Privacy policy

This policy explains what personal data is processed when you visit the Bonmi website, book a table or place a takeaway order on it, why, for how long, and how to exercise your rights. It is based on Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and on the amended French Data Protection Act of 6 January 1978 (loi « Informatique et Libertés »).

In the event of any discrepancy between this English translation and the French version, the French version shall prevail.

Summary

The Bonmi website presents the restaurant and lets you book a table or order takeaway online. It has no customer accounts, no audience measurement tools and no advertising, and no payment is made on it. The only data processed is:

technical data required for the website to function and remain secure;
the information you give us when booking a table;
the information you give us when ordering takeaway;
the exchanges you choose to start with us by email;
Google Maps cookies, only if you accept them.

Data controller

Bonmi, a French SAS with share capital of €3,000, registered with the Paris Trade and Companies Register (RCS) under number 991 768 888, with its registered office at 73 rue Pernety, 75014 Paris, France, represented by Cécile Zhu, President.

Contact: bonmi75014@gmail.com — +33 1 40 44 71 42.

The data we process

1. Server technical logs

Like any website, our server automatically records certain information on each visit.

Data: IP address, date and time of connection, page visited, browser and operating system type, referring page.
Purpose: keeping the website running properly, securing it and detecting abuse (intrusion attempts, overload).
Legal basis: our legitimate interest in securing the website (Article 6(1)(f) GDPR).
Retention period: 15 days at most, then automatic deletion.

2. Online table booking

When you book a table using the form on the website:

Data: date, time and number of guests; your name, email address and phone number; the language of the site you used; and, if you provide one, your special request.
Purpose: recording and managing your booking, sending you a confirmation email and contacting you if necessary (delay, unforeseen event). The restaurant receives an email notification for each new booking.
Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Retention period: your contact details (name, email, phone) are anonymised 3 months after the date of your booking. After that, we only keep information that cannot identify you (date, service, number of guests), for statistical purposes. The confirmation and notification emails related to your booking are deleted from our mailbox within the same period.

Special request. This optional field lets you tell us about a specific need: high chair, special occasion, allergy… If you include information about your health (allergy, food intolerance), you explicitly consent to our using it for the sole purpose of preparing your meal (Article 9(2)(a) GDPR). You may withdraw this consent at any time by contacting us. This information is erased from our booking system the day after your visit; it also appears in the notification email sent to the restaurant, which is deleted no later than 3 months after your booking.

Protection against abuse. To prevent automated fake bookings, we limit the number of requests per connection. For this purpose, your IP address is held temporarily in memory, never stored, and forgotten no later than 24 hours after your request. Legal basis: our legitimate interest in protecting the booking service (Article 6(1)(f) GDPR).

3. Takeaway orders (Click & Collect)

When you order takeaway dishes through the website:

Data: your name, email address and phone number; the language of the site you used; the content of your order (dishes, quantities, prices), its date, its number and the estimated pick-up time.
Purpose: recording and preparing your order, sending you a summary by email, handing it over to you at the restaurant and contacting you if necessary (delay, unavailable dish). The restaurant receives an email notification for each new order.
Legal basis: performance of the sales contract concluded with you (Article 6(1)(b) GDPR).
Retention period: your contact details (name, email, phone) are anonymised 30 days after the date of your order. After that, we only keep information that cannot identify you (date, dishes ordered, amount), for statistical purposes. The summary and notification emails related to your order are deleted from our mailbox within the same period.

No health data. The order form has no free-text field. If you have a food allergy or intolerance, please contact us by phone before ordering: this information is then not recorded.

No bank data. Payment is made at the restaurant, on collection. No payment data is collected on the website.

Protection against abuse. To prevent automated fake orders, we limit the number of requests per connection. For this purpose, your IP address is held temporarily in memory, never stored, and forgotten no later than 24 hours after your request. Legal basis: our legitimate interest in protecting the ordering service (Article 6(1)(f) GDPR).

4. Email exchanges

When you write to us at the address shown on the website:

Data: your email address, your name if it appears, the content of your message and any information you choose to share with us.
Purpose: answering your request (information, booking, order, complaint, private hire…).
Legal basis: our legitimate interest in answering the requests sent to us (Article 6(1)(f) GDPR) or, where your request concerns a booking or an order, taking steps prior to entering into a contract or performing the contract concluded with you (Article 6(1)(b) GDPR).
Retention period: as long as needed to handle your request, then no more than 3 years from our last exchange.

5. Google Maps

To help you find us, the website offers an interactive map provided by Google. This map is only loaded if you accept it through the cookie banner. Until you give your consent, no connection is made to Google Maps servers: the restaurant’s address and a directions link remain displayed.

Once the map is loaded, Google may place or read cookies on your device and collect your IP address and browsing data. Google then acts as a separate data controller, for its own purposes, described in its privacy policy.

Legal basis: your consent (Article 82 of the French Data Protection Act and Article 6(1)(a) GDPR).

Cookies and other trackers

A cookie is a small file stored on your device (computer, phone) when you visit a website. Our website only uses the following trackers.

Storing your consent choices

Issuer: Bonmi (browser local storage)
Purpose: remembering whether you accepted or refused cookies, so that you are not asked again on every page
Consent: not required, as this tracker is strictly necessary to respect your choice
Duration: 6 months

Storing your basket

Issuer: Bonmi (browser session storage)
Purpose: keeping the content of your basket while you order, for example if you reload the page. Only the dishes chosen and their quantities are stored, with no personal data
Consent: not required, as this tracker is strictly necessary for the ordering service you request
Duration: until you close the tab, or until your order is confirmed

Google Maps cookies

Issuer: Google
Purpose: displaying the interactive map and Google’s own purposes (security, preferences, measurement, personalisation)
Consent: required
Duration: set by Google

We use no advertising cookies and no audience measurement tools.

Managing your choices

On your first visit, a banner lets you accept or refuse cookies that require consent, just as easily. Refusing has no effect on your access to the website: only the interactive map is not displayed.

Your choice is kept for 6 months, after which you will be asked again. You can change it at any time using the “Manage cookies” link at the bottom of every page. You can also set your browser to block or delete cookies.

Recipients of the data

Your data is intended exclusively for authorised Bonmi staff. It may be processed on our behalf, within the limits of their tasks, by:

PulseHeberg, a French SAS with its registered office at 9 boulevard de Strasbourg, 83000 Toulon, France, the website host, whose servers are located in France;
Maxime Hu, sole trader, the contractor responsible for the design and technical maintenance of the website;
Google, the provider of our email service, used in particular to send booking confirmations and notifications, as well as order summaries and notifications.

We never sell, rent or transfer your data to third parties.

Transfers outside the European Union

The website’s hosting, its booking and order databases and its technical logs remain in France. However, Google services (email, map) may involve transferring data to the United States. These transfers are subject to appropriate safeguards: the EU–US Data Privacy Framework, under which Google LLC is certified, and the standard contractual clauses adopted by the European Commission.

Security

We implement appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), regular server updates, access restricted to authorised persons only, and protection of the booking and order forms against automated submissions.

Your rights

Under the GDPR and the French Data Protection Act, you have the following rights over your data:

right of access: to know what data we hold about you and obtain a copy;
right to rectification: to have inaccurate data corrected;
right to erasure: to have your data deleted, under the conditions provided by law;
right to restriction: to request that processing be temporarily suspended;
right to object: to object to processing based on our legitimate interest;
right to data portability: to receive your data in a readable format, where processing is based on your consent or a contract;
right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
right to set instructions regarding what happens to your data after your death.

To exercise these rights, write to us at bonmi75014@gmail.com or by post to: Bonmi SAS, 73 rue Pernety, 75014 Paris, France. We will reply within one month, which may be extended by two months if the request is complex. If we have reasonable doubts about your identity, we may ask you for proof of identity.

Complaint to the CNIL

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

Changes to this policy

We may update this policy, in particular when adding new features. The date of the last update is shown at the top of this page.