Privacy Policy

Last updated: 01.10.2026

We take the protection of your personal data seriously. This policy explains which data we process when you use bambimart.com, why we do it and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

BambiMart SH.P.K., Abedin Mërlaku 99, 32000 Klinë, Kosovo, email: info@bambimart.com.

2. Visiting the website

When you visit our website, our hosting provider automatically processes technical data that your browser sends (IP address, date and time, pages visited, browser and operating system). We need this data to deliver the website and keep it secure (Art. 6(1)(f) GDPR). It is stored only for a short time, unless it is needed to investigate a security incident.

We also keep our own visitor statistics, without cookies. From your IP address and browser we compute a code that changes every day, so a visitor counts once per day but can't be recognised later; the IP address itself is not stored. We record which pages are opened, where the visit came from (for example the link of an ad), and whether products were put in the cart or ordered (Art. 6(1)(f) GDPR; our legitimate interest is improving the shop and measuring our ads). This data stays on our own servers and is deleted after 13 months.

3. Cookies

We only use cookies that are technically necessary for the shop to work. We do not use tracking, analytics or advertising cookies.

• bm_cart – remembers the products in your cart (30 days).
• .AspNetCore.Culture – remembers your language (1 year).
• bm_code – remembers a discount code you entered (30 days).
• bm_app – remembers that you closed the app bar on your phone, so it stays away (30 days).
• bm_favs – remembers the products you saved with the heart while not signed in (1 year).
• BambiMart.Auth – keeps you signed in to your account (up to 7 days with “Keep me signed in”, otherwise until you close the browser).
• Security and message cookies – protect forms against misuse and show short notices such as “added to cart” (end of session).

Because these cookies are strictly necessary, no consent is required (Art. 5(3) ePrivacy Directive and the national laws implementing it; Art. 6(1)(b) and (f) GDPR).

BambiMart as an app. If you add BambiMart to your home screen and open it from there, your device keeps a copy of our design files (styles, scripts, fonts, logo) and of a short “You’re offline” page, so the app opens quickly and tells you when there is no internet. No personal data is stored this way. A visit in the browser stores nothing of this. Removing the app deletes the copy.

4. Orders

When you order, we process your name, delivery address, email address, phone number (if provided), the ordered products and payment information in order to process and deliver your order (Art. 6(1)(b) GDPR). We keep this data for as long as required by tax and commercial law, usually up to 10 years (Art. 6(1)(c) GDPR).

5. Customer account

You can shop without an account. If you create one, we process your name, email address, password (stored only as a secure hash), language, saved addresses, favourites, cart, the products you viewed while signed in, and your choice about offers by email (with the date of your consent). We use this data to provide your account (Art. 6(1)(b) GDPR). Guest orders placed with your email join your account once you have confirmed the address. You can download all of this data or delete your account at any time under My account → Profile; orders are then kept only as long as the law requires, without a link to the account.

6. Reviews and the email after delivery

About two days after delivery we send you one email asking you to rate the products you bought (Art. 6(1)(f) GDPR; for customers, as permitted for similar products we sell). You can object at any time, free of charge, with the link in that email or by writing to us; we then send you no more review requests. If you write a review, we publish your rating, text and photos with your first name and the initial of your last name on the product page (Art. 6(1)(a) GDPR). You can ask us to remove your review at any time.

7. Withdrawals and back-in-stock alerts

If you use our withdrawal button, we keep your withdrawal statement (name, email, order, products, date and time) to handle the return and refund and as proof (Art. 6(1)(b) and (c) GDPR). If you ask us to tell you when a sold-out product is back, we store your email for that single message and close the request once it is sent (Art. 6(1)(a) GDPR).

8. Offers by email

If you sign up for new products and offers, we only send them after you have confirmed your address with the link in our confirmation email (double opt-in, Art. 6(1)(a) GDPR). We store your email address, language and the dates of sign-up, confirmation and unsubscribing as proof of your consent. If you have an account and agreed to offers, we may also remind you once about products left in your cart. Every email has an unsubscribe link, and you can also switch offers off in your account. We send these emails through our own email service (Titan).

9. Who receives your data

• Payment provider – processes your payment (e.g. Paysera). Card details are entered directly with the payment provider; we never see them.
• Fulfilment partner – our supplier CJdropshipping packs and ships your order and receives your name, delivery address, phone number and the ordered products.
• Shipping companies – receive the data needed for delivery.
• Print partner – Printful (Latvia) prints and ships our printed products and receives the same delivery data.
• IT service providers – Microsoft Azure (hosting, product and review photos, error monitoring; servers in the EU) and Titan (email), bound by data processing agreements.

10. Transfers outside the EU

Our company is based in Kosovo, and our fulfilment partners ship from warehouses that may be located outside the EU, for example in China. These transfers take place on the basis of EU Standard Contractual Clauses where available, and otherwise because they are necessary to fulfil your order (Art. 49(1)(b) GDPR).

11. Contacting us

If you write to us, we process your message and contact details to answer your request (Art. 6(1)(b) or (f) GDPR). To answer faster, an AI service (DeepSeek) suggests a draft reply. Before that, we remove your name, email address, phone number and postal address from the message; the AI only receives the text and the status of your order. A member of our team checks every reply before it is sent. We delete your messages after 12 months. The chat in our Help window answers with the same AI service: we remove email addresses and phone numbers from your question before it is sent and do not store the conversation. Please do not enter personal data there.

12. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise your rights, write to info@bambimart.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live.

13. Changes

We update this policy when our services or the law change. The current version is always available on this page.