Privacy Policy

Last updated: 24 October 2026

Who we are

The controller of your personal data is Bilal El Boughlamy, sole trader (entrepreneur individuel, EI), 138 avenue de Lodève, 34070 Montpellier, France (“Gambiko”, “we”, “us”). For any questions or to exercise your rights: contact@gambiko.com.

This policy applies to customers and visitors in the United Kingdom, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and in Ireland and the rest of the European Union, under the General Data Protection Regulation (EU GDPR).

The data we collect

• Identity and contact details: first name, surname, email address, delivery and billing addresses, and phone number if you give it.
• Orders: products bought, amounts, order history and your messages with customer service.
• Payment: card details are processed directly by the payment providers; Gambiko has no access to them.
• Use of the website: IP address, type of device and browser, pages viewed, collected through cookies in line with your choices.
• Contact form: your name, email address and the content of your message, so that we can reply.

Why we use your data and our lawful bases

• Processing and delivering your orders, handling returns and customer service: performance of a contract (Article 6(1)(b) UK GDPR and EU GDPR).
• Replying to your questions through the contact form or by email: our legitimate interests (Article 6(1)(f)) or steps taken before entering into a contract (Article 6(1)(b)).
• Keeping invoices and accounting records: legal obligation (Article 6(1)(c)).
• Preventing fraud and keeping the website secure: our legitimate interests (Article 6(1)(f)).
• Sending our news and offers by email: your consent (Article 6(1)(a)), which you can withdraw at any time using the unsubscribe link in every email.
• Audience measurement and personalised advertising: your consent (Article 6(1)(a)), given through the cookie banner.

Who we share your data with

• Shopify, which hosts the shop and processes payments.
• Our logistics providers and suppliers based in China, which receive your name, delivery address and phone number in order to ship the products.
• The carriers responsible for delivery.
• Payment providers.
• Public authorities, where the law requires it.

Gambiko does not sell your personal data.

International transfers

Some recipients are located outside the United Kingdom and the European Economic Area. Shopify may process data in Canada and the United States; the UK and the European Commission recognise these countries as providing an adequate level of protection (for the United States, under the UK Extension to the EU-US Data Privacy Framework and the EU-US Data Privacy Framework). Gambiko is based in France, in the European Union; the UK recognises the EU as providing an adequate level of protection.

Some of our products are shipped from China, which is outside the United Kingdom and the European Union. Transferring your name, delivery address and phone number to our logistics providers and suppliers based in China is necessary to perform your contract with us (Article 49(1)(b) UK GDPR and EU GDPR), and is limited to those details.

How long we keep your data

• Order data and invoices: 10 years, to meet French accounting obligations.
• Customer account: until you delete it, or 3 years after your last activity.
• Marketing emails: 3 years after your last contact with us, or until you unsubscribe.
• Cookies: 13 months at most; your cookie banner choices are kept for 6 months.

Your rights

You have the right to access, correct and erase your data, to restrict its processing, to data portability, and to withdraw your consent at any time for the future. To exercise these rights, email contact@gambiko.com. We will reply within one month.

Right to object: you can object at any time to processing based on our legitimate interests. You can object to direct marketing at any time, without giving a reason.

If you think your rights have not been respected, you can complain to the Information Commissioner's Office (ICO) in the United Kingdom (ico.org.uk), to the Data Protection Commission in Ireland (dataprotection.ie), or to the French data protection authority, the CNIL (www.cnil.fr).

Cookies

Cookies needed for the shop to work (basket, payment, security) are set without consent. Cookies for audience measurement and advertising are only set with your consent, which you can change at any time through the cookie banner.

Shopify

For some features, Shopify acts as an independent controller. You can read Shopify's privacy policy and exercise your rights with Shopify at privacy.shopify.com.

Changes

We may update this Privacy Policy. The date of the latest update is shown at the top of this page.