Privacy Policy
Last Updated: 1 September 2026
1. Who We Are
Bonvale UK Limited (company number 17142585), incorporated in England and Wales, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("Bonvale", "we", "us", "our"), is the data controller for personal data collected from customers in France through our website (bonvale.fr), mobile application, and related services (our "Services").
Because Bonvale UK Limited is established outside the European Union and offers goods to individuals in the Union, Article 27 of the GDPR requires us to designate a representative in the Union.
You may contact either us or our representative in the Union on all matters relating to the processing of your personal data. Requests relating to your personal data may also be sent to us at the contact details in Section 17.
We may share personal data with the Bonvale group and related entities as described in Section 6. Where data is transferred outside the European Economic Area, appropriate safeguards apply (see Section 7).
2. Personal Data We Collect
2.1 Data You Provide Directly
When you create an account, place an order, contact us, or use our Services:
- Identity: first name and surname, date of birth
- Contact: email address, telephone number, postal address
- Account: username, password (stored in hashed form), preferences
- Transaction: products purchased, order and returns history, payment method type (full card numbers are held by our payment provider, not by Bonvale)
- Communications: messages sent to our customer care team
- Marketing preferences: opt-in and opt-out choices for email, SMS, and push notifications
2.2 Data We Collect Automatically
When you visit our Website or use our App:
- Device and technical: IP address, browser type and version, operating system, device identifiers, time zone
- Usage: pages viewed, product pages viewed, search queries, clickstream, session duration, referral source
- Tracking: data collected via cookies, pixels, and similar technologies (see Section 5)
- Location: approximate location derived from IP address (we do not collect GPS location unless you grant App permission)
2.3 Data We Receive From Third Parties
- Payment providers: transaction status, fraud risk signals, payment verification data
- Logistics providers: delivery status, confirmation, address validation
- Meta Platforms: aggregated advertising performance data and, where you have consented, audience matching data via the Meta Pixel (see Section 5)
- Google: analytics and advertising performance data via Google Analytics and Google Ads (see Section 5)
3. How and Why We Use Your Personal Data
The table below maps each processing purpose to the lawful basis we rely on under the GDPR and our default retention period.
| Data Collected | Purpose | Lawful Basis (GDPR) | Retention |
|---|---|---|---|
| Name, contact, order and payment data | Processing your order: fulfilment, dispatch, returns | Contract performance (Art. 6(1)(b)) | 10 years from transaction (EU VAT obligations) |
| Account data | Creating and managing your account | Contract performance (Art. 6(1)(b)) | 3 years after last account activity |
| Contact, order data | Customer care and dispute resolution | Contract performance / Legitimate interests (Art. 6(1)(f)) | 3 years from last interaction |
| Email, phone, preferences | Transactional communications (confirmations, dispatch, returns) | Contract performance (Art. 6(1)(b)) | Duration of customer relationship |
| Email, phone, preferences | Marketing emails, SMS, and push notifications | Consent (Art. 6(1)(a)) and Article L34-5 CPCE | Until consent withdrawn, and at most 3 years after last contact |
| Browsing, purchase history | Personalised product recommendations | Legitimate interests (Art. 6(1)(f)) | 3 years from last activity |
| Device, browsing, and purchase data via the Meta Pixel and Google Analytics | Profiling for targeted advertising on Meta and Google | Consent (Art. 6(1)(a)) | Per Meta and Google terms; on our side: 25 months |
| IP, device, transaction data | Fraud detection, security, and abuse prevention | Legitimate interests (Art. 6(1)(f)) | 2 years |
| All categories | Legal obligations (tax, anti-money laundering, court orders) | Legal obligation (Art. 6(1)(c)) | As required by law (minimum 10 years for EU VAT records) |
| Aggregated, anonymised data | Analytics and business management | Legitimate interests (Art. 6(1)(f)) | Indefinite (no longer personal data) |
Our legitimate interests assessments are available on request from privacy@bonvale.com.
4. Marketing Communications
We send marketing communications (email, SMS, push notifications) only where you have given consent. You may withdraw your consent at any time:
- by clicking 'unsubscribe' in any marketing email;
- by replying STOP to any marketing SMS;
- by changing your notification preferences in your device settings or in your Bonvale account;
- by writing to us at privacy@bonvale.com.
Withdrawing your marketing consent does not affect transactional communications (order confirmations, dispatch, returns), which are sent under our contract with you.
France: Article L34-5 of the Code des postes et des communications électroniques
Direct marketing by electronic means requires your prior consent under Article L34-5 of the CPCE. If you are already a customer and the marketing relates to products similar to our own, we may contact you in reliance on the exemption applicable to existing customers; in that case, you may object free of charge and without difficulty at the time your contact details are collected and in every message we send you. In line with the CNIL's recommendations, we do not retain prospects' contact details for marketing purposes for more than 3 years from our last contact with you.
5. Cookies, Pixels, and Tracking Technologies
5.1 What We Use
Strictly Necessary Cookies
Essential for the Website to function: shopping basket, login, security, and fraud prevention. They cannot be disabled.
Analytics Cookies: Google Analytics
We use Google Analytics (Google LLC) to understand how visitors use our Website: pages visited, session duration, referral source, and device. This aggregated data helps us improve our Services. It is transferred to Google's servers, which may be located outside the European Economic Area (see Section 7). You may object via the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout or by refusing analytics cookies in our banner.
Advertising and Targeting Cookies: Meta Pixel
We use the Meta Pixel (Meta Platforms, Inc.) to measure the effectiveness of our advertising, build audiences, and track conversions. When active, it collects your IP address, browser data, page URL, and your actions on the Website (product views, purchases). This data is transmitted to Meta and used to serve you targeted advertisements on Facebook, Instagram, and the Meta Audience Network (retargeting). Meta may also use it for its own purposes in accordance with its privacy policy. We activate the Meta Pixel only with your consent, which you may withdraw at any time via your cookie preferences.
5.2 Consent Management
Storing information on your device, or accessing information already stored, requires your consent under Article 82 of the loi Informatique et Libertés, except where those operations are strictly necessary to provide the service you requested.
We use Shopify's native consent banner. On your first visit, it presents the categories of cookies in use. Non-essential cookies, including the analytics and advertising categories, are not set until you actively accept them. In line with the CNIL's requirements, refusing all non-essential cookies is as straightforward as accepting them, and continuing to browse does not constitute consent. Your choice is recorded with a timestamp and the version of this Policy in force at that time, so that we can demonstrate the validity of consent if required. If you refuse, we will not ask you again for at least 6 months, in line with the CNIL's recommendations.
You can review or change your preferences at any time via the "Cookie Settings" link in the footer. Withdrawing consent for a category takes effect immediately and the scripts that depend on it stop firing for your session.
5.3 Your Cookie Choices
Manage your preferences via our preference centre (footer), your browser settings, or the opt-out tools provided by Google and Meta. Restricting certain cookies may affect how the Website works.
6. Who We Share Your Personal Data With
We do not sell or rent your personal data. We share it only in the cases described below.
6.1 Service Providers
We share data with service providers acting under our instruction, including:
- Shopify Inc.: storefront platform, transactional emails, order notifications, and native cookie consent management.
- Shopify Payments and the payment and instalment payment providers offered at checkout in France: payment processing and fraud screening. Your full card details are held by the relevant provider, not by Bonvale.
- KEC and KLN: outbound logistics from our fulfilment warehouse and returns logistics to our EU returns warehouse.
- Local carriers responsible for final delivery in France.
- Loop Returns, Inc. (with EasyPost for return label generation): returns and exchanges portal.
- Gorgias, Inc.: customer support and ticketing.
- Klaviyo, Inc.: marketing emails, SMS, and push notifications.
- Amazon Web Services, Inc.: cloud infrastructure for our apps and integrations.
- Google LLC (Google Analytics): Website usage analytics.
- Meta Platforms, Inc. (Meta Pixel): advertising measurement and audience targeting, subject to your consent.
6.2 Legal and Regulatory Disclosure
We disclose personal data to authorities, courts, or regulators only where required to do so by law, a court order, or a regulatory direction. We will notify you of such disclosures where the law permits.
6.3 Mergers, Acquisitions, and Disposals
In the event of a merger, acquisition, or asset sale involving Bonvale UK Limited, your data may be transferred to the relevant entity. We will notify you and ensure that equivalent protections apply.
6.4 Group Companies
We may share data with the Bonvale group and related entities for the purposes set out in this Policy, including group-wide analytics, IT infrastructure, and customer support. All intra-group transfers outside the EEA are covered by an intra-group agreement incorporating the European Commission's Standard Contractual Clauses (see Section 7).
7. International Transfers of Personal Data
Bonvale UK Limited is established in the United Kingdom. Some of our service providers and group companies are located outside the European Economic Area, which means your personal data may be transferred to and processed in countries whose data protection laws differ from those of the EEA.
Where we transfer your personal data outside the EEA, we rely on the appropriate safeguards provided for in Chapter V of the GDPR, including:
- transfers to a country covered by a European Commission adequacy decision. Transfers to the United Kingdom, including to Bonvale UK Limited itself, are covered by the Commission's adequacy decision for the United Kingdom, which was extended on 19 December 2025 and applies until 27 December 2031;
- the European Commission's Standard Contractual Clauses, accompanied by a transfer impact assessment and any supplementary measures that may be necessary;
- the derogations for specific situations provided for in Article 49 GDPR, where applicable; and/or
- other approved safeguards, for example Binding Corporate Rules.
Transfers to service providers and group companies located outside the EEA in countries not covered by an adequacy decision are made under the Standard Contractual Clauses, accompanied by the corresponding transfer impact assessments. You may request a copy of the applicable mechanism by writing to privacy@bonvale.com.
8. How Long We Keep Your Personal Data
We retain your personal data only as long as necessary for the relevant purpose and to comply with our legal obligations.
| Data Category | Retention Period |
|---|---|
| Orders, transactions, and payments | 10 years from the date of the transaction (EU VAT obligations) |
| Account data | 3 years after the last activity or the closure of the account, whichever is later |
| Customer care communications | 3 years from the last interaction |
| Marketing preferences and consent records | Until consent withdrawn, plus 1 year (to demonstrate our compliance). Prospects' contact details: 3 years from the last contact, in line with the CNIL's recommendations |
| Fraud and security logs | 2 years from the relevant event |
| Cookies and tracking data | Cookie lifetime: 13 months maximum; data collected via cookies: 25 months maximum, in line with the CNIL's recommendations |
| Data retained for the purposes of proceedings (disputes, access requests, litigation) | Duration of the proceedings, plus the applicable limitation period |
| Anonymised or aggregated analytics data | Indefinite (no longer personal data) |
On expiry of the retention period, we securely delete or anonymise the data. Where immediate deletion is not possible (backups, for example), we isolate the data and restrict access to it until it is actually deleted.
9. How We Protect Your Personal Data
We implement technical and organisational measures to protect your data, including:
- encryption in transit (TLS/SSL) and at rest;
- access controls and role-based permissions;
- regular security assessments and penetration testing;
- data protection training for our teams;
- incident response procedures (see Section 10).
Payment card data is processed by our PCI-DSS certified payment provider. We do not store full card numbers. If you believe your account has been compromised, write to us immediately at privacy@bonvale.com.
10. Data Breach Notification
Where we become aware of a personal data breach likely to pose a risk to you, we will:
- investigate its nature and scope;
- notify the CNIL within the timeframes set out below;
- inform the individuals concerned without undue delay where the breach poses a high risk;
- document the breach and the measures taken.
France: Articles 33 and 34 of the GDPR
Under Article 33 GDPR, we must notify the competent supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals. Where the breach is likely to result in a high risk, we must also communicate it directly to the individuals concerned under Article 34.
Because Bonvale UK Limited has no establishment in the European Union, the one-stop-shop mechanism does not apply to us. Where the individuals concerned are resident in France, we notify the Commission nationale de l'informatique et des libertés (CNIL): cnil.fr.
11. Your Rights
Under the GDPR and the loi Informatique et Libertés, you have the following rights:
| Right | What It Means |
|---|---|
| Right of Access | Request a copy of the personal data we hold about you. We respond within one month (extendable by two further months for complex requests). |
| Right to Rectification | Ask us to correct inaccurate or incomplete data. Most account data can be updated directly in your account. |
| Right to Erasure | Ask us to delete your data where we have no legitimate reason to retain it, subject to our legal obligations (accounting and VAT records, for example). |
| Right to Restrict Processing | Ask us to suspend processing in certain cases, for example while you contest the accuracy of your data. |
| Right to Data Portability | Receive your data in a structured, machine-readable format, where it is processed by automated means on the basis of consent or contract. |
| Right to Object | Object to processing for direct marketing purposes (absolute right), to advertising profiling, or to processing based on our legitimate interests. Marketing objections are actioned immediately. |
| Right to Withdraw Consent | Withdraw your consent at any time where processing is based on it. Withdrawal does not affect the lawfulness of prior processing. |
| Right re Automated Decisions | Not to be subject to a decision based solely on automated processing producing legal effects or similarly significantly affecting you. We do not make such decisions at present. |
| Post-Mortem Directives | Under Article 85 of the loi Informatique et Libertés, you may issue general or specific directives concerning the retention, erasure, and communication of your data after your death, and designate a person responsible for carrying them out. |
To exercise any of these rights, write to privacy@bonvale.com or to our representative in the Union (Section 1). We respond within one month and may ask you to verify your identity. These requests are free of charge unless they are manifestly unfounded or excessive.
12. Complaints & Supervisory Authority
If you have a concern about how we handle your personal data, we ask that you contact us first at privacy@bonvale.com so we can address it directly.
You have the right to lodge a complaint with the French supervisory authority at any time:
- Commission nationale de l'informatique et des libertés (CNIL)
- Website: cnil.fr
You may also refer the matter to the supervisory authority of another Member State in which you work or in which the alleged infringement took place.
Under Article 21 GDPR, you may object at any time to profiling for targeted advertising purposes (including via the Meta Pixel and Google Ads) by writing to privacy@bonvale.com or through your cookie preferences.
13. Children's Privacy
Our Services are for individuals aged 18 and over. We do not knowingly collect data relating to minors. If you believe a minor has provided us with their data, write to privacy@bonvale.com and we will promptly delete it, unless retention is required by law.
14. Third-Party Links
Our Website and App may link to third-party sites. This Policy does not cover those sites and we are not responsible for their privacy practices.
15. Cookie Policy
What are cookies?
Cookies are small text files placed on your device when you visit our Website. They allow the site to remember your actions and preferences over time, and help us and our partners understand how visitors interact with our content. Similar technologies, including pixels and device identifiers, work in an equivalent way.
The cookies we use
We use three categories of cookies. The table below shows, for each cookie, who sets it, what it does, and how long it remains on your device.
Category 1: Strictly Necessary
These cookies are essential for the Website to function. They cannot be disabled and do not require consent.
| Cookie Name | Set By | Purpose | Duration |
|---|---|---|---|
_shopify_session |
Shopify | Maintains your shopping session, keeps you logged in, and secures payment | Session (deleted when browser closes) |
_shopify_y |
Shopify | Assigns a unique visitor ID used for analytics and personalisation within Shopify's platform | 1 year |
cart |
Shopify | Retains the contents of your shopping cart while you browse | 2 weeks |
secure_customer_sig |
Shopify | Verifies that you are logged into your account securely | 20 years |
_ab |
Shopify | Indicates whether you were directed to a particular storefront variant (used internally by Shopify) | 2 years |
_tracking_consent |
Shopify | Records your consent preferences, the categories accepted or rejected, and the date and version of the policy in force | 1 year |
Category 2: Analytics
These cookies help us understand how visitors use our Website: pages visited, session duration, and where visitors come from. The data is aggregated and is not used to identify you personally. These cookies are set only with your consent.
| Cookie Name | Set By | Purpose | Duration |
|---|---|---|---|
_ga |
Google LLC (Google Analytics 4) | Assigns a unique identifier to distinguish visitors and aggregate usage data | 13 months |
_ga_[ID] |
Google LLC (Google Analytics 4) | Maintains session state for a specific GA4 property | 13 months |
_gid |
Google LLC (Google Analytics 4) | Distinguishes users over a 24-hour session | 24 hours |
_gat |
Google LLC (Google Analytics 4) | Throttles the rate of requests sent to Google's servers | 1 minute |
Cookie lifetimes are capped at 13 months in line with the CNIL's recommendations. Google Analytics data is transferred to Google's servers, which may be located outside the European Economic Area. See Section 7 on international transfers.
You may object to Google Analytics tracking at any time via the Opt-Out Browser Add-on or by changing your preferences in our banner.
Category 3: Marketing and Advertising
These cookies are used to serve you targeted advertising based on your browsing and purchases on our Website, and to measure the effectiveness of our campaigns. They are set only with your consent.
| Cookie Name | Set By | Purpose | Duration |
|---|---|---|---|
_fbp |
Meta Platforms, Inc. | Identifies browsers for advertising measurement and retargeting via Facebook and Instagram (Meta Pixel) | 3 months |
_fbc |
Meta Platforms, Inc. | Stores the click identifier when you arrive at our Website via a Facebook or Instagram advertisement | 3 months |
fr |
Meta Platforms, Inc. | Used by Meta to deliver, measure, and improve targeted advertisements shown on its platforms | 3 months |
Meta Pixel data is transferred to Meta's servers in the United States. See Section 7 on international transfers and Section 5.1 for details of how the pixel operates.
Managing your preferences
You can review and change your cookie preferences at any time by clicking Cookie Settings in the footer. You can also:
- use your browser settings to block or delete cookies. Blocking strictly necessary cookies will affect how the Website works;
- object to Google Analytics via the Opt-Out Browser Add-on;
- manage your Meta advertising preferences at facebook.com/ads/preferences.
Withdrawing consent for analytics or advertising cookies takes effect immediately. It does not affect the lawfulness of processing carried out during the period when consent was valid.
Keeping this table up to date
We review this table whenever we add, change, or remove a tracking technology. The "last updated" date at the top of this Policy reflects the most recent revision. An automatically updated version of this table is also accessible from your preference centre.
16. Updates to This Policy
We may update this Policy to reflect changes in our practices, in the applicable regulations, or in our Services. The updated version is published with a new "last updated" date. For material changes, we will notify you by email or by a prominent notice on the Website before the change takes effect. Continued use of our Services after that date constitutes acceptance of the updated Policy.
17. Contact Us
For all queries, requests, and complaints relating to your personal data:
Email: privacy@bonvale.com
You may also contact our representative in the Union, whose details are set out in Section 1.
We aim to respond within one month. If our response does not satisfy you, you may lodge a complaint with the CNIL (see Section 12).
