Privacy Notice 

 

Cocoa Valley Suisse SA, a company of the Cocoa Valley Swiss Group SA (hereinafter “we,” “our,” or “us”), Route du Stand 19, CH-1260 Nyon, is responsible for the collection and processing of personal data. We thank you for visiting and using our websites and social media platforms. We respect your privacy and are committed to the utmost transparency regarding how we collect, process, and share your personal data. This privacy notice informs you about how we process personal data that we collect from you, that you provide to us, or that we collect from other sources, including during your interactions with us, whether in person, by phone at 0848 08 08 18, by email at info@cocoavalley.ch, when you visit our website https://cocoavalley.ch, or when you visit our social media pages. As the data controller, we establish this privacy notice to:

• Provide our headquarters with a list of the personal data we collect from you, in our stores, and on our online sales platform;
• Explain why we process (e.g., collect, use, store, share) this data;
• Specify the legal bases on which we rely to process this data;
• Identify with whom it is shared and where it is transferred;
• Present the security measures we take to protect your personal data;
• Describe your rights regarding your personal data and how you can exercise them.

 

What Data Do We Collect? 

We may collect your personal data when you interact with us, including through the website https://cocoavalley.ch, our social media platforms, by email, or when you visit our headquarters, factory, stores, or events. When you contact us, we collect, as contact details, your name, email address, phone number, physical address, and communication metadata such as your IP address, timestamp, and potentially geolocation details. When you create an account on our website https://cocoavalley.ch or log into an existing account, we collect identification information such as username, account ID, as well as authentication information such as passwords and security question answers. If you log into our website using your social media accounts, we may also collect identification and authentication information for those accounts. When you create an account on our website, you have the option to provide profile information that we will subsequently process. In addition to contact details, profile information may include language preferences, profile pictures, gender, age, relationship status, as well as interests and hobbies. When you subscribe to our communication channels, we may collect information about your preferences or interests, considering the nature of your subscription and the full range of products we offer. We may also collect other information regarding your language, age, gender, location, lifestyle, or consumption preferences. When you prepare or order our products, add items to your cart, or purchase our goods, we collect transaction data such as item choices and payment information (e.g., credit card or bank account numbers), delivery address, billing address, and place of purchase, as well as your contact details (email address) if applicable. When you book a space or organize an event with us (seminar rooms, factory tours, training, tastings, or other special events), we collect booking information, namely contact details, special requests, your preferences or interests, as well as transaction information. Based on event details, we may collect other information such as your name and contact details or information about other event participants. When you visit our website, we collect various data including IP address, location, browser type, operating system, source, visit duration, pages viewed, abandoned carts, etc., as usage information. Please consult our Cookie Notice for further information. When you visit our premises or stores, we may collect identification information such as license plates, photographs or video recordings of you, or information from your passport, ID card, or driver’s license. When you send us a spontaneous application or respond to a job offer, we may collect professional information such as career history, schools attended, references, or certifications. We collect information directly from you. We may also collect certain personal information about you, such as contact and identification details, when friends or family members purchase products online or in our stores to have them delivered to your address or to book an event on your behalf. We also use cookies and other tracking technologies (pixels, web beacons, and APIs) that collect certain types of information when you visit our website or open our emails, such as IP addresses, location, device and browsing preferences, operating system, source, visit duration, pages visited, etc. For more information, please consult our Cookie Notice. We may also collect personal data from third-party data aggregators (e.g., Google), public sources, and social media platforms. This information may include personal data from your social media profile, data that you authorize the network to share with us in accordance with their rules.

 

On What Legal Bases Do We Process Your Personal Data? 

The processing of your personal data is lawful provided there are legal bases for doing so.

We rely on four legal bases for collecting and processing your data:

Processing necessary for the performance of a contract or pre-contractual measures

When you enter into a business relationship with us, for example by requesting information, contacting us, etc., we process your contact details on a pre-contractual or contractual basis. Furthermore, if you decide to open an account on our website, we collect and process identification and authentication information for the same reasons. If you book a space or an event, we will also process booking information for the same reasons. Additionally, transaction information will be processed within the framework of our business relationship. Finally, if you respond to a job offer or send us an application, your professional information will also be processed.

Processing based on your consent

If you subscribe to our communication channels and promotional materials, such as the newsletter or our mailing list, you may specify your preferences or interests, or create a user profile. In this case, we will explicitly ask for your consent to process your personal data. Please note that you can unsubscribe or withdraw your consent at any time by contacting us at info@cocoavalley.ch. For consent-related questions regarding cookies, please consult here.

Processing necessary for the purposes of our legitimate interests or those of a third party:

Although as a customer you may be engaged in a contractual relationship for a specific product or service, we may wish to inform you of different but related offers that may interest you. In this case, it is in the legitimate interest of our company and yours that we process your contact details, preferences and interests, profile, usage data, as well as transaction information such as your purchase history. Please note that in this case, you have the right to object to the processing by contacting us at info@cocoavalley.ch. We also process identification information to ensure the security of our premises, IT systems, as well as our staff and customers.

Processing necessary to comply with a legal obligation

As a company, we have legal obligations under national and international law. To fulfill our obligations, we process your personal data for compliance, record-keeping, or for tax, employment, or security reasons.

 

With Whom Do We Share Your Personal Data and Where Is It Transferred? 

We do not sell your personal data to third parties.

We transfer your personal data to the European Union and Switzerland, as well as to countries for which an adequacy decision has been made or where a comparable level of data protection is ensured by additional measures.

If necessary, we share personal data within the Cocoa Valley Swiss Group SA (including the companies listed in the appendix) to optimize business processes and task allocation. This is done for a specific purpose and in accordance with applicable laws and requirements.

We do not transfer your personal data outside the European Union and Switzerland, or to countries subject to an adequacy decision.

We may share your personal data with certain suppliers (such as our IT hosting company, our online store, or our billing company, the call center, and the credit card payment service) and our marketing and communication agencies (e.g., advertising agency, development agency, CRM services, and newsletter publishing and distribution services), or with authorities.

Most of our suppliers are located in the European Union, the United Kingdom, and Switzerland.

Some of our suppliers are also located in Cameroon and China. It is important to specify that your personal data will not be transferred to these territories. These suppliers do not participate in the processing of our customers’ personal data and do not have access to it.

Our host is Infomaniak Network SA (https://infomaniak.com), whose headquarters are in Geneva, Switzerland.

We work with Stripe, Inc., headquartered in Dublin, Ireland, for our payment services. Stripe Services Agreement — Switzerland – see here.

We also use Google Analytics (GA) and other tools offered in its suite, which may result in data transfers to the United States. For more information on GA and how to disable it, please consult here.

The third-party tools used can be found in the Plugins and Tools chapter.

We may also use plugins on our website that link to social media platforms. The use by the third-party platform of the information collected from you (or authorized by you) is governed by its own privacy policy and your settings on the service. If you do not wish for a third-party social network platform to attribute the data collected via our website to your account on that social network, you must log out of the relevant social network site before visiting our website.

 

What Security Measures Are in Place for Your Personal Data? 

We take appropriate technical and organizational measures to secure your personal data and prevent its loss, misuse, or alteration.

When the personal data we process is no longer necessary for the purposes for which it was collected, or to meet legal obligations, it is securely deleted or destroyed.

Our website includes links to third-party websites. We have no control over the privacy policies and practices of these third parties and cannot be held responsible for them. It is your responsibility to inquire about the privacy policies and practices of these third parties.

 

What Are Your Rights and How Can You Exercise Them?

You can exercise your rights at any time by contacting us at: info@cocoavalley.ch.

Your rights regarding your personal data are as follows:

• You have the right to be informed about how your personal data is processed and to access your personal data at any time by contacting info@cocoavalley.ch;
• You have the right to correct your personal data or to obtain the deletion of your personal data under certain conditions;
• You have the right to restrict the processing of your personal data under certain conditions and, in the case of legitimate interests, you can object to their processing;
• You can withdraw your consent at any time;
• You have the right to data portability, i.e., to receive your personal data in a structured, commonly used format and to transmit this data to another controller without hindrance from us;
• If you are not satisfied with how we process your personal data, you have the right to lodge a complaint with a supervisory authority;
• You can also limit the use of tracking technologies such as cookies by configuring your browser to warn you before accepting them or to refuse them.

If you believe that we are not respecting your rights or fulfilling our obligations, you can lodge a complaint with your data protection authority at any time.

We reserve the right to make changes or corrections to this privacy notice. Please consult this page regularly to be aware of these changes and corrections, as well as any new information.

Plugins and Tools

 

Google

We use the Google tools listed below. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data transfer to the United States is based on the Standard Contractual Clauses of the European Commission. Details can be found here.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing in the United States. Each company certified under the DPF commits to adhering to these data protection standards. For more information, please contact the provider at the following link.

Order Processing

We have entered into an order processing contract with Google and fully apply the strict legal requirements when using Google services.

You can find more information on how Google processes user data in Google’s Privacy Policy.

Google Tag Manager

Google Tag Manager is a tool that allows us to use tracking or statistical tools and others on our website. Google Tag Manager itself does not create user profiles, store cookies, or perform independent analysis. It is used solely for the administration and distribution of the integrated tools through it. However, Google Tag Manager collects your IP address, which may also be transmitted to Google’s parent company in the United States.

The use of Google Tag Manager is based on our legitimate interest. If corresponding consent has been requested, processing is carried out exclusively on the basis of consent. Consent can be revoked at any time.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing in the United States. Each company certified under the DPF commits to adhering to these data protection standards. For more information, please contact the provider at the following link.

Google Analytics

Google Analytics allows the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, dwell time, operating systems used, and user origin. These data are summarized in a user ID and assigned to the respective device of the website visitor.

Furthermore, with Google Analytics, we can, among other things: record your mouse movements and clicks and scrolls. Additionally, Google Analytics uses various modeling approaches to supplement the collected data sets and uses machine learning technologies in data analysis.

Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the United States and stored there.

The use of this service is based on your consent and can be revoked at any time.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing in the United States. Each company certified under the DPF commits to adhering to these data protection standards. For more information, please contact the provider at the following link.

Browser Plugin

You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link.

Google Optimize

Google Optimize allows us to optimize our website by conducting tests (A/B testing) and website personalization. For this purpose, Google Optimize processes the IP address of website visitors. The personal data collected may then be processed by other analytics tools.

The use of Google Optimize is based on our legitimate interest.

If corresponding consent has been requested, processing is carried out exclusively on the basis of consent, insofar as the consent covers the storage of cookies or access to information on the user’s terminal device (e.g., for device fingerprinting). Consent can be revoked at any time.

Order Processing

We have concluded an order processing contract (AVV) for the use of the aforementioned service. This is a contract required by data protection law, which ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with applicable data protection laws.

We use the following host:

Infomaniak Network SA
Rue Eugène Marziano 25
1227 Les Acacias (GE)

Order Processing

We have concluded an order processing contract with the aforementioned provider. This is a contract required by data protection law, which ensures that it processes the personal data of our visitors only in accordance with our instructions and in compliance with applicable data protection laws.

Our Social Media Presence

We maintain publicly accessible profiles on social networks. The individual social networks we use can be found below.

Social networks such as Facebook, Twitter, etc. can generally comprehensively analyze your user behavior when you visit their website or a website with integrated social media content (e.g., advertising buttons or banners). When you visit our social media pages, numerous data processing operations related to data protection are triggered. In detail:

If you are logged into your social media account and visit our social media page, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, your personal data may also be collected if you are not logged in or do not have an account on the corresponding social media portal. In this case, this data is collected, for example, via cookies stored on your device or by collecting your IP address.

Based on the data collected in this way, the operators of social media portals can create user profiles in which their preferences and interests are stored. This allows you to see interest-based advertising inside and outside of your social media presence. If you have an account on the social network, interest-based advertising can be displayed on any device on which you are logged in or have logged in.

Legal Basis

Our social media presence aims to ensure the widest possible presence on the Internet. This is a legitimate interest. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks.

Responsibility and Assertion of Rights

If you visit one of our social media pages (e.g., Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can protect your rights (information, correction, deletion, restriction of processing, data portability, and complaint) both against us and against the operator of the respective social media portal (e.g., Facebook).

Please note that despite the joint responsibility with the operators of the social media portals, we do not have full influence over the data processing operations of the social media portals. Our options depend on the corporate policy of the respective provider.

Retention Period

The data collected directly from us via social media presence will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage, or the purpose for data storage no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – especially retention periods – remain unaffected.

We have no influence on the retention period of your data, which is stored by the operators of social networks for their own purposes. For more details, please contact the operators of the social networks directly (e.g., in their privacy policy, see below).

Your Rights

You have the right to receive information about the origin, recipient, and purpose of your stored personal data at any time and free of charge. You also have the right to object, the right to data portability, and the right to lodge a complaint with the competent supervisory authority. Furthermore, you can request the correction, blocking, deletion, and, under certain conditions, the restriction of the processing of your personal data.

Individual Social Networks

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter Meta). According to Meta, the data collected will also be transferred to the United States and other third countries.

We have signed an agreement with Meta on joint responsibility for data processing (Controller Addendum). This agreement defines the data processing operations for which we or Meta are responsible when you visit our Facebook fan page. This agreement can be viewed at the following link.

You can adjust your advertising settings independently in your user account. Click on the link below and log in.

Data transfer to the United States is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here.

Details can be found in Facebook’s Privacy Policy.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing in the United States. Each company certified under the DPF is required to comply with these data protection standards. For more information, please contact the provider at the following link.

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Data transfer to the United States is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here.

Details on the processing of your personal data can be found in Instagram’s Privacy Policy.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing in the United States. Each company certified under the DPF is required to comply with these data protection standards. For more information, please contact the provider at the following link.

LinkedIn

We have a LinkedIn profile. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you wish to disable LinkedIn advertising cookies, please use the following link.

Data transfer to the United States is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here and here.

Details on the processing of your personal data can be found in LinkedIn’s Privacy Policy.

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on the processing of your personal data can be found in YouTube’s Privacy Policy.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards for data processing in the United States. Each company certified under the DPF is required to comply with these data protection standards. For more information, please contact the provider at the following link.

Our Video and Surveillance Systems

You have visited us and seen a video camera or similar device. This could have been in the Cocoa Valley factory, in the immediate vicinity of the main sites, or in one of our stores.

We wish to inform you about the data processing and provide you with all relevant information.

Vicinity of Our Main Sites

In the immediate vicinity of our production sites, the entrance and parking areas or the external shell are monitored. This is done in particular to meet our high food safety requirements and the associated legal requirements of various target markets.

We will clearly indicate any video surveillance at the entrance to the monitored area – by means of signage.

You can find the respective legal basis as well as the possible data retention period from the signage.

If you have detailed questions, please contact our Data Protection Officer directly at info@cocoavalley.ch.

Cocoa Valley Swiss Group SA, November 2025

Appendix 1

• Cocoa Valley Suisse SA: Route du Stand 19, 1260 Nyon – Switzerland.
• Farm to Bar: Route du Stand 19, 1260 Nyon – Switzerland.
• Ngassam Farm: 671 Avenue Douala Manga Bell, 21101 Douala – Cameroon.