Privacy policy
Translation provided for your information: only the French version of this document is legally binding. Read the French version
Last updated: 28 August 2026
This policy explains what personal data is collected on the Zonebazar website, why it is collected, how long it is kept, who it is shared with, and what rights you can exercise.
1. Data controller
- Data controller: Mohamed BENJERRAI, sole trader (entrepreneur individuel), operating the Zonebazar website (SIREN 531 454 965, 16 rue de la Rabotière, 44800 Saint-Herblain)
- Address: 16 rue de la Rabotière, 44800 Saint-Herblain, France
- SIRET: 531 454 965 00033
- Contact for any question about your data: support@zonebazar.com
Given the size of the business and the nature of the processing, no data protection officer has been appointed: such an appointment is not mandatory within the meaning of Article 37 of the GDPR. Requests are handled directly by the data controller named above.
2. Data collected and purposes
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Surname, first name, postal address, email address, telephone | Processing and delivering the order, keeping you informed of its shipment | Performance of the contract (Art. 6.1.b) | 3 years after the last contact, then archiving |
| Order details, invoices | Accounting and tax obligations, legal guarantees | Legal obligation (Art. 6.1.c) | 10 years (Art. L123-22 of the French Commercial Code) |
| Exchanges with customer service | Handling a complaint, a withdrawal or a guarantee claim | Performance of the contract and legal obligation | Duration of the legal guarantee, i.e. 2 years, then 5 years in the event of a dispute |
| Payment data | Collecting payment for the order | Performance of the contract | Never stored by the seller — see Article 4 |
| Email address, if you consent | Sending marketing information | Consent (Art. 6.1.a), which can be withdrawn at any time | 3 years after the last contact, or until consent is withdrawn |
| Browsing data, cookies | Running the website, measuring audience | Legitimate interest for strictly necessary cookies; consent for the others | 13 months maximum |
No data is collected without your knowledge, and none is sold to third parties.
3. Mandatory information
The data marked as mandatory when ordering is necessary to fulfil the order: without a postal address, no delivery is possible; without an email address, no confirmation or tracking can be sent to you. If it is not provided, the contract cannot be concluded, with no other consequence.
4. Recipients of the data
Your data is shared only with the providers involved in fulfilling your order, and only to the extent they need it:
- OVH SAS (France; server located in the United Kingdom, a country recognised by the European Commission as providing adequate data protection) — hosting of the website and the shop, as a processor within the meaning of Article 28 of the GDPR;
- the payment provider PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — processing of the transaction. It is the sole recipient of your bank details; the seller never has access to them;
- our logistics partner and the carriers — preparation and shipment of the parcel. See Article 5 below.
5. Transfer of data outside the European Union
An important point, specific to the way we ship.
Our items are prepared and shipped from partner suppliers located outside the European Union, mainly in the People's Republic of China. For a parcel to reach you, your name, your full postal address and your telephone number must necessarily be passed on to this logistics partner and to the carriers involved.
This constitutes a transfer to a third country within the meaning of Chapter V of the GDPR. China is not covered by an adequacy decision of the European Commission.
This transfer is limited to what is strictly necessary for delivery: no other data — purchase history, means of payment, exchanges with customer service — is passed on. We ask our logistics partners to commit to the safeguards provided for in Chapter V of the GDPR.
You can ask us about the safeguards governing this transfer by writing to support@zonebazar.com.
6. Cookies
The website places the following cookies:
- strictly necessary cookies — basket, session, security. They cannot be refused because the website would not work without them, and they do not require your consent;
- audience measurement cookies and, where applicable, advertising personalisation cookies — subject to your prior consent, obtained through the banner displayed on your first visit.
You can change your choice at any time in the privacy settings of the website or of your browser. Refusing non-essential cookies prevents neither browsing nor ordering.
Cookies are kept for no longer than thirteen months, and the data derived from them is not kept for more than twenty-five months.
7. Security
The website is served entirely over HTTPS. Payments are processed by a PCI-DSS certified provider, without bank details passing through the seller. Access to the shop's administration is protected and restricted to the data controller alone.
In the event of a data breach likely to result in a risk to your rights and freedoms, the CNIL will be notified within 72 hours and you will be informed as soon as possible, in accordance with Articles 33 and 34 of the GDPR.
8. Your rights
You have the following rights over the data concerning you:
- Access — to obtain confirmation that it is being processed and to receive a copy;
- Rectification — to have inaccurate or incomplete information corrected;
- Erasure — to request its deletion, subject to our legal retention obligations, in particular for accounting purposes;
- Restriction — to request that a disputed processing operation be suspended;
- Objection — to object to processing based on legitimate interest, and without having to give reasons where direct marketing is concerned;
- Portability — to receive your data in a machine-readable format, or to have it transmitted to another controller;
- Withdrawal of consent at any time, without affecting the lawfulness of what was done before;
- Post-mortem instructions — to set out what should happen to your data after your death (Art. 85 of the French “Informatique et Libertés” Act).
How to exercise them
Write to support@zonebazar.com, or by post to the address given in Article 1. You will receive a reply within one month, which may be extended by two months if the request is complex, in which case you will be informed.
You will only be asked for proof of identity if there is reasonable doubt about your identity.
Complaints
If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés:
CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr/fr/plaintes
9. Automated decision-making
No decision producing legal effects concerning you is taken solely on the basis of automated processing, and no profiling is carried out.
10. Minors
The website is not intended for minors under the age of fifteen and does not knowingly collect their data. Should it come to light that data has been collected from a minor without the consent of the holder of parental authority, it would be deleted without delay upon simple notification.
11. Changes
This policy may be amended to take account of legal or technical developments. The applicable version is the one published on this page, with its date of update shown at the top.