How personal data is handled.

Data controller

Data-protection enquiries should be addressed to contact@bonategia.com.

Data collected

Bonategia collects only the information provided directly through correspondence: name, the company represented, contact details, and the content of messages and documents sent to the company.

The public website sets no tracking cookies. No third-party analytics, advertising pixels, or social-media scripts are loaded. Server access logs are retained for a short window for security purposes only.

Purposes of processing

• Responding to enquiries and coordinating trade conversations (legitimate interest, GDPR Art. 6(1)(f), and pre-contractual measures, Art. 6(1)(b)).
• Complying with legal and regulatory obligations — including sanctions screening, anti-money-laundering, and record-keeping (Art. 6(1)(c)).
• Supplier and buyer due diligence, on the basis of the legitimate interest of operating a verifiable trading company (Art. 6(1)(f)).

Recipients of data

Personal data is not sold or rented. Limited disclosures may occur to:

• Trading counterparties (suppliers, customers, carriers) when transfer is necessary to perform the engagement, with the data subject's awareness.
• Service providers engaged by the company for its own operations (e.g. accounting, banking, e-invoicing PDP) under contract and on a need-to-know basis.
• Public authorities, where compelled by applicable French or EU law.

International transfers

International trading by its nature involves counterparties outside the European Economic Area. Where information is shared with counterparties in third countries, the lawful basis is Article 49(1)(b) GDPR (performance of a contract or pre-contractual measures) and, where appropriate, Standard Contractual Clauses.

Retention

Correspondence is retained while a commercial relationship is active and for the duration required by applicable bookkeeping and tax law (ten years under French Code de commerce, Art. L123-22). Beyond that, data is deleted or anonymised.

Rights of the data subject

Under the GDPR, the data subject may request access to personal data, rectification, deletion, restriction of processing, portability, and may object to processing carried out on the basis of legitimate interest. A complaint may be lodged with the Commission Nationale de l'Informatique et des Libertés (CNIL) at www.cnil.fr.

Rights requests should be sent to contact@bonategia.com.

Changes to this notice

This notice is updated when practices change. The effective date at the top of the page reflects the current version.