Privacy Policy
Last Updated: 1 September 2026
1. Who We Are
Bonvale UK Limited (company number 17142585), incorporated in England and Wales, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("Bonvale", "we", "us", "our"), is the data controller for the personal data we collect from customers in Germany through our website (bonvale.de), our App, and the related services (our "Services").
Because Bonvale UK Limited is established outside the European Union and offers goods to individuals in the Union, Article 27 of the GDPR requires us to designate a representative in the Union.
You may contact either us or our EU representative on all matters relating to the processing of your personal data. Privacy queries may also be directed to us using the contact details in Section 17.
We may share personal data with the Bonvale group and related entities as described in Section 6. Where data is transferred outside the European Economic Area, appropriate safeguards apply (see Section 7).
2. Personal Data We Collect
2.1 Data You Provide Directly
When you create an account, place an order, contact us, or use our Services:
- Identity: first and last name, date of birth
- Contact: email address, telephone number, postal address
- Account: username, password (stored in hashed form), preferences
- Transaction: products purchased, order and returns history, payment method type (full card numbers are held by our payment gateway, not by Bonvale)
- Communications: messages sent to our customer care team
- Marketing preferences: consents and objections relating to email, SMS, and push notifications
2.2 Data We Collect Automatically
When you visit our Website or use our App:
- Device and technical: IP address, browser type and version, operating system, device identifiers, time zone
- Usage: pages viewed, products browsed, search queries, clickstream, session duration, referral source
- Tracking: data collected via cookies, pixels, and similar technologies (see Section 5)
- Location: approximate location from IP address (we collect GPS location data only if you grant App permission)
2.3 Data We Receive From Third Parties
- Payment gateways: transaction status, fraud risk signals, and payment verification data
- Logistics providers: delivery status, delivery confirmation, and address validation
- Meta Platforms: aggregated advertising performance data and, where you have consented, audience matching data via the Meta Pixel (see Section 5)
- Google: analytics and advertising performance data via Google Analytics and Google Ads (see Section 5)
3. How and Why We Use Your Personal Data
The table below maps each processing purpose to the lawful basis under the GDPR and our default retention period.
| Data Collected | Purpose | Lawful Basis (GDPR) | Retention |
|---|---|---|---|
| Name, contact, order, and payment data | Processing your order: fulfilment, dispatch, returns | Contract performance (Art. 6(1)(b)) | 10 years from transaction (EU VAT record-keeping) |
| Account data | Creating and managing your account | Contract performance (Art. 6(1)(b)) | 3 years after last account activity |
| Contact and order data | Customer care and dispute resolution | Contract performance / legitimate interests (Art. 6(1)(f)) | 3 years from last interaction |
| Email, phone, preferences | Transactional communications (order confirmation, dispatch, returns) | Contract performance (Art. 6(1)(b)) | Duration of customer relationship |
| Email, phone, preferences | Marketing emails, SMS, and push notifications | Consent (Art. 6(1)(a)) and § 7 UWG (German Act Against Unfair Competition) | Until consent withdrawn |
| Browsing and purchase history | Personalised product recommendations | Legitimate interests (Art. 6(1)(f)) | 3 years from last activity |
| Device, usage, and purchase data via the Meta Pixel and Google Analytics | Profiling for targeted advertising on Meta and Google | Consent (Art. 6(1)(a)) and § 25 TDDDG (German Digital Services Data Protection Act) | Per Meta and Google terms; our data: 2 years |
| IP address, device, transaction data | Fraud detection, security, and abuse prevention | Legitimate interests (Art. 6(1)(f)) | 2 years |
| All categories | Legal obligations (tax, anti-money laundering, court orders) | Legal obligation (Art. 6(1)(c)) | As required by law (min. 10 years for EU VAT records) |
| Aggregated, anonymised data | Analytics and business intelligence | Legitimate interests (Art. 6(1)(f)) | Indefinite (not personal data) |
We make our legitimate interests assessments available to you on request from privacy@bonvale.com.
4. Marketing Communications
We send marketing communications (email, SMS, push) only where you have given consent. You may withdraw your consent at any time:
- via the unsubscribe link in any marketing email;
- by replying STOP to any marketing SMS;
- via the notification settings on your device or in your Bonvale account;
- by contacting us at privacy@bonvale.com.
Withdrawing your marketing consent does not affect transactional communications (order confirmations, dispatch, returns), which we send on the basis of our contract with you.
Germany: § 7 UWG
Under § 7(2) no. 2 UWG (German Act Against Unfair Competition), electronic marketing requires your prior express consent. Where we obtained your email address in connection with the sale of goods, we may use it under § 7(3) UWG to advertise our own similar goods, provided you have not objected and provided we clearly inform you, both at the point of collection and in every message, that you may object at any time without incurring any costs other than the transmission costs at basic rates.
5. Cookies, Pixels, and Tracking Technologies
5.1 What We Use
Strictly Necessary Cookies
Necessary for core functionality: shopping basket, login, security, and fraud prevention. They cannot be disabled.
Analytics Cookies: Google Analytics
We use Google Analytics (Google LLC) to understand how visitors use our Website: pages visited, session duration, referral source, and device. This aggregated data helps us improve our Services. It is transferred to Google's servers, which may be located outside the European Economic Area (see Section 7). You may object via the Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout or by rejecting analytics cookies in our banner.
Advertising and Targeting Cookies: Meta Pixel
We use the Meta Pixel (Meta Platforms, Inc.) to measure advertising effectiveness, build audiences, and track conversions. When active, it collects your IP address, browser data, the page URL, and your actions on the Website (such as product views and purchases). This data is transmitted to Meta and used there for targeted advertising on Facebook, Instagram, and the Meta Audience Network (retargeting). Meta may also use it for its own purposes under its own Privacy Policy. We activate the Meta Pixel only with your consent, which you may withdraw at any time via your cookie preferences.
5.2 Consent Management
Storing information on your device and accessing information already stored there require your consent under § 25(1) TDDDG (German Digital Services Data Protection Act), unless this is strictly necessary to provide the digital service you have expressly requested.
We use Shopify's native cookie banner. On your first visit, it displays the categories of cookies in use. Non-essential cookies, including the analytics and advertising categories, are not set until you expressly accept them. Rejecting all non-essential cookies is just as straightforward as accepting them. Your choice is recorded with a timestamp and the version of this Policy in force at that time, so that we can demonstrate valid consent.
You can review and change your preferences at any time via the "Cookie Settings" link in the footer of our Website. Withdrawing consent for a category takes effect immediately; the tracking scripts relying on that consent will no longer fire for your session.
5.3 Your Choices
Manage your preferences via our cookie settings in the footer of the Website, via your browser settings, or via the opt-out tools provided by Google and Meta. Restricting certain cookies may affect Website functionality.
6. Who We Share Your Personal Data With
We do not sell or rent your personal data. We share it only as described below.
6.1 Service Providers
We share data with service providers acting under our instruction, in particular:
- Shopify Inc.: storefront platform, transactional emails, order notifications, and native cookie consent management.
- Shopify Payments and the payment and instalment providers offered at checkout in Germany: payment processing and fraud screening. Your full card details are held by the relevant payment provider, not by Bonvale.
- KEC and KLN: outbound logistics from our fulfilment warehouse and inbound returns logistics to our EU returns warehouse.
- The local carriers responsible for delivery in Germany.
- Loop Returns, Inc. (with EasyPost for return label generation): returns and exchanges portal.
- Gorgias, Inc.: customer support and ticketing.
- Klaviyo, Inc.: marketing emails, SMS, and push notifications.
- Amazon Web Services, Inc.: cloud infrastructure for custom apps and integrations.
- Google LLC (Google Analytics): Website usage analytics.
- Meta Platforms, Inc. (Meta Pixel): advertising measurement and audience targeting, subject to your consent.
6.2 Legal and Regulatory Disclosure
We disclose personal data to law enforcement, courts, or regulators only where we are required to do so by law, court order, or regulatory direction. We will notify you of such disclosures where legally permitted.
6.3 Business Transfers
If Bonvale UK Limited undergoes a merger, acquisition, or asset sale, your data may transfer to the relevant entity. We will notify you and ensure that an equivalent level of protection applies.
6.4 Group Companies
We may share data with the Bonvale group and related entities for the purposes set out in this Policy, for example group-wide analytics, IT infrastructure, and customer support. Intra-group transfers outside the EEA are covered by an intra-group agreement based on the European Commission's Standard Contractual Clauses (see Section 7).
7. International Transfers of Personal Data
Bonvale UK Limited is established in the United Kingdom. Some of our service providers and group companies are located outside the European Economic Area. Your personal data may therefore be transferred to and processed in countries whose data protection laws differ from those of the EEA.
Where we transfer your personal data outside the EEA, we rely on appropriate safeguards under Chapter V of the GDPR, which may include:
- Transfers to a country covered by a European Commission adequacy decision. Transfers to the United Kingdom, including to Bonvale UK Limited itself, are covered by the Commission's adequacy decision for the United Kingdom, which was extended on 19 December 2025 and runs until 27 December 2031;
- the European Commission's Standard Contractual Clauses, supported by a transfer impact assessment and any supplementary measures required;
- where applicable, derogations for specific situations under Article 49 GDPR; and/or
- other approved safeguards, for example Binding Corporate Rules.
Transfers to service providers and group companies outside the EEA in countries not covered by an adequacy decision are made under the Standard Contractual Clauses with the accompanying transfer impact assessments. You may request a copy of the relevant mechanism at privacy@bonvale.com.
8. How Long We Keep Your Personal Data
We retain personal data only as long as necessary for the relevant purpose and to comply with our legal obligations.
| Data Category | Retention Period |
|---|---|
| Order, transaction, and payment records | 10 years from date of transaction (EU VAT record-keeping) |
| Account data | 3 years after last account activity or closure, whichever is later |
| Customer care communications | 3 years from last interaction |
| Marketing preferences and consent records | Until consent withdrawn, plus 1 year (to demonstrate compliance with the GDPR and § 7 UWG) |
| Fraud and security logs | 2 years from the relevant event |
| Cookies and tracking data | 2 years from collection (see also Meta and Google terms) |
| Legal hold data (disputes, access requests, litigation) | Duration of matter plus applicable limitation period |
| Anonymised or aggregated analytics data | Indefinite (not personal data) |
On expiry of the retention period, we securely delete or anonymise the data. Where immediate deletion is not possible (e.g. in backup copies), we isolate the data and restrict access until deletion occurs.
9. How We Protect Your Personal Data
We implement technical and organisational measures to protect your data, including:
- Encryption in transit (TLS/SSL) and at rest
- Access controls and role-based permissions
- Regular security assessments and penetration testing
- Data protection training for our staff
- Incident response procedures (see Section 10)
Payment card data is processed by our PCI-DSS certified payment gateway. We do not store full card numbers. If you believe your account has been compromised, contact us immediately at privacy@bonvale.com.
10. Data Breach Notification
On becoming aware of a personal data breach likely to pose a risk to you, we will:
- investigate its nature and scope;
- notify the competent supervisory authority within the timeframes set out below;
- notify affected individuals without undue delay where there is a high risk;
- document the breach and our response.
Germany: Articles 33 and 34 GDPR
Under Article 33 GDPR, we must notify the competent supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk, we must also communicate it to affected individuals directly under Article 34.
Because Bonvale UK Limited has no establishment in the European Union, the lead supervisory authority mechanism does not apply to us. Data protection supervision in Germany is organised at Land level; the competent authority is therefore the state data protection authority of the Land in which the affected individuals are resident. A list of the German federal and state supervisory authorities is published by the Federal Commissioner for Data Protection and Freedom of Information at bfdi.bund.de.
11. Your Rights
Under the GDPR and the Bundesdatenschutzgesetz (BDSG) (German Federal Data Protection Act), you have the following rights:
| Right | What It Means |
|---|---|
| Access | Request a copy of the personal data we hold about you. We respond within one month (extendable by two further months for complex requests). |
| Rectification | Ask us to correct inaccurate or incomplete data. Most account data can be changed directly in your account. |
| Erasure | Ask us to delete your data where we have no legitimate reason to retain it, subject to legal obligations (e.g. VAT and accounting records). |
| Restriction of Processing | Ask us to pause processing in certain circumstances, e.g. while you contest the accuracy of the data. |
| Data Portability | Receive your data in a structured, machine-readable format where it is processed by automated means on the basis of consent or a contract. |
| Objection | Object to processing for direct marketing purposes (an absolute right), and likewise to profiling for advertising or to processing based on legitimate interests. Marketing objections are actioned immediately. |
| Withdrawal of Consent | Withdraw consent at any time where processing is based on it. The lawfulness of processing carried out up to that point is unaffected. |
| Automated Decisions | Not to be subject to a solely automated decision producing legal effects or similarly significantly affecting you. We do not currently make such decisions. |
To exercise any of these rights, write to privacy@bonvale.com or to our EU representative (Section 1). We respond within one month and may ask you to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.
12. Complaints & Supervisory Authority
If you have a concern about how we handle your personal data, please contact us first at privacy@bonvale.com so that we can resolve it directly.
You have the right to lodge a complaint with a supervisory authority at any time, in particular with the data protection authority of the Land in which you are habitually resident, in which you work, or in which the alleged infringement took place. A list of the German supervisory authorities is available from the Federal Commissioner for Data Protection and Freedom of Information at bfdi.bund.de.
Under Article 21 GDPR, you may object at any time to profiling for targeted advertising (including via the Meta Pixel and Google Ads) by contacting privacy@bonvale.com or through your cookie preferences.
13. Children's Privacy
Our Services are for individuals aged 18 and over. We do not knowingly collect data from minors. If you believe a child has provided us with their data, write to privacy@bonvale.com; we will then delete it promptly unless retention is required by law.
14. Third-Party Links
Our Website and our App may link to third-party websites. This Policy does not cover those websites and we are not responsible for their privacy practices.
15. Cookie Policy
What are cookies?
Cookies are small text files placed on your device when you visit our Website. They allow the Website to store your actions and preferences over time, and help us and our partners understand how visitors interact with our content. Similar technologies such as pixels and device identifiers work in an equivalent way.
The cookies we use
We use three categories of cookies. The table below lists, for each cookie, who sets it, what it does, and how long it remains on your device.
Category 1: Strictly Necessary
These cookies are necessary for our Website to function. They cannot be disabled and do not require consent.
| Cookie Name | Set By | Purpose | Duration |
|---|---|---|---|
_shopify_session |
Shopify | Maintains your shopping session, keeps you logged in, and secures the checkout | Session (deleted when browser closes) |
_shopify_y |
Shopify | Assigns a unique visitor ID for analytics and personalisation within Shopify's platform | 1 year |
cart |
Shopify | Stores the contents of your shopping cart as you continue browsing | 2 weeks |
secure_customer_sig |
Shopify | Verifies that you are logged into your account securely | 20 years |
_ab |
Shopify | Records whether you were directed to a specific storefront variant (used internally by Shopify) | 2 years |
_tracking_consent |
Shopify | Stores your consent preferences, the categories you accepted or rejected, and the date and version of the policy in force at the time | 1 year |
Category 2: Analytics
These cookies help us understand how visitors use our Website: which pages are visited, how long sessions last, and where visits come from. The data is aggregated and is not used to identify you personally. These cookies are set only with your consent.
| Cookie Name | Set By | Purpose | Duration |
|---|---|---|---|
_ga |
Google LLC (Google Analytics 4) | Assigns a unique identifier to distinguish visitors and aggregate usage data | 2 years |
_ga_[ID] |
Google LLC (Google Analytics 4) | Stores and maintains session state for a specific GA4 property | 2 years |
_gid |
Google LLC (Google Analytics 4) | Distinguishes individual users within a 24-hour session | 24 hours |
_gat |
Google LLC (Google Analytics 4) | Throttles the rate of requests to Google's servers | 1 minute |
Google Analytics data is transferred to Google's servers, which may be located outside the European Economic Area. See Section 7 of this Policy on international transfers.
You may object to Google Analytics tracking at any time via the Opt-Out Browser Add-on or via the settings in our cookie banner.
Category 3: Marketing and Advertising
These cookies are used to serve you targeted advertising based on your browsing and purchase behaviour on our Website and to measure the effectiveness of our campaigns. They are set only with your consent.
| Cookie Name | Set By | Purpose | Duration |
|---|---|---|---|
_fbp |
Meta Platforms, Inc. | Identifies browsers for advertising measurement and retargeting via Facebook and Instagram (Meta Pixel) | 3 months |
_fbc |
Meta Platforms, Inc. | Stores the click identifier when you arrive at our Website via a Facebook or Instagram advertisement | 3 months |
fr |
Meta Platforms, Inc. | Used by Meta to deliver, measure, and improve targeted advertisements on its platforms | 3 months |
Meta Pixel data is transferred to Meta's servers in the United States. See Section 7 on international transfers and Section 5.1 on how the Pixel operates.
Managing your preferences
You can review and change your cookie preferences at any time via Cookie Settings in the footer of our Website. You can also:
- block or delete cookies via your browser settings. Blocking strictly necessary cookies will affect core Website functionality.
- object to tracking by Google Analytics via the Opt-Out Browser Add-on.
- manage your Meta advertising preferences at facebook.com/ads/preferences.
Withdrawing consent for analytics or advertising cookies takes effect immediately. The lawfulness of the processing carried out up to the point of withdrawal is unaffected.
Keeping this table up to date
We review and update this table whenever we add, change, or remove tracking technologies. The "Last Updated" date at the top of this Policy indicates the most recent revision. A continuously and automatically updated version of this table is also accessible via your cookie preferences.
16. Updates to This Policy
We may amend this Policy to reflect changes in our processing practices, the law, or our Services. The amended version will be published with a new "Last Updated" date. We will notify you of material changes by email or by a prominent notice on the Website before they take effect. If you continue to use our Services after that date, this constitutes acceptance of the amended Policy.
17. Contact Us
For all privacy queries, requests, and complaints:
Email: privacy@bonvale.com
You may also contact our EU representative, whose details are set out in Section 1.
We aim to respond within one month. If you are not satisfied with our response, you may lodge a complaint with your competent supervisory authority (see Section 12).
