business in a way that affects personal data protection.
Updates will be posted on Our Site. Where required, We will provide additional information or obtain fresh consent before introducing a new consent-based purpose. Continued browsing does not constitute acceptance of a new processing purpose. Review draft prepared on 23 September 2026; the publication date must be set when the final version is approved.
