Privacy Policy

BOMBALYX LTD, Private company limited by shares (England and Wales), with its registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom, operates the Bombalyx marketplace and acts as controller for the personal data described in this policy. You can contact us at contact@bombalyx.tech.

As a company established in the United Kingdom, BOMBALYX LTD processes your personal data under the UK GDPR and the Data Protection Act 2018; where EU law applies to you, the EU GDPR grants you the same rights.

Account data: your name, email address, password stored as a hash and, if you sell, information about your shop.

Order and shipping data: the items ordered, billing and shipping addresses, and order history needed to process and track your purchases.

Payment data: payments are processed by our payment provider, Stripe. We receive only limited confirmation data and never store full card numbers on our servers.

Usage and device data: pages viewed, searches, IP address and information about your device/browser, collected to secure and improve the marketplace.

Performance of our contract with you: account creation, order processing and delivery, returns, refunds and support.

Our legitimate interests: securing the Platform, preventing fraud and improving our services while balancing your rights and freedoms.

Compliance with legal obligations: tax, accounting and record-keeping requirements.

Your consent: optional marketing emails, which you can withdraw at any time. We do not sell your personal data.

Independent Sellers: to fulfil an order, we share the information needed for shipping, namely your name and delivery address. Sellers act as independent suppliers of BOMBALYX LTD and may use this information only to ship and track your order.

Service providers acting on our instructions as processors under the GDPR: Stripe for payment processing, Vercel and Railway for website and database hosting, IONOS for domain and email, and our transactional email provider. Each is governed by a data processing agreement compliant with Article 28 GDPR.

Legal obligations and safety: authorities or third parties where required by law, or to protect our rights, users or the public.

BOMBALYX LTD is established in the United Kingdom, and your data is hosted and processed primarily within the United Kingdom and the European Union. Some of our processors are established in the United States: Vercel Inc. and Railway Corp. for website and database hosting, and Stripe for payment processing. Use of the Platform may therefore involve transferring your data to the United States.

These transfers are protected by appropriate safeguards under the UK GDPR and, for users in the European Union, Chapter V of the EU GDPR: certification under the EU-U.S. Data Privacy Framework and its UK Extension where applicable, and/or standard contractual clauses, including the ICO’s International Data Transfer Addendum, supplemented where necessary by additional technical measures. You can request a copy of these safeguards at contact@bombalyx.tech.

We keep your personal data while your account is active and for as long as necessary to provide the service, then for the periods required by legal, tax and accounting obligations before deletion or anonymisation.

We use essential cookies to maintain your session and remember your cart, and functional cookies to remember preferences such as your language, currency and theme. We do not currently use analytics or advertising cookies. You can manage or delete cookies in your browser settings; disabling essential cookies may prevent parts of the Platform from working.

Under the UK GDPR and, where it applies to you, the EU GDPR, you have the right to access, rectify and erase your data, restrict or object to processing, receive your data in a portable format and withdraw consent at any time.

To exercise these rights, contact us at contact@bombalyx.tech. You also have the right to lodge a complaint with a supervisory authority: the Information Commissioner’s Office (ICO) in the United Kingdom (ico.org.uk), the CNIL in France (cnil.fr), or your local data protection authority.

If you use the Platform from a country with its own data protection laws, such as Switzerland or California, you may have rights similar to those described in section 8. We do not sell your personal data or share it for cross-context behavioural advertising.

For requests under these laws, email us at contact@bombalyx.tech; we will take reasonable steps to verify your identity before responding.

We use technical and organisational measures, including encrypted connections, hashed passwords and access controls, to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your data and respond quickly to any incident.

Bombalyx is not directed at children. You must be at least 18 to use the Platform, and we do not knowingly collect personal data about minors.

We may update this policy from time to time. If we make material changes, we will take reasonable steps to inform you. The date above shows the latest update.

BOMBALYX LTD, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. For any question or request about your personal data, email us at contact@bombalyx.tech.