Privacy policy

1. Data controller

The data controller is [to be completed : company name], [to be completed : registered address]. For any question about your data: [to be completed : contact email].

2. Data we collect

• Account: name, phone number, email address, password (stored hashed), profile photo if you add one, language and notification settings; your Google ID if you sign in with it.
• Orders: products, quantities, amounts, delivery address and wilaya, recipient’s phone, delivery method, order status and messages about it (return, complaint).
• Payments: payment method chosen, amount, date, status and transaction reference. Your card details are entered with the payment provider: we never see or store them.
• Contact and newsletter: messages sent with the contact form (name, email, phone, topic, message) and your address if you subscribe to the newsletter.
• Technical data: IP address, device and browser type, technical and security logs. Audience measurement (if we turn it on): Umami, installed on our own server, without cookies; your account pages and payments are not counted.

We do not ask for any sensitive data within the meaning of Law No. 18-07.

3. Why we process it

• Manage your account and sign you in securely.
• Process your orders: payment, preparation, delivery, tracking, returns and customer service, under the terms of sale.
• Keep the accounts and meet our legal obligations.
• Prevent fraud and abuse.
• Send you notifications about your orders and, if you chose to, our offers; you can turn them off at any time.
• Improve the website using aggregated statistics.

4. Who receives your data

Your data is never sold. It is available to our authorised staff (order preparation, customer service, accounting), whose actions are logged, to the authorities where the law requires, and to our providers, each for its own task only:

• Carriers and pick-up points: name, phone and delivery address, parcel contents and amount if paid on delivery.
• Chargily and SATIM: CIB or Edahabia card payments (amount, order reference, and the card details you enter with them).
• An SMS operator and Meta (WhatsApp Cloud API): sign-in codes and order notifications (your number and the message).
• Resend: sending emails (your address and the email content).
• Google: sign-in with your Google account, if you choose it.
• Your browser’s notification services (Google, Mozilla, Apple…) for web notifications: device token and notification content.

5. Hosting and transfers outside Algeria

The website, database and files are hosted by the host named in the legal notice. Some providers (Meta, Resend, Google, notification services) are based outside Algeria: using the related features means data is transferred abroad, under the rules of Law No. 18-07 (authorisation from the ANPDP and an adequate level of protection in the receiving country).

6. How long we keep it

• Account: while it is active. Once closed, it is permanently deleted after 30 days (see Delete my account).
• Orders and payments: for the period required by accounting and tax rules, detached from your account if it is deleted.
• Messages sent with the contact form: 24 months at most.
• Newsletter: until you unsubscribe.
• Sign-in codes: a few minutes (single use).
• Technical and security logs: 12 months. Backups: 5 weeks at most.

7. Cookies and local storage

The website only sets the cookies it needs to work. We use no advertising or audience-measurement cookies.

The website may also keep your basket in your browser (local storage); it is only sent to us when you order.

8. Security

Traffic is encrypted (HTTPS), session cookies are not readable by JavaScript, codes and passwords are stored hashed, access to data is limited to authorised staff and staff actions are logged.

9. Your rights

Law No. 18-07 gives you the right to information, access, rectification and objection (in particular to marketing), and the right to withdraw your consent.

• Change your details: from your account.
• Get a copy: “Download my data” in your profile.
• Delete your account: see Delete my account.
• Turn off notifications and offers: in your settings or with the unsubscribe link in each email.

For any other request, write to [to be completed : contact email] from the phone number or address linked to your account. We answer within one month. You may also contact the national personal data protection authority (ANPDP).

10. Minors

Accounts and orders are for adults only. We do not knowingly collect data about minors.

11. Changes

We may update this policy; the date of the last update is shown at the top of this page. Account holders are told about important changes.