BANDEJA SHOP PRIVACY POLICY (GDPR)

Last updated: October 22, 2026

BANDEJA SHOP places particular importance on protecting personal data and respecting the privacy of users of its websites.

As part of its e-commerce activities, BANDEJA SHOP collects and processes certain personal data, particularly when users create a customer account, place an order, subscribe to a newsletter, or use its services.

In accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and applicable French data protection legislation, BANDEJA SHOP undertakes to collect only the data necessary for the intended purposes, ensure its confidentiality, and inform users of their rights.

This Privacy Policy explains what data is collected, how it is used, with whom it may be shared, and how users can exercise their rights.

1. Collection of Personal Data

When using BANDEJA SHOP websites, including their different language versions (Bandeja-shop.com/fr/, Bandeja-shop.com/en/, Bandeja-shop.com/de/, Bandeja-shop.com/es/, Bandeja-shop.com/it/, Bandeja-shop.com/pt/ and Bandeja-shop.com/se/), BANDEJA SHOP may collect personal data relating to users.

Data Controller:

Company: BANDEJA SHOP – SAS
Antibes Trade and Companies Register (RCS): 929 857 555
Registered office: 181 Chemin du Puissanton, 06220 Vallauris, France
Trading name: BANDEJA SHOP

Web Hosting:

BANDEJA SHOP websites are hosted by:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany
Website: https://www.hetzner.com

Categories of Data Collected

Profile and Contact Information:

First name, last name, email address, telephone number, postal address, date of birth where necessary, and any information voluntarily provided by the user.

Order-Related Information:

Customer number, order number, purchased products, transaction amounts, payment methods used, delivery and billing addresses, payment and delivery statuses, return requests, reviews, complaints, and communications with customer service.

Payments may be processed by specialized payment service providers. BANDEJA SHOP does not store complete payment card details.

Technical and Browsing Data:

When visiting our websites, certain technical information may be collected:

IP address.
Date and time of connection.
Pages and content viewed.
Referring website address.
Browser type and operating system.
Type of device used.
Information relating to browsing activity and interactions with the website.
Cookies and other technical or advertising identifiers, depending on the user's consent preferences.

Certain data may also be used to ensure website security, detect fraudulent behavior, and prevent unauthorized access.

2. Purposes and Legal Bases for Data Processing

Personal data is collected and used for the following purposes:

Order and Customer Relationship Management:

Creation and management of customer accounts.
Processing, payment, preparation, and delivery of orders.
Management of returns, refunds, and warranties.
Handling customer service requests.
Management of complaints and after-sales service.

These processing activities are primarily based on the performance of a contract with the user or on pre-contractual measures.

Administrative Management and Legal Obligations:

Issuing invoices.
Retaining accounting documents.
Complying with tax and regulatory obligations.

These processing activities are based on BANDEJA SHOP's applicable legal obligations.

Security and Fraud Prevention:

Securing transactions.
Preventing fraudulent activities.
Protecting customer accounts.
Detecting suspicious access or behavior.

These processing activities may be based on BANDEJA SHOP's legitimate interest in protecting its business and customers, subject to the rights and freedoms of the individuals concerned, or on a legal obligation where applicable.

Statistics and Service Improvement:

Analyzing website traffic.
Studying browsing behavior.
Measuring commercial performance.
Improving website usability and functionality.

The use of cookies or tracking technologies that are not exempt from consent requirements is subject to the user's prior consent.

Marketing Communications and Advertising:

Sending newsletters and promotional offers.
Presenting offers tailored to users' interests.
Measuring advertising campaign performance.
Displaying personalized or non-personalized advertisements.
Conducting advertising remarketing campaigns.

These activities are carried out in accordance with applicable marketing regulations and, where necessary, after obtaining the user's consent.

Users may unsubscribe from electronic marketing communications using the unsubscribe link included in the relevant messages.

3. Fraud Prevention

To secure transactions carried out on its websites, BANDEJA SHOP implements fraud prevention and detection measures.

These measures may include:

Verifying certain information provided when placing an order.
Requesting additional supporting documents in cases of suspected fraud, within the limits permitted by applicable regulations.
Checking the consistency of payment and delivery information.
Temporarily blocking a transaction or account showing serious indications of fraudulent activity.

The data used for these purposes is limited to the information necessary for risk prevention and the protection of users and BANDEJA SHOP.

4. Recipients of Personal Data

BANDEJA SHOP does not sell its customers' personal data to third parties.

However, data may be shared with service providers and partners when necessary to provide services, operate the website, or fulfill the purposes described in this Privacy Policy.

These recipients may include:

Authorized BANDEJA SHOP internal departments: sales, administration, accounting, IT, logistics, and after-sales service.
Payment service providers and banking institutions.
Carriers and logistics providers responsible for preparing and delivering orders.
Web hosting, maintenance, and IT security providers.
Electronic communication and newsletter management service providers.
Audience measurement, statistical analysis, and digital advertising service providers, including Google, where the relevant processing activities are authorized.
Administrative or judicial authorities when required by law.

Service providers acting as data processors are required to comply with their obligations regarding personal data protection.

Certain partners may also process data as independent data controllers, in accordance with their own privacy policies.

Where personal data is transferred outside the European Economic Area, BANDEJA SHOP ensures that such transfers are based on an appropriate legal mechanism, including an adequacy decision or suitable contractual safeguards, where required.

5. Data Security

BANDEJA SHOP implements technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction.

Depending on the systems concerned, these measures include:

Securing data exchanges.
Controlling access to information systems.
Restricting access to authorized personnel only.
Monitoring and protecting IT infrastructure.
Implementing backup and recovery procedures.
Maintaining and updating systems.

BANDEJA SHOP ensures that its security measures are appropriate to the risks associated with its data processing activities.

6. Cookies and Other Tracking Technologies

6.1. What Is a Cookie?

A cookie is a small file stored on a user's device when visiting a website.

Cookies and similar technologies make it possible to remember certain preferences, maintain browsing sessions, measure website usage, or provide tailored content and advertisements.

Certain cookies or identifiers may allow a browser, device, or user to be recognized directly or indirectly.

6.2. Categories of Cookies Used

Strictly Necessary Cookies:

These cookies enable the website and its essential features to function properly, including:

Shopping cart management.
Maintaining user sessions.
Customer account authentication.
Securing transactions.
Remembering privacy preferences.

These cookies do not require consent when they are strictly necessary to provide the service requested by the user.

Analytics and Audience Measurement Cookies:

These cookies help analyze website traffic, pages viewed, and visitor interactions in order to improve performance and user experience.

BANDEJA SHOP may use services such as Google Analytics for these purposes.

Where these cookies do not qualify for an exemption under applicable regulations, their use is subject to the user's prior consent.

Advertising and Personalization Cookies:

BANDEJA SHOP may use cookies, advertising identifiers, and similar technologies to measure the effectiveness of its advertising campaigns and display personalized or non-personalized advertisements.

With the user's consent, these technologies may be used to:

Analyze interactions with advertisements.
Measure advertising conversions.
Display advertisements tailored to users' interests.
Present advertisements based on products viewed.
Conduct remarketing campaigns.
Limit the repetition of certain advertisements.

Non-essential advertising cookies are subject to the user's prior consent.

6.3. How Google Uses Personal Data

As part of its audience measurement and digital advertising activities, BANDEJA SHOP uses services provided by Google, particularly to analyze the performance of its website and advertising campaigns.

Subject to the user's consent where required, Google may collect and process certain personal data, such as cookies, advertising identifiers, technical device information, and browsing data.

This information may be used to:

Measure website traffic and interactions.
Evaluate the effectiveness of advertising campaigns.
Measure advertising-related conversions.
Display personalized or non-personalized advertisements.
Personalize advertisements based on users' interests and interactions, where they have given their consent.

To understand how Google uses personal data collected when you visit websites or use applications that rely on its services, please refer to Google's official information page:

How Google Uses Personal Data – Google's Business Data Responsibility

Google's use of personal data is also governed by its own privacy policies and the consent preferences expressed by users.

6.4. Managing Cookie Consent

When visiting the website for the first time, users are informed about the use of cookies and other tracking technologies through a consent banner.

This banner allows users to:

Accept non-essential cookies.
Reject non-essential cookies.
Customize their preferences according to the purposes offered.

Cookies requiring consent are not stored or accessed before valid consent has been obtained from the user.

Rejecting non-essential cookies does not prevent access to the website's essential features, including browsing products and placing orders.

Users may modify or withdraw their consent at any time using the cookie preference management tool available on the website.

They may also configure their browser to restrict or delete cookies stored on their device. However, browser settings do not replace the consent mechanism provided by BANDEJA SHOP.

7. Consent and Legal Bases

The processing of personal data by BANDEJA SHOP is based on the legal grounds provided for under the GDPR, including:

Performance of a contract, for order and customer account management.
Compliance with legal obligations, particularly accounting and tax requirements.
Legitimate interests, particularly for service security and fraud prevention, where applicable.
Consent, particularly for certain cookies, ads personalization, and certain marketing communications.

Where consent constitutes the legal basis for processing, it must be freely given, specific, informed, and unambiguous.

Users may withdraw their consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Creating a customer account or placing an order does not, in itself, constitute consent to the use of personal data for advertising purposes.

8. Right of Access and Rectification

In accordance with the GDPR and applicable French data protection legislation, every user has rights regarding their personal data.

Users may request access to their personal data, its rectification, erasure, or the restriction of certain processing activities, under the conditions provided by applicable regulations.

To exercise these rights, users may contact BANDEJA SHOP:

Through the Contact Form:

Users can submit their requests through the "Contact" section of the BANDEJA SHOP website by selecting the subject relating to personal data protection or privacy.

By Post:

BANDEJA SHOP
181 Chemin du Puissanton
06220 Vallauris
France

To protect personal data, proof of identity may be requested only where there is reasonable doubt about the identity of the person making the request.

BANDEJA SHOP undertakes to respond to requests within the time limits established by applicable regulations.

9. Supervisory Authority and CNIL

In France, the authority responsible for overseeing compliance with personal data protection regulations is the Commission Nationale de l'Informatique et des Libertés (CNIL), the French Data Protection Authority.

Any person who believes that their personal data protection rights have not been respected may submit a complaint to the CNIL.

Official website: https://www.cnil.fr

10. Data Retention Periods

BANDEJA SHOP retains personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to applicable legal retention obligations.

Retention periods vary depending on the nature of the data and the processing activities concerned.

Customer Account Data:

Data is retained for the period necessary to manage the commercial relationship and is subsequently archived or deleted in accordance with legal obligations and the retention periods established by BANDEJA SHOP.

Order and Billing Data:

Accounting documents and supporting records are retained for the periods required by applicable regulations, including ten years for accounting documents subject to this obligation.

Data Used for Marketing Purposes:

Such data is retained in accordance with the retention periods applicable to marketing activities and commercial relationships, subject to the exercise of users' rights.

Cookies and Advertising Identifiers:

Their retention periods depend on their purpose and the settings of the services concerned.

Users' cookie preferences are retained for an appropriate period to avoid requesting consent excessively.

Security and Fraud Prevention Data:

Such data is retained for the period necessary to manage risks, incidents, and any applicable legal obligations.

At the end of the applicable retention periods, data is deleted, anonymized, or archived where continued retention is legally justified.

11. Users' Rights Regarding Personal Data

In accordance with applicable regulations, users have the following rights:

Right of Access: To obtain confirmation that their personal data is being processed and to access that data.
Right to Rectification: To request the correction of inaccurate or incomplete personal data.
Right to Erasure: To request the deletion of their personal data where the legal conditions are met.
Right to Restriction of Processing: To request the temporary restriction of certain processing activities.
Right to Object: To object to certain processing activities, particularly those carried out for direct marketing purposes.
Right to Data Portability: To receive relevant personal data in a structured, commonly used format, in the cases provided for under the GDPR.
Right to Withdraw Consent: To withdraw previously given consent at any time.
Right to Lodge a Complaint: To submit a complaint to the CNIL or another competent supervisory authority.

Users may also establish instructions regarding the retention, deletion, and disclosure of their personal data after their death, in accordance with French law.

The exercise of these rights may be subject to certain legal limitations, particularly where BANDEJA SHOP must retain information to comply with its legal obligations or defend its rights.

12. Updates to the Privacy Policy

BANDEJA SHOP reserves the right to modify this Privacy Policy to reflect regulatory, technical, or organizational developments.

The applicable version is the one published on the website at the time of consultation.

In the event of substantial changes affecting personal data processing, users will be informed through appropriate means, and renewed consent will be obtained where necessary.

For any questions regarding this Privacy Policy or the protection of personal data, users may contact BANDEJA SHOP through the contact form available on the website by selecting the subject relating to data privacy.

BANDEJA SHOP
181 Chemin du Puissanton
06220 Vallauris – France