Who is responsible for your data
Bioshop L.L.C., a New Mexico limited liability company with its principal place of business at 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA, is the controller of the personal data described in this policy.
For any privacy question or request, write to info@bioshopessentials.com.
We never see your card details. Payments are processed entirely by Stripe on its own secure pages. Bioshop receives confirmation that a payment succeeded, together with the information needed to ship your order — never your card number or security code.
What we collect
Data you give us
If you use the contact form or write to us by email, we collect the name, email address, subject and message content you provide. Providing this data is voluntary; without it we cannot answer you.
Order and payment data
When you place an order we process the data needed to fulfil and account for it: your name, delivery and billing address, email address, telephone number where given, the products ordered, the amount paid, the currency and the order reference. This data is necessary to perform the sales contract; without it we cannot deliver an order.
Card data is collected and processed directly by Stripe as an independent controller for the purposes of processing the payment and preventing fraud. We receive only the payment status, the payment method type, the last four digits and the associated billing details.
Your basket
The contents of your basket and your chosen currency are stored in your browser's local storage so that they survive a page reload. They stay on your device, are not transmitted to us until you order, and contain no identifier.
Data collected automatically
Our hosting provider records standard server logs when a page is served: IP address, date and time of request, page requested, browser type and operating system. These logs exist for security, abuse prevention and technical diagnosis.
Local storage
This website stores one item in your browser's local storage: your chosen display language. It is a functional preference, it contains no identifier, it is not transmitted to us and it is not used for tracking. You can clear it at any time from your browser settings.
What we do not do
We do not use advertising cookies, analytics trackers, social plug-ins, profiling or automated decision-making on this website. We do not sell or share your personal data, and we do not buy contact lists.
Why we use it, and on what legal basis
- To process and deliver your order — basis: performance of the sales contract you entered into with us.
- To handle returns, withdrawals and warranty claims — basis: performance of the contract and compliance with our legal obligations.
- To answer your enquiry — basis: your consent when you send the message, and our legitimate interest in responding to people who contact us.
- To operate and secure the website — basis: our legitimate interest in keeping the site available, functional and protected against abuse, including fraud prevention.
- To comply with legal obligations — basis: compliance with applicable law, including accounting and tax retention, product safety and consumer protection.
The legal bases above refer to Article 6(1) of the EU General Data Protection Regulation, where it applies to you.
Who we share it with
We disclose personal data only to the extent necessary, and only to:
- our hosting provider, which stores and serves the website;
- Stripe, our payment service provider, which processes the payment;
- the carriers that deliver your parcel, which receive the delivery details needed to do so;
- our email and form-handling providers, which transmit and store your messages;
- professional advisers (legal, accounting) bound by confidentiality;
- public authorities, where disclosure is required by law or to establish, exercise or defend a legal claim.
Our hosting, email and form providers act as processors on our instructions. Stripe acts as an independent controller for payment processing and fraud prevention, under its own privacy policy. Online marketplaces that also sell our products are likewise independent controllers.
International transfers
Bioshop L.L.C. is established in the United States and our providers may process data in the United States or other countries. Where personal data of individuals in the European Economic Area, Switzerland or the United Kingdom is transferred outside those territories, we rely on appropriate safeguards — in particular the European Commission's Standard Contractual Clauses, together with supplementary measures where required. You may request a copy of the relevant safeguards at the address above.
How long we keep it
- Order and invoicing records: retained for the period required by accounting and tax law — ten years in France, and the equivalent period elsewhere.
- Delivery and customer-service data linked to an order: three years from the last contact, unless a longer period is required to handle a warranty claim or a dispute.
- Contact enquiries: up to three years from our last exchange with you, then deleted.
- Server logs: a short technical retention period defined by our hosting provider, generally no more than twelve months.
- Data retained to satisfy a legal or accounting obligation: for the period prescribed by the applicable law.
How we protect it
The website is served over an encrypted HTTPS connection. Access to messages you send us is restricted to the people who need it in order to reply. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your rights in the European Economic Area and the United Kingdom
If the GDPR or UK GDPR applies to you, you have the right to: access your data; have inaccurate data corrected; have your data erased; restrict processing; object to processing based on legitimate interest; receive your data in a portable format; and withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, write to info@bioshopessentials.com. We answer within one month, extendable by two further months for complex requests. We may ask for information needed to confirm your identity.
You also have the right to lodge a complaint with your national supervisory authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
Your rights in California and other US states
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to know what personal information we collect and how we use it; to request deletion; to request correction; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so no opt-out mechanism is required. Residents of other US states with comparable privacy laws may exercise equivalent rights by writing to us at the address above.
Children
This website is not directed at children. We do not knowingly collect personal data from anyone under sixteen years of age, or under thirteen where that is the applicable threshold. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this policy to reflect changes in our practices or in the law. The date at the top of this page indicates the most recent revision. Material changes will be signalled on this page.