Personal data
Privacy Policy
What data we collect, why, how long we keep it and how to take back control. Updated 4 August 2026. This English version is provided for information only; in the event of any discrepancy, the French version prevails.
Contents
Who processes your data
The data controller is BHM EXPORT, a French private limited company (SARL) with share capital of €60,000, 82 rue Manin, 75019 Paris, Paris Trade and Companies Register 819 429 200, operating the website hk-handmade.com under the trading name HK Handmade.
No data protection officer has been appointed, as this is not mandatory for our activity. For any question, write to contact@hk-handmade.com.
What we collect, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing and tracking orders | Name, delivery and billing addresses, email, telephone, order details | Performance of the contract | 10 years (accounting obligation) |
| Payment | Amount, transaction status, payment identifier | Performance of the contract | 13 months with the provider |
| Customer account | Login details, order history | Performance of the contract | Until deletion, then after 3 years of inactivity |
| Replying to your messages | Name, email, content of the message | Legitimate interest in replying to you | 3 years after the last exchange |
| Analytics | Pages viewed, browsing path, device, browsing data | Consent | 13 months maximum |
| Advertising and campaign measurement | Advertising identifiers, purchase events | Consent | 13 months maximum |
| Site security | IP address, connection logs | Legitimate interest in securing the service | 12 months |
We do not collect any sensitive data, and we carry out no automated profiling producing legal effects and no automated decision-making concerning you.
Your payment card details
We never have access to your card numbers. Payment is processed directly by our payment provider, which alone handles this data in an environment certified as compliant with the PCI-DSS standard.
Who receives your data
We do not sell or rent your data. It is shared only with the service providers needed to run the service, who act on our instructions:
| Provider | Role | Location |
|---|---|---|
| Hostinger International Ltd | Website hosting and email delivery | European Union (Cyprus) |
| Stripe Payments Europe Ltd | Payment processing | European Union (Ireland), with possible transfers outside the EU |
| Google Ireland Limited | Analytics, advertising and catalogue distribution | European Union (Ireland), with possible transfers outside the EU |
| Carrier | Parcel delivery | France |
Your data may also be disclosed to an administrative or judicial authority where the law requires it.
Transfers outside the European Union
Some of our providers belong to groups with entities established outside the European Union, notably in the United States. These transfers are governed by the safeguards set out in Chapter V of the GDPR: the European Commission’s standard contractual clauses and, where applicable, an adequacy decision.
Your rights
You have the following rights over the data that concerns you:
- Access : obtain a copy of your data.
- Rectification : correct inaccurate or incomplete information.
- Erasure : request deletion, subject to our legal retention obligations.
- Restriction : freeze the use of your data while a dispute is examined.
- Objection : object to processing based on our legitimate interest.
- Portability : receive your data in a structured, machine-readable format.
- Withdrawal of consent : at any time, without affecting what was done before.
- Instructions after death : decide what happens to your data after your death.
To exercise these rights, write to contact@hk-handmade.com. We reply within one month, which may be extended by two months if the request is complex. Proof of identity may be requested in case of reasonable doubt.
Complaints
If you believe the processing of your data is not compliant, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
Security
The site is served entirely over HTTPS. Administrative access is restricted and passwords are stored in encrypted form. Our payment and hosting providers apply their own technical and organisational measures.
Cookies
The trackers placed during your visit, their purpose and their duration are detailed in our cookie policy. You can change your choices at any time from that page.
Changes to this policy
This policy may be amended to reflect legal or technical changes. The date of the last update appears at the top of the page.