01
Data controller
Bullman Equipment SAS, 47 boulevard de Courcelles, 75008 Paris, France, registered under RCS Paris 949 013 957.
Personal data contact: [email protected].
Personal data
Privacy policy.
This policy explains how Bullman Equipment SAS ("we"), publisher of bullmanequipment.com, collects and processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Last updated : 2026-09-02
02
Data we collect
| When | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account creation | Name, e-mail, password (hashed), phone, addresses | Customer account, order history | Performance of the contract | Account lifetime + 3 years after the last activity |
| Order (with or without an account) | Identity, delivery and billing addresses, phone, order content, company registration / VAT number for professionals | Processing, delivery, invoicing, after-sales service | Performance of the contract, legal obligation (accounting) | 10 years (accounting records) |
| Payment | Card data is processed directly by our payment provider; we never access it. We keep the amount, date and status of the transaction. | Collection, fraud prevention | Performance of the contract, legitimate interest | 13 months (disputes), 10 years as accounting evidence |
| Delivery | Name, address, phone, e-mail, chosen pickup point | Shipping, appointment, tracking | Performance of the contract | Delivery period + warranty |
| Quote request, contact, after-sales | Identity, contact details, company, message, attachments | Answering your request, layout study | Pre-contractual measures, legitimate interest | 3 years after the last contact |
| Newsletter | Commercial information | Consent (unsubscribe at any time) | Until consent is withdrawn, 3 years max without interaction | |
| Wishlist, cart | Saved products, session identifier | Site operation | Legitimate interest | Session or account lifetime |
| Browsing | IP address, pages viewed, device, cookies (see § 6) | Operation, security, audience measurement, advertising (with consent) | Legitimate interest, consent | 13 months max for cookies |
03
Recipients
Your data is processed by our authorised staff and by providers acting on our behalf, within the limits of their tasks:
- Payment: Stripe Payments Europe Ltd (Ireland) and, depending on the chosen method, GoCardless SAS (France) or our bank for direct debits and transfers.
- Delivery: carriers and pickup-point networks (DPD, pallet carriers). Name, address, phone and e-mail are passed on for shipping.
- Hosting: IONOS SARL, 7 place de la Gare, 57200 Sarreguemines, France (servers in the European Union).
- Business management: our ERP (Odoo, hosted on our IONOS servers); Microsoft 365 business e-mail (Microsoft Ireland Operations Ltd, data hosted in Europe).
- Audience measurement and advertising, only with your consent: Google Ireland Ltd (Google Analytics), Meta Platforms Ireland Ltd (Facebook, Instagram).
04
Transfers outside the European Union
We never sell or rent your data. We work exclusively with the European entities of our providers: your data is hosted and processed in the European Union, with no transfer outside the EU.
05
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to set directives on its fate after your death. You may withdraw your consent at any time (newsletter, cookies) without affecting the lawfulness of prior processing.
To exercise your rights: [email protected], or by post at the address in § 1. Proof of identity may be requested in case of reasonable doubt. We answer within one month. You may also lodge a complaint with the CNIL (cnil.fr).
06
Cookies
On your first visit a banner lets you accept or refuse non-essential cookies. You can change your mind at any time through the "Cookies" link in the footer. You may also set your browser to refuse cookies; some features (cart, account) may then stop working.
- Necessary: session, cart, language, cookie choice, security. No consent required.
- Audience measurement: Google Analytics. Consent required.
- Advertising: Meta Pixel. Consent required.
07
Security
The site is served over HTTPS, passwords are stored hashed, payment data never passes through our servers and access to our tools is limited to authorised staff. No system is infallible: report any anomaly to [email protected].
08
Minors and changes
The site is intended for adults and professionals. We do not knowingly collect data from children under 15.
This policy may change, in particular when a provider or the regulation changes. The version in force is the one published on this page, with its update date.