Data Protection

1. Purpose of This Policy

Bed Bath & Beyond (“we,” “our,” or “us”) is committed to protecting the personal data of our customers, suppliers, and partners in compliance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. This policy explains how we handle personal data, ensure security, and protect the rights of individuals.

2. Scope

This Data Protection Policy applies to:

• All users of our website

• All customers who purchase our products or interact with our services

• Employees, contractors, and third-party service providers who handle personal data on our behalf

3. Principles of Data Protection

We process personal data according to the following principles:

• Lawfulness, fairness, and transparency: Data is collected and processed legally, fairly, and in a transparent manner.

• Purpose limitation: Data is collected only for specified, explicit, and legitimate purposes.

• Data minimization: Only the minimum necessary data is collected.

• Accuracy: Data is kept accurate and up to date.

• Storage limitation: Data is retained only as long as necessary.

• Integrity and confidentiality: Data is processed securely to prevent unauthorized access, loss, or damage.

4. What Data We Collect

We may collect the following categories of personal data:

• Identity Data: name, billing/shipping address, email, phone number.

• Financial Data: payment details (processed securely via third-party gateways).

• Order Data: purchase history, delivery details, transaction records.

• Technical Data: IP address, browser type, operating system, and cookies.

• Communications: customer service inquiries, feedback, and correspondence.

5. How We Use Personal Data

We process personal data for the following purposes:

• To process and deliver customer orders.

• To manage payments, returns, and refunds.

• To communicate with customers regarding orders, products, or support.

• To improve website performance and user experience.

• To comply with legal and regulatory obligations.

• To prevent fraud, unauthorized access, or misuse of our services.

6. Data Sharing & Third Parties

We do not sell personal data to third parties. Data may be shared only with:

• Logistics providers (to deliver products).

• Payment processors (to complete transactions securely).

• IT service providers (to host and maintain our website).

• Authorities if required by law or regulation.

All third parties are contractually required to keep data secure and use it only for the agreed purpose.

7. Data Security

We take appropriate technical and organizational measures to protect personal data, including:

• Encryption of sensitive data and secure payment processing.

• Access controls to limit data access to authorized personnel only.

• Regular monitoring, audits, and system security checks.

• Employee training on data protection responsibilities.

8. Data Retention

• We retain personal data only as long as necessary to fulfill the purposes described above or as required by law.

• Order and transaction records are generally kept for up to 7 years for tax and accounting compliance.

• Data no longer needed is securely deleted or anonymized.

9. Individual Rights

Under GDPR and applicable laws, you have the following rights:

• Right of access – request a copy of the data we hold about you.

• Right to rectification – correct inaccurate or incomplete data.

• Right to erasure – request deletion of your data (subject to legal requirements).

• Right to restrict processing – limit how your data is used.

• Right to data portability – receive your data in a structured, commonly used format.

• Right to object – object to processing based on legitimate interests or direct marketing.

• Right to withdraw consent – withdraw consent at any time if processing is based on consent.

To exercise your rights, please contact us at info@boisorigine.shop.

10. Children’s Data

We do not knowingly collect or process personal data of individuals under 18 years old. If you believe a child has provided us with personal data, please contact us immediately so we can delete it.

11. International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections.

12. Policy Updates

We may update this Data Protection Policy to reflect changes in legal requirements, technology, or business practices. Updates will be posted on this page with the “Last Updated” date.

13. Contact Us

For any questions about this Data Protection Policy or to exercise your rights, please contact us:

• Email: bedbathandbeyondcustomerservice@gmail.com

• Phone: +33 7 74 16 15 55

• Service Hours: Monday – Saturday, 10:00 AM – 6:00 PM (CET)

If you believe we have not handled your data properly, you also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French Data Protection Authority.