Privacy and Personal Data Policy

Last updated: 20 June 2026

1. Purpose of this policy

This policy explains how Le Monde Minéral collects, uses, stores and protects the personal data of its visitors and customers.

It applies in particular when browsing the website, creating an account, placing an order, making a payment, arranging delivery, contacting customer service, subscribing to the newsletter, publishing a review or exercising the right of withdrawal.

2. Data controller

The data controller is:

BM COMMERCE
French simplified joint-stock company with a sole shareholder, with share capital of €1,000
13 rue Roquebillière, 06150 Cannes-la-Bocca, France
Cannes Trade and Companies Register: 792 880 916
EU VAT number: FR30792880916

BM COMMERCE is represented by its President, Mr Bernard Masse.

For any question relating to your personal data or to exercise your rights, please contact: [email protected].

BM COMMERCE has not appointed a Data Protection Officer.

3. Personal data collected

Depending on how you use the website, the following data may be collected:

surname, first name and contact details;
email address, postal address and optional telephone number;
customer account login details and protected password;
billing and delivery addresses;
order, return, withdrawal and refund history;
payment method and payment status, without BM COMMERCE having access to the full bank card number or security code;
messages, complaints, attachments and correspondence with customer service;
email address used to subscribe to the newsletter;
rating, review content and display name associated with a customer review;
IP address, technical logs, browser, device and browsing information;
choices made regarding cookies and similar technologies.

Most personal data is provided directly by the user. Some information may also be received from payment providers or carriers, for example to confirm a payment or track a delivery.

4. Purposes and legal bases

Customer accounts and orders

Personal data is used to create and manage customer accounts, record orders, manage addresses, prepare products, issue invoices and manage the customer relationship. These processing activities are based on steps taken at the customer’s request before entering into a contract, performance of the sales contract and, for accounting purposes, BM COMMERCE’s legal obligations.

Payments and fraud prevention

Payments by bank card and PayPal are processed through PrestaShop Checkout and the payment services connected to it. BM COMMERCE only receives the information required to confirm the payment status and manage the order.

Bank transfer may also be accepted at the customer’s request. The customer then arranges the transfer through their own bank.

Payment providers, including PayPal, may automatically analyse transaction data in order to prevent fraud, identify potentially unauthorised payments, assess risk and determine whether a transaction is eligible for their protection programmes.

Delivery

The information required to deliver and track a parcel is transmitted to the selected carrier. In France, deliveries may be handled by Colissimo or Mondial Relay. International deliveries are arranged through Colissimo and may involve a local postal partner in the destination country.

The telephone number is optional. When provided, it may be used to facilitate delivery or notify the customer of a problem affecting the parcel.

Withdrawal, returns and after-sales service

Information provided in connection with a withdrawal, return, refund or after-sales request is used to assess and process the request. These processing activities are based on performance of the contract and compliance with the legal obligations applicable to distance selling.

Contact form and customer service

Information submitted through the contact form or by email is used to reply to enquiries, provide assistance, handle complaints or follow up an order.

Depending on the nature of the enquiry, processing is based on pre-contractual steps, performance of the contract or BM COMMERCE’s legitimate interest in responding to enquiries and defending its rights.

Newsletter subscription is optional and is based on the user’s consent. It requires an email address and confirmation by ticking the relevant box.

Consent may be withdrawn at any time by using the unsubscribe link included in every newsletter. Once unsubscribed, the email address is removed from the subscriber list.

Customer reviews

Reviews are managed directly by Le Monde Minéral and are not sent to an external review platform. The rating, review content, publication date and the first name, pseudonym or display name chosen by the customer may be published. The customer’s email address and full name are not displayed.

Review management and publication are based on BM COMMERCE’s legitimate interest in informing visitors about customer experiences.

Website security

Technical data may be processed to protect the website, customer accounts and orders, prevent attacks, detect misuse and maintain service availability.

The website uses Cloudflare, which may process technical information relating to connections and requests, including IP addresses, timestamps and security logs, in order to protect the website and filter traffic.

The contact form also uses Google reCAPTCHA to reduce automated submissions.

Audience measurement and external content

Le Monde Minéral uses Google Analytics to obtain website traffic statistics and improve the operation of the website. Where consent is required, the relevant tracking technologies may only be used on the basis of the choice made through the cookie management banner.

Some pages include videos hosted by YouTube. Displaying or playing these videos may result in technical exchanges with Google and YouTube services.

5. Mandatory and optional data

Information marked as mandatory is required to create an account, process an order, issue an invoice, arrange delivery or respond to an enquiry. Failure to provide this information may prevent the relevant operation from being completed.

The telephone number is optional. Newsletter subscription, publication of a review and acceptance of non-essential tracking technologies are also optional. Refusing them does not prevent a customer from placing an order.

6. Recipients and service providers

Within BM COMMERCE, personal data is only accessible where necessary for website management, order processing, accounting, shipping and customer service.

Depending on the operation concerned, data may also be disclosed to:

payment providers operating through PrestaShop Checkout, including PayPal;
banks in the event of payment by bank transfer;
La Poste, Colissimo, Mondial Relay and local postal partners;
MainHost for hosting and backups;
Cloudflare for website security and traffic filtering;
Google for Google Analytics, YouTube and reCAPTCHA services;
technical providers required for the operation of PrestaShop and its modules;
public authorities, administrative bodies or courts where required by law.

Recipients only receive the data required to perform their services. BM COMMERCE does not sell or rent its customers’ personal data.

7. Hosting and international transfers

The website and its data are hosted in France by MainHost, which also provides website backups under the hosting agreement.

Certain service providers, including Google, YouTube, Cloudflare and PayPal, may process data or make it accessible from a country outside the European Economic Area.

Where such transfers take place, they are governed by mechanisms recognised under the GDPR, such as a European Commission adequacy decision, Standard Contractual Clauses or another appropriate safeguard implemented by the relevant provider.

8. Data retention periods

Personal data is retained for as long as necessary for the relevant purpose and may then be archived where required by law or where necessary to establish, exercise or defend legal claims.

Customer account: for the duration of the commercial relationship and for no more than three years after the customer’s last activity, unless earlier deletion is requested or a legal obligation requires longer retention.
Orders and related correspondence: for the time required to manage the order and customer relationship, then for up to five years where retention is necessary for evidence or the defence of legal rights.
Invoices and accounting records: ten years from the end of the relevant financial year.
Enquiries not connected with an order: no more than three years after the last exchange.
Withdrawals, returns and complaints: for the time required to process them and then for the period necessary to provide evidence of the transaction or manage a possible dispute.
Newsletter: until consent is withdrawn or, in the absence of withdrawal, for three years after the subscriber’s last active contact.
Reviews: for as long as the review remains published, subject to a justified request for removal or anonymisation.
Technical logs, security data and backups: for the periods required for website security, maintenance and restoration, in accordance with the settings and policies of the relevant providers.
Cookies and evidence of user choices: for the periods stated in the consent management tool and the cookie policy.

9. Cookies and similar technologies

The website uses the Advanced Cookie Banner module, allowing visitors to accept, refuse or customise the use of cookies that require consent.

Cookies that are strictly necessary for security, authentication, the shopping cart and order processing may be used without consent where they meet the legal conditions for exemption.

Users may change their choices at any time through the cookie management tool available on the website. Further information will be provided in the separate cookie policy.

10. Data security

BM COMMERCE implements measures intended to protect personal data against loss, alteration, disclosure and unauthorised access.

These measures include secure HTTPS connections, protection of the website’s back office, restricted access, backups, technical maintenance and the security and traffic-filtering systems provided by the hosting provider and Cloudflare.

11. Your rights

Depending on the nature of the processing, you may exercise the following rights:

the right to access your personal data;
the right to correct inaccurate or incomplete data;
the right to erasure;
the right to restrict processing;
the right to object to processing based on legitimate interests;
the right to data portability where the legal conditions are met;
the right to withdraw consent at any time;
the right to give instructions concerning the handling of your personal data after your death, in accordance with French law.

These rights may be restricted where data retention is required by law or is necessary for accounting purposes, evidence of a transaction or the defence of legal claims.

Deleting a customer account therefore does not necessarily result in the immediate deletion of invoices, orders and records that must be retained by law.

12. Exercising your rights

You may exercise your rights:

by email at [email protected]
or by post at:
BM COMMERCE
13 rue Roquebillière
06150 Cannes-la-Bocca
France

Your request must clearly identify the right you wish to exercise and allow BM COMMERCE to identify the person concerned. Proof of identity will only be requested where there is reasonable doubt about the requester’s identity.

BM COMMERCE will respond within one month of receiving the request. This period may be extended by a further two months where justified by the complexity or number of requests.

13. Complaints to the CNIL

If, after contacting BM COMMERCE, you believe that your rights have not been respected, you may lodge a complaint with the French Data Protection Authority:

CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France

A complaint may also be submitted directly through the CNIL website.

14. Automated decision-making

BM COMMERCE does not carry out individualised commercial profiling or make fully automated decisions on its own behalf that produce legal effects or similarly significantly affect a customer.

Payment providers may, however, use automated fraud-prevention and risk-assessment systems in accordance with their own terms and privacy policies.

15. Changes to this policy

This policy may be updated to reflect changes in the law, regulations, technology or the services offered by Le Monde Minéral.

The version applicable is the version published on the website on the date it is consulted.

```