PRIVACY POLICY (GDPR)

1. DATA COLLECTED

We only collect the data necessary to process your orders and manage our commercial relationship:

• Identity: First name, last name, proof of identity (if requested for age verification or fraud prevention).
• Contact details: Delivery address, billing address, email, phone number.
• Payment: Payment information (processed securely by our banking partners — GVBSC does not store your full banking details).

2. PURPOSES OF PROCESSING

Your data is used for:

• Manual validation and processing of your orders.
• Delivery organisation with our carriers (FedEx, DHL, Chronopost).
• Sending pro forma invoices and accounting follow-up.
• Compliance with our legal obligations (ban on sales to minors).

3. DATA RECIPIENTS

Your data is strictly confidential. It is only shared with third parties necessary for the execution of your order:

• Our transport partners for delivery.
• Our secure payment providers.
• Administrative or judicial authorities if required by law. GVBSC never resells your data to third parties.

4. RETENTION PERIOD

• Order data: Kept for 10 years (legal accounting obligation).
• Identity documents: Deleted immediately after age verification or order validation.
• Prospect data: Kept for a maximum of 3 years after the last contact.

5. YOUR RIGHTS

Under the GDPR, you have the following rights regarding your data:

• Right of access and rectification.
• Right to erasure (right to be forgotten).
• Right to restriction of processing.
• Right to object on legitimate grounds.

To exercise these rights, simply contact us by email at: service-client@pomerol.com