This policy covers the belcova.fr website. The tax-free service, which will open once we are approved, will come with its own privacy notice.
Data controller
BELCOVA SAS, 58 rue de Monceau, 75008 Paris, France, Paris RCS 104 126 727. For any question about your data: rgpd@belcova.fr.
What we collect, and why
Waitlist
- Data: your email address, the site language and the sign-up date.
- Purpose: telling you when Belcova launches. Nothing else.
- Legal basis: your consent (GDPR article 6(1)(a)), given when you sign up.
- Retention: until you unsubscribe, and at most 3 years after our last contact.
The list is kept in a Cloudflare D1 database located in Western Europe. To limit abusive sign-ups, the IP address of the request is used to cap the number of attempts per minute (an ephemeral Cloudflare counter) and for the Turnstile anti-bot check; it is never stored with your address.
"Become a partner retailer" requests
- Data: your name, your store or brand name, your work email address, the city of the store and, if you give them, your phone number and an estimate of your monthly tax-free sales; the site language and the date of the request.
- Purpose: contacting you about a partnership and building our approval file with French Customs.
- Legal basis: our legitimate interest in finding partners and preparing our approval (article 6(1)(f)).
- Retention: 3 years after our last contact.
Requests are kept in the same Cloudflare D1 database in Western Europe, separately from the waitlist. The IP address is only used to cap attempts and for the Turnstile check; it is never stored with the request. You can object to this processing at any time by writing to rgpd@belcova.fr.
Messages sent to contact@belcova.fr
- Data: your address, the content of your message and any contact details you choose to share.
- Purpose: replying to you (travellers, retailers, partners).
- Legal basis: our legitimate interest in answering requests sent to us (article 6(1)(f)).
- Retention: 3 years after our last contact.
Audience measurement, only with your consent
- Data: Google Analytics cookie identifiers, pages viewed, connection data (IP address, browser).
- Purpose: understanding site traffic to improve it.
- Legal basis: your consent (article 82 of the French Data Protection Act, GDPR article 6(1)(a)).
- Retention: cookies 13 months at most; audience data at Google 14 months at most. Your choice is kept for 6 months, then we ask again.
Until you accept, Google Tag Manager is not loaded and no data is sent to Google. If you decline, nothing is loaded. You can withdraw your consent at any time: .
Technical logs
- Data: IP address, date, requested page, browser.
- Purpose: running and securing the site.
- Legal basis: our legitimate interest in keeping the site secure (article 6(1)(f)).
- Retention: kept by our host for a short period, 30 days at most.
We never sell your data or use it for targeted advertising or automated decisions.
Recipients and processors
Only BELCOVA's directors and the providers that help us run the site can access your data:
- Cloudflare, Inc. (USA, certified under the Data Privacy Framework) — site hosting and technical logs; waitlist and retailer request storage (D1 database in Western Europe); Turnstile anti-bot check when forms are sent (technical browser data and IP address, no advertising cookie).
- Google — audience measurement (Google Analytics, Google Tag Manager) after your consent, and the contact@belcova.fr mailbox (Google Workspace).
Some of these providers process data in the United States. Transfers rely on the EU–US Data Privacy Framework for certified providers and, otherwise, on the European Commission's standard contractual clauses.
Your rights
At any time you can:
- access your data and get a copy;
- have it corrected or erased;
- object to its processing or ask for it to be restricted;
- withdraw your consent, without affecting processing already carried out;
- ask for data portability;
- set instructions for what happens to your data after your death.
Write to rgpd@belcova.fr or to BELCOVA SAS, 58 rue de Monceau, 75008 Paris, France. We reply within one month. To leave the waitlist, a short message is enough.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL): cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Security
Traffic to the site is encrypted (HTTPS). Access to the tools that hold your data is restricted to BELCOVA's directors.
Changes
We will update this page if our processing changes; the last-updated date is shown at the top.