We only collect what we need to run your orders well, and we're transparent about it. This policy explains the rest.

1. Who is responsible for your data

The data controller is ZY Agency SARL-S (RCS Luxembourg B272241), operator of Bammat. Contact details are in our Legal Notice. For any privacy matter, write to privacy@bammat.com.

2. Data we collect

• Account data — name, email, phone number, password (stored securely).
• Order data — delivery address, basket contents, replacement preferences, delivery notes, order history.
• Payment data — handled by our payment provider; we receive confirmation and limited details, not your full card number.
• Location data — the address you enter, used to show stores that serve you and to route delivery.
• Technical & usage data — device, app version, IP address, and how you use the Platform.
• Communications — messages you send us and to your shopper about an order.

3. How & why we use it

• To create and manage your account.
• To take, shop, deliver and support your orders, including notifying you about replacements and delivery.
• To process payments and issue refunds.
• To provide customer support and handle disputes.
• To keep the Platform secure and prevent fraud and misuse.
• To improve our service and, where permitted, send you service-related or (with consent) marketing messages.
• To comply with our legal and accounting obligations.

4. Legal bases (GDPR)

• Performance of a contract — to provide the service you order.
• Legitimate interests — to secure, operate and improve the Platform, and prevent fraud.
• Consent — for optional cookies and marketing, which you can withdraw at any time.
• Legal obligation — to meet tax, accounting and consumer-law requirements.

5. Who we share it with

We share personal data only as needed to run the service:

• Shoppers and couriers — the details needed to shop and deliver your order (e.g. name, address, phone, basket).
• Partner stores — order information required to fulfil your purchase.
• Payment provider — to process your card payment securely.
• Service providers — hosting, notifications, analytics and support tools acting on our instructions.
• Authorities — where required by law.

We do not sell your personal data.

6. Cookies

We use cookies and similar technologies as described in our Cookie Policy, where you can also manage your preferences.

7. International transfers

Where a provider processes data outside the European Economic Area, we ensure appropriate safeguards are in place (such as European Commission standard contractual clauses) so your data remains protected.

8. How long we keep it

We keep personal data only as long as necessary for the purposes above — for the life of your account and, afterwards, for the periods required to meet legal, tax and accounting obligations or to resolve disputes. We then delete or anonymise it.

9. Your rights

Subject to conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing.

To exercise any right, contact privacy@bammat.com. We may need to verify your identity.

10. Security

We use appropriate technical and organisational measures to protect your data. No system is completely secure, but we work to keep your information safe and to respond quickly to any incident.

11. Contact & complaints

Questions? Email privacy@bammat.com. If you believe we've mishandled your data, you may lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD), or the authority in your country of residence.

This policy may be updated from time to time; the current version is always published here.