Privacy policy — GDPR
PROVISIONAL VERSION — LEGAL REVIEW REQUIRED · 2026-10-14.2
This version is published provisionally. A qualified French legal review and completion of the outstanding information and operating arrangements are still required before sales open.
Controller and scope
BON ENTERPRISE SAS, 60 rue François Ier, 75008 Paris, is the intended controller for BON Online Shopping’s own processing. Privacy contact: ebon@bonenterprise.com. No appointed DPO is asserted. Processing by designer sellers and the payment provider must be classified according to their actual roles; this notice does not automatically describe them as mere processors.
Proposed data and purposes
To document for launch: account and authentication (identity, email, hashed password; performance of the requested service); ordering, delivery and after-sales (contact details, address, goods, payment references; contract); accounting and platform obligations (strictly necessary records; identified legal obligation); security and abuse prevention (technical logs; legitimate interest requiring assessment). Optional marketing requires a separate mechanism, an appropriate basis and simple withdrawal; acceptance of sales terms is not advertising consent. Required fields and the consequences of not supplying them must be explained at collection. The candidate does not store full card numbers through its own forms.
Recipients, retention and transfers
Access must be limited to authorised BON staff, the relevant seller, necessary service providers and authorities where required by law. Before publication, identify the actual host and providers, countries, roles, safeguards for transfers outside the EEA and how to obtain copies. Establish a purpose-by-purpose retention schedule distinguishing active records, legally necessary archives and deletion; periods have not yet been implemented and must not be represented as established. Order information must not be accessible to other sellers.
Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability, or object to processing. Consent may be withdrawn for the future without affecting prior lawfulness. Contact the address above; proportionate identity evidence may be requested where necessary. The normal response period is one month, with extensions possible under the legal conditions. You may complain to the CNIL.
Actual preview status
This local copy is for review without importing real customer records. Tests use fictitious data. Pages still load external resources from Google Fonts, jsDelivr and, depending on the page, Unsplash; the payment page uses Stripe.js. These requests may disclose technical information to the provider even without advertising cookies. Their necessity, recipients and transfers require assessment before publication; the cookie manager is not a filter for all network requests. No external AI service is active in this candidate. Historical log deletion and production retention periods remain separate work.