Privacy Policy

Last updated: 13 May 2026

1. Who We Are

Bonvale UK Limited (company number 17142585), incorporated in England and Wales, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("Bonvale", "we", "us", "our"), is the data controller for personal data collected from customers in the United Kingdom through our website (bonvale.com), mobile application, and related services (our "Services"). Because Bonvale UK Limited is established in the United Kingdom, we are not required to appoint an Article 27 representative under the UK GDPR. Any privacy queries should be directed to us at the contact details in Section 17. We may share personal data with the Bonvale group and related entities as described in Section 6. Where data is transferred outside the United Kingdom, appropriate safeguards apply (see Section 7).

2. Personal Data We Collect

2.1 Data You Provide Directly

When you create an account, place an order, contact us, or otherwise use our Services:

• Identity: full name, date of birth
• Contact: email address, telephone number, postal address
• Account: username, password (stored in hashed form), preferences
• Transaction: products purchased, order and returns history, payment method type (full card numbers are held by our payment gateway, not by Bonvale)
• Communications: messages sent to our customer care team
• Marketing preferences: email, SMS, and push notification opt-in and opt-out choices

2.2 Data We Collect Automatically

When you visit our Website or use our App:

• Device and technical: IP address, browser type and version, operating system, device identifiers, time zone
• Usage: pages viewed, products browsed, search queries, clickstream, session duration, referral source
• Tracking: data collected via cookies, pixels, and similar technologies (see Section 5)
• Location: approximate location from IP address (we do not collect GPS location unless you grant App permission)

2.3 Data We Receive From Third Parties

• Payment gateways: transaction status, fraud risk signals, and payment verification data
• Logistics providers: delivery status, confirmation, and address validation data
• Meta Platforms: aggregated advertising performance data and, where you have consented to Meta's terms, audience matching data via the Meta Pixel (see Section 5)
• Google: analytics and advertising performance data via Google Analytics and Google Ads (see Section 5)

3. How and Why We Use Your Personal Data

The table below maps our processing purposes to the lawful basis we rely on under UK GDPR and our default retention period.

Our legitimate interests assessments are available on request from privacy@bonvale.com.

4. Marketing Communications

We send marketing communications (email, SMS, push notifications) only where you have given consent. You may withdraw consent at any time by:

• Clicking 'unsubscribe' in any marketing email
• Replying STOP to any marketing SMS
• Adjusting push notification preferences in your device settings or Bonvale account
• Contacting us at privacy@bonvale.com

Withdrawing marketing consent does not affect transactional communications (order confirmations, dispatch, returns), which are sent under our contract with you. United Kingdom: Privacy and Electronic Communications Regulations (PECR) The Privacy and Electronic Communications Regulations 2003 apply to our email, SMS, and push notification marketing. We contact you by electronic means for marketing purposes only with your prior opt-in consent (or, where permitted, under the "soft opt-in" rule for existing customers of similar products, in which case you have the right to opt out at any time and in every message we send).

5. Cookies, Pixels, and Tracking Technologies

5.1 What We Use

Essential Cookies Strictly necessary for core functionality including shopping basket, login, security, and fraud prevention. Cannot be disabled. Analytics Cookies: Google Analytics We use Google Analytics (Google LLC) to understand how visitors use our Website including pages visited, session duration, referral source, and device. This aggregated data improves our Services. Data is transferred to Google's servers, which may be outside the United Kingdom (see Section 7). You may opt out via the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout or by rejecting analytics cookies in our consent banner. Advertising and Targeting Cookies: Meta Pixel We use the Meta Pixel (Meta Platforms, Inc.) to measure advertising effectiveness, build audiences, and track conversions. When active, it collects your IP address, browser data, page URL, and on-site actions (such as product views and purchases). This data is transmitted to Meta and used to serve targeted advertisements on Facebook, Instagram, and the Meta Audience Network ('retargeting'). Meta may also use it for its own purposes under its Privacy Policy. We activate the Meta Pixel only with your consent; you may withdraw consent at any time via your cookie preferences.

5.2 Consent Management

We use Shopify's native cookie consent banner to manage cookie consent on our Website. On your first visit, our cookie banner presents the categories of cookies in use. Non-essential cookies, including analytics and advertising categories, do not activate until you actively accept them. Your consent choice is recorded with a timestamp and the version of this Policy in force at the time, so we can demonstrate valid consent if required. You can review or change your preferences at any time via the "Cookie Settings" link in the footer of our Website. Withdrawing consent for a category takes effect immediately. Any tracking scripts relying on that consent will stop firing for your session.

5.3 Your Cookie Choices

Manage preferences via our cookie preference centre (footer of our Website), your browser settings, or the opt-out tools provided by Google and Meta. Restricting certain cookies may affect Website functionality.

6. Who We Share Your Personal Data With

We do not sell or rent your personal data. We share it only as described below.

6.1 Service Providers

We share data with service providers acting under our instruction, including:

• Shopify Inc.: storefront platform, transactional emails, order notifications, and native cookie consent management.
• Shopify Payments and Klarna Bank AB (publ): payment processing, fraud screening, and Buy Now, Pay Later. Your full card details are held by the relevant payment provider, not by Bonvale.
• KEC and KLN: outbound logistics from our fulfilment warehouse and inbound returns logistics to our local UK returns warehouse.
• Royal Mail Group plc: last-mile delivery within the United Kingdom.
• Loop Returns, Inc. (with EasyPost for return label generation): returns and exchanges portal.
• Gorgias, Inc.: customer support and ticketing.
• Klaviyo, Inc.: marketing emails, SMS, and push notifications.
• Amazon Web Services, Inc.: cloud infrastructure for custom apps and integrations.
• Google LLC (Google Analytics): Website usage analytics.
• Meta Platforms, Inc. (Meta Pixel): advertising measurement and audience targeting, subject to consent.

6.2 Legal and Regulatory Disclosure

We disclose personal data to law enforcement, courts, or regulators only where required by law, court order, or regulatory direction. We will notify you of such disclosures where legally permitted.

6.3 Business Transfers

If Bonvale UK Limited undergoes a merger, acquisition, or asset sale, your data may transfer to the relevant entity. We will notify you and ensure equivalent protections apply.

6.4 Group Companies

We may share data with the Bonvale group and related entities for the purposes set out in this Policy, including group-wide analytics, IT infrastructure, and customer support. All intra-group transfers are covered by an intra-group data transfer agreement incorporating the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, as applicable (see Section 7).

7. International Transfers of Personal Data

Bonvale UK Limited is established in the United Kingdom. Some of our service providers and group companies are located outside the United Kingdom, which means your personal data may be transferred to and processed in countries whose data protection laws differ from those of the United Kingdom. Where we transfer your personal data outside the United Kingdom, we rely on appropriate safeguards under Chapter V UK GDPR, which may include:

• Transfers to a country subject to UK "adequacy" regulations (for example, to EEA countries under the UK's adequacy decision);
• UK International Data Transfer Agreements (IDTAs);
• The UK Addendum to the EU Standard Contractual Clauses; and/or
• Other approved safeguards (for example, Binding Corporate Rules).

Intra-group transfers to other members of the Bonvale group and related entities are made under intra-group data transfer agreements using the UK IDTA or UK Addendum, as applicable. You may request a copy of the relevant mechanism by contacting privacy@bonvale.com.

8. How Long We Keep Your Personal Data

We retain personal data only as long as necessary for the relevant purpose and our legal obligations.

On expiry of the retention period, we securely delete or anonymise data. Where immediate deletion is not possible (e.g. backup systems), we isolate the data and restrict access until deletion occurs.

9. How We Protect Your Personal Data

We implement technical and organisational measures to protect your data, including:

• Encryption in transit (TLS/SSL) and at rest
• Access controls and role-based permissions
• Regular security assessments and penetration testing
• Staff data protection training
• Incident response procedures (see Section 10)

Payment card data is processed by our PCI-DSS certified payment gateway. We do not store full card numbers. If you believe your account has been compromised, contact us at privacy@bonvale.com immediately.

10. Data Breach Notification

On becoming aware of a personal data breach likely to pose a risk to you, we will:

• Investigate its nature and scope
• Notify the Information Commissioner's Office (ICO) within the timeframes set out below
• Notify affected individuals without undue delay where the breach poses a high risk
• Document the breach and our response

United Kingdom: ICO Notification (UK GDPR Articles 33 & 34) Under UK GDPR Article 33, we must notify the ICO within 72 hours of becoming aware of a breach likely to pose a risk to individuals. Where the breach poses a high risk, we must also notify affected individuals directly under Article 34. Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

To exercise any right, contact privacy@bonvale.com. We respond within one month and may ask you to verify your identity. We do not charge for requests unless manifestly unfounded or excessive.

12. Complaints & Supervisory Authority

If you have a concern about how we handle your personal data, we ask that you contact us first at privacy@bonvale.com so we can attempt to resolve your concern directly. You have the right to lodge a complaint with the Information Commissioner's Office at any time:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Under Article 21 of the UK GDPR, you may object at any time to profiling for targeted advertising (including via the Meta Pixel and Google Ads) by contacting privacy@bonvale.com or through your cookie preferences.

13. Children's Privacy

Our Services are for individuals aged 18 and over. We do not knowingly collect data from under-18s. If you believe a child has provided us with their data, contact privacy@bonvale.com and we will promptly delete it unless retention is required by law.

14. Third-Party Links

Our Website and App may link to third-party sites. This Policy does not cover those sites and we are not responsible for their privacy practices.

15. Cookie Policy

What are cookies? Cookies are small text files placed on your device when you visit our Website. They allow the site to remember your actions and preferences over time, and help us and our third-party partners understand how visitors interact with our content. Similar technologies, including pixels and device identifiers, work in an equivalent way. The cookies we use We use four categories of cookies. The table below lists each cookie, who sets it, what it does, and how long it remains on your device. Category 1: Strictly Necessary These cookies are essential for our Website to function. They cannot be disabled. No consent is required to set them.

Category 2: Analytics These cookies help us understand how visitors use our Website including which pages are visited, how long sessions last, and where visitors come from. The data is aggregated and not used to identify you personally. These cookies are set only with your consent.

Google Analytics data is transferred to Google's servers, which may be located outside the United Kingdom. See Section 7 of this Policy on international transfers. You may opt out of Google Analytics tracking at any time using the Google Analytics Opt-Out Browser Add-on or by adjusting your preferences in our cookie banner. Category 3: Marketing and Advertising These cookies are used to deliver targeted advertising based on your browsing and purchase behaviour on our Website, and to measure the effectiveness of our advertising campaigns. They are set only with your consent.

Meta Pixel data is transferred to Meta's servers in the United States. See Section 7 on international transfers and Section 5.1 for a full description of how the Meta Pixel operates. Managing your preferences You can review and change your cookie preferences at any time by clicking Cookie Settings in the footer of our Website. You can also:

• Use your browser settings to block or delete cookies. Note that blocking strictly necessary cookies will affect core Website functionality.
• Opt out of Google Analytics via the Google Analytics Opt-Out Browser Add-on.
• Manage your Meta advertising preferences at facebook.com/ads/preferences.

Withdrawing consent for analytics or advertising cookies takes effect immediately. It does not affect the lawfulness of any processing that took place while consent was in place. Keeping this table up to date We review and update this cookie table whenever we add, change, or remove tracking technologies from our Website. The "Last Updated" date at the top of this Policy reflects the most recent revision. A live and automatically updated version of this table is also accessible via your cookie preference centre.

16. Updates to This Policy

We may update this Policy to reflect changes in our data practices, applicable law, or our Services. The updated Policy will be published with a revised 'Last Updated' date. For material changes, we will notify you by email or prominent Website notice before the change takes effect. Continued use of our Services after the effective date constitutes acceptance of the updated Policy.

17. Contact Us

For all privacy queries, requests, and complaints: Email: privacy@bonvale.com We aim to respond within one month. If unsatisfied, you may escalate to the Information Commissioner's Office (see Section 12).