Privacy Policy
Last updated: October 19, 2026
This translation is provided for your convenience. The French version is the only legally binding version and prevails in case of any discrepancy.
This policy explains what personal data we collect on bhali.fr, why, how long we keep it, who it is shared with and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi “Informatique et Libertés”). It may change: the date of the last update appears at the top of the page.
1. Controller
The controller is KOSMOFY, an SAS with share capital of €500, registered with the Paris Trade and Companies Register (RCS) under number 987 838 331, with its registered office at 229 rue Saint-Honoré, 75001 Paris, which operates the bhali.fr website under a license for the Bhali trademark (owned by TRICODPO).
Contact for any question about your data: contact@bhali.fr.
2. Data collected, purposes and retention periods
Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
Managing your orders: preparation, delivery, payment, invoicing, tracking, after-sales service | Last name, first name, email, phone number, shipping and billing addresses, chosen pickup point, order contents and history | Performance of the contract | Duration of the business relationship; invoices and accounting records kept for 10 years (legal obligation) |
Managing your customer account | Email, name, password (stored in encrypted form, never in plain text), saved addresses | Performance of the contract | Until the account is deleted, or 3 years after your last activity |
Replying to your messages (contact form, email, phone, WhatsApp) | Name, email, phone number, message content | Legitimate interest in replying to you; pre-contractual measures | The time needed to handle the request, then 12 months maximum |
Sending you our newsletter and offers | Consent (box not pre-checked) | Until you unsubscribe, or 3 years without any interaction from you | |
Securing the website and preventing fraud | IP address, connection data, technical logs; anti-fraud signals collected by Stripe during payment | Legitimate interest (security); legal obligation | 12 months maximum for technical logs |
Exercising and proving our rights in the event of a dispute | Order data and correspondence | Legitimate interest; legal obligation | Applicable limitation period |
Mandatory fields are marked in the forms: without them, we cannot process your order or your request. We collect only the data that is necessary and do not make any automated decision producing legal effects concerning you.
Payment: your card data is entered and processed directly by our provider Stripe. We never have access to it and do not store it.
Audience measurement and advertising: as of the date of the last update, the website does not use any audience measurement or targeted advertising tools. If they are added, they will be activated only with your consent, obtained through our cookie banner. See our Cookie Policy.
3. Recipients and processors
Your data is accessible only to the KOSMOFY staff authorized to process it (order preparation, customer service, website management), and to our processors, to the extent necessary for their tasks. We never sell your data.
Provider | Role | Data location |
|---|---|---|
IKOULA NET (Paris, France) | Hosting of the website and the database | France (Reims data center) |
Stripe Payments Europe, Ltd. (Dublin, Ireland) | Online payment, fraud prevention, refunds | European Union; possible transfers to Stripe, Inc. in the United States, governed by the EU–US Data Privacy Framework and standard contractual clauses |
Infomaniak Network SA (Geneva, Switzerland) | Sending emails (order confirmations, account, customer service replies) and the contact@bhali.fr mailbox | Switzerland (a country recognized by the European Commission as providing an adequate level of protection) |
Mondial Relay (France) | Pickup point delivery: recipient’s name, address, email and phone number | European Union |
Home delivery carrier | Home delivery in France, in the European Union and in the United States: recipient’s name, address, email and phone number | European Union; United States for parcels delivered in that country (see below) |
Delivery to the United States: to deliver an order to the United States, we share with the carrier, its local delivery partners and the customs authorities the data needed to route the parcel and clear it through customs (name, shipping address, phone number, email, contents and value of the order). This transfer outside the European Union is necessary for the performance of the contract concluded with you (Article 49(1)(b) of the GDPR). It is limited to this data and takes place only for an order delivered to the United States.
If you contact us via WhatsApp, your messages pass through the WhatsApp service (WhatsApp Ireland Limited, Meta group), under its own terms and privacy policy.
We may also disclose your data to administrative or judicial authorities when required by law.
4. Security
We implement appropriate technical and organizational measures to protect your data: encrypted connection (HTTPS), passwords stored in encrypted form, access to the administration restricted to authorized persons, regular backups and hosting in France.
5. Your rights
You have the following rights regarding your data:
- Right of access: obtain confirmation that your data is being processed and receive a copy of it;
- Right to rectification: have inaccurate or incomplete data corrected (you can also do this from your account);
- Right to erasure: request the deletion of your data, unless we must keep it to comply with a legal obligation (invoices, for example);
- Right to object: object to processing based on our legitimate interest, and, at any time and without giving a reason, to direct marketing;
- Right to restriction of processing;
- Right to data portability: receive the data you have provided to us in a structured, machine-readable format;
- Withdrawal of consent at any time (unsubscribe link in every newsletter, “Manage cookies” link at the bottom of every page), without affecting the lawfulness of processing already carried out;
- Post-mortem instructions: set instructions regarding the retention, erasure and disclosure of your data after your death.
To exercise your rights, write to contact@bhali.fr or to KOSMOFY, 229 rue Saint-Honoré, 75001 Paris. If we have reasonable doubts about your identity, we may ask you for proof of identity. We reply within one month of receiving the request, which may be extended by two months if the request is complex (we will inform you if so).
If, after contacting us, you believe that your rights have not been respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the data protection authority of the European Union country where you reside.
6. Minors
The website is intended for adults. Minors under 15 cannot consent on their own to subscribing to the newsletter and must obtain the consent of their legal representative to place an order.
7. Cookies
The website currently uses only cookies that are strictly necessary for it to work (cart, signing in to your account, remembering your cookie choice). Details are given in our Cookie Policy. You can change your choices at any time using the “Manage cookies” link at the bottom of every page.
8. Telephone marketing
You can sign up free of charge for Bloctel, the French telephone opt-out list (www.bloctel.gouv.fr).