Privacy Policy

Last updated: October 10, 2026

This policy explains what personal data Bough & Bow collects, why, who we share it with, and the choices you have. We collect only what we need to sell and deliver your order.

1. Who we are

The data controller is Yanis Oulad Slimane, 105 Chemin du Lavoir, 34270 Le Triadou, France, trading as Bough & Bow ("we"). Contact: yanis.pro34@outlook.fr, +33 7 66 29 68 52.

Because we are established in France, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and French law, wherever our customers live. We also honor the rights that US state privacy laws give their residents.

2. What we collect

Order data: name, email, shipping address, billing address, items ordered, order amount. Phone number only if you choose to provide it.
Payment data: processed directly by our payment provider. We never see or store your full card number.
Messages: what you write when you contact us.
Technical data: IP address, browser and device type, pages visited, collected by our e-commerce platform and through cookies (see our Cookie Policy).

We do not collect sensitive data, and we do not knowingly collect data from children under 16. Our products and site are not directed at children.

3. Why we use it, and on what legal basis

Purpose	Legal basis (GDPR)
Process, ship, and support your order, handle returns	Performance of a contract
Keep invoices and accounting records	Legal obligation
Prevent fraud and secure our store	Legitimate interest
Answer your messages	Legitimate interest or pre-contractual steps
Analytics and marketing cookies, marketing emails	Your consent, which you can withdraw at any time

4. Who we share it with

Shopify (Shopify International Limited, Ireland), which hosts our store and processes data on our behalf.
Our payment provider(s), shown at checkout, to take payment.
Our product suppliers and their carriers, located in China, which ship your order directly to you. We pass orders to them through the DSers order-management app. They receive your name, shipping address, and, if provided, phone number.
Authorities, only when the law requires it.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising without your consent.

5. International transfers

Some recipients are located outside the European Union, including in the United States, Canada, and China. Where the European Commission has not recognized a country as providing adequate protection, we rely on safeguards such as Standard Contractual Clauses or, for the shipment of your order, on the transfer being necessary to perform our contract with you.

6. How long we keep it

Order and invoice data: 10 years, as required by French accounting law.
Customer service messages: up to 3 years after our last exchange.
Cookie choices: 6 months, after which we ask you again.
Marketing email consent: until you unsubscribe, or 3 years without any interaction.

7. Your rights

You can ask to access, correct, or delete your data, to restrict or object to its use, to receive a copy in a portable format, and to withdraw consent at any time. US residents can also exercise the rights given by their state's law, including the right to opt out of the sale or sharing of personal data and of targeted advertising. We honor Global Privacy Control signals.

To exercise a right, email yanis.pro34@outlook.fr. We answer within one month. We will not discriminate against you for using your rights. If you are not satisfied, you can file a complaint with the French data protection authority, the CNIL (cnil.fr), or with your local authority.

8. Security

Our store runs on Shopify, which encrypts data in transit and meets payment card industry (PCI DSS) standards. No system is perfectly secure, but we limit access to your data to what is needed to run the store.