Your details, handled with care

We are established in the United Kingdom, so we work under the UK General Data Protection Regulation and the Data Protection Act 2018. We also offer goods to people who live in the European Union. For that reason the EU General Data Protection Regulation (GDPR) applies to the way we handle the data of those customers, under its Article 3(2), alongside the UK rules. Where the two differ, customers in the EU get the protection of the GDPR.

In practice this means every right described in the chapter “Your rights” is yours, wherever you live among the countries we deliver to, and you may take a complaint to the data protection authority of your own country.

When you place an order

First name, last name, phone number, delivery address, town, postcode and country; your email address if you choose to give it; any note you leave for the courier; the item, quantity and total; the date and time; the IP address the order came from; and a short label saying which advertisement or page led to the order.

• To confirm the order by phone, deliver it, collect payment and handle returns and guarantee claims. Legal basis: taking steps at your request before a contract and performing that contract (Article 6(1)(b)).
• To keep invoices and accounting records. Legal basis: legal obligations that apply to us as a company (Article 6(1)(c)).
• To spot and stop abuse, such as floods of fake orders from one connection or repeat orders that are never collected. Legal basis: our legitimate interest in keeping the shop working and couriers paid for real deliveries only (Article 6(1)(f)).

During and after the confirmation call

We note the outcome of the call (confirmed, changed, cancelled, not reached) and any correction you give us. If a call is going to be recorded, you are told at the start and may decline. Legal basis: performing the contract.

When you write to us

The topic you picked, your name, email address, order reference if you gave one, your message, the date and time and the IP address. We use them to answer you and, where the message is about an order, keep it with that order. Legal basis: your consent, given with the tick box on the form (Article 6(1)(a)); for messages about an order, also the contract. You can withdraw consent at any time by writing to us; this does not affect what was done before.

When we pay a refund

The account holder’s name and IBAN you send us, used once to make the transfer. Legal basis: the contract and our legal obligations. We never ask for card numbers, PINs or passwords.

When you browse

Our hosting provider keeps short-lived technical logs (IP address, time, page requested, browser type) to keep the site secure and working. Legal basis: legitimate interest. Your cookie choice and a few functional items are stored in your own browser. Advertising tags from Google Ads and Meta are used only with your consent (Article 6(1)(a)). Names, purposes and durations are on the cookies page.

You are not obliged to give us any data. Without a name, a reachable phone number and a delivery address, though, we cannot confirm or deliver an order. Our shop is meant for adults: we do not knowingly take orders from anyone under 18.

The advertising for BonnyBuy is run by SCROLLWORK LLC (30 N Gould St, Ste R, Sheridan, WY 82801-6317, United States), a business separate from the seller. It creates and manages the advertising campaigns and holds the advertising accounts with Google and Meta.

It is not the seller and not the controller of your order data. We do not pass it your name, address, phone number, email or messages. What it can see are the figures the advertising platforms report: how many people saw or clicked an advertisement and, if you accepted advertising cookies, that an order of a certain value followed, identified by an order number and not by your identity.

Only those who need it for the purposes above:

• Courier companies in your country: name, address, phone number, courier note and the amount to collect.
• Phone confirmation partners (call-centre services) that ring you on our behalf to confirm the order: your order details, used on our instructions only.
• Order-fulfilment partners that pack, label and dispatch parcels for us in or near your country. On product pages written in the language of your country, the order form sends your details directly to the partner serving that country, which handles them for us, and a copy to us.
• Hosting, database and email-delivery providers that run this website, store order records and carry our email.
• Accountants, auditors and tax authorities, as the law requires, and our bank when a refund is paid.
• Google and Meta, only if you accepted advertising cookies, and only the technical data described on the cookies page.
• Courts, police or regulators, where the law obliges us.

Providers that handle data for us do so under a written contract that limits them to our instructions, requires confidentiality and security, and ends with deletion or return of the data.

Your order is handled in the United Kingdom, which the European Commission has recognised as offering adequate protection for personal data. Data sent from us to couriers and partners in your country returns to the EU under the matching UK arrangements.

Some of our hosting, database and email providers are based in the United States or have parent companies there. Transfers to them rely on an adequacy decision where the provider takes part in the EU–US Data Privacy Framework (and its UK extension), and otherwise on the European Commission’s standard contractual clauses together with the UK addendum. You can ask us for a copy of the safeguards that apply to a particular provider.

• Delivered orders, invoices and refund records: six years after the end of the financial year they belong to, the period company and tax records must be kept.
• Orders that were cancelled, never confirmed or returned uncollected: twelve months, then deleted or made anonymous.
• Messages sent through the contact form or by email: two years after our last reply, unless they belong to an order, in which case they follow the order.
• Bank details for a refund: deleted from our mailbox and notes once the transfer has gone through; the payment itself remains in our accounting records.
• Technical logs: up to 30 days.
• Items stored in your browser: under your control; see the cookies page.

If a dispute or claim is open, we keep what is relevant until it is closed.

You may, at any time and free of charge:

• ask whether we hold data about you and receive a copy of it (access);
• have wrong or incomplete data corrected;
• have data deleted where we no longer need it, where you withdraw consent, or where you object and we have no overriding reason to keep it;
• have the use of your data restricted while a question is sorted out;
• receive the data you gave us in a common electronic format, or have it sent to another company (portability);
• object to processing based on our legitimate interests, for reasons relating to your situation;
• withdraw a consent you gave, including your cookie choice, with effect for the future;
• ask for a person to review any decision made by automated means.

Write to hello@bonnybuy.com or to our postal address. To protect you, we may ask for your order reference and the phone number used for the order before we act; we ask for an identity document only if there is no other way to be sure. We answer within one month. If a request is complex we may need up to two further months, and we will tell you so within the first month.

We would like the chance to put things right first, so please write to us. You may also complain at any time to a supervisory authority. Ours is the Information Commissioner's Office (Scotland office), Queen Elizabeth House, Sibbald Walk, Edinburgh EH8 8FT. If you live in the European Union you may complain instead to the data protection authority of the country where you live or work.

The site is served over an encrypted connection. Order records are kept in a database that only the people who process orders can reach, behind individual logins that lock after repeated failed attempts. Forms carry a one-time token so that they can only be submitted from this site. No system is perfectly safe; if a breach ever puts you at risk, we will tell you and the authority as the law requires.

When this notice changes, the date at the top changes with it. If a change affects how we use data we already hold about you in a way you would not expect, we will tell you directly where we have your contact details.