Privacy Policy

The data controller for personal data collected through www.bestbuyreview.net (the "Site") is Achat Avis, the company that operates the BestBuyReview brand, based in Île-de-France, France. For any question about this policy or your data, email contact@bestbuyreview.net.

This policy explains what we collect, why, on what legal basis, who receives it, how long we keep it, and how to exercise your rights. Because Achat Avis is established in France, the EU General Data Protection Regulation (GDPR) and the French Data Protection Act apply to our processing, wherever you are located.

We only collect the data you choose to send us and a small amount of technical data needed to run the Site:

• Free invitations form: your full name, business name, work email address, phone number, and the profile or listing you want to grow (for example a Google Business Profile name or a page URL). The short version of the form at the top of pages asks only for business name, email, and phone.
• Contact form: your name, email address, and message.
• Callback pop-up: your email address and a note that you asked to be contacted.
• With each form, the address of the page you sent it from, so we know which service you were reading about.
• WhatsApp: if you choose to message us, we receive your phone number, WhatsApp profile name, and the content of your messages.
• Technical data: when you visit the Site, our hosting provider processes your IP address, browser type, requested pages, and timestamps in server logs, which are needed to deliver pages and keep the Site secure.

Our forms do not include file uploads, and we do not ask for sensitive data. Please do not include your customers' personal data in a form or first message.

If you become a client, we also process the customer records you share for a campaign. For that data we act as your processor, under your instructions, as described in our Terms of Service.

We use your data for the following purposes, each with its GDPR legal basis:

• To answer your request, contact you about the free invitations offer, and prepare a quote or campaign: steps taken at your request before entering into a contract (Article 6(1)(b)) and our legitimate interest in replying to business enquiries (Article 6(1)(f)).
• To provide the Services, manage your account, and handle billing if you become a client: performance of the contract (Article 6(1)(b)).
• To keep accounting and tax records and respond to lawful requests from authorities: compliance with legal obligations (Article 6(1)(c)).
• To operate, secure, and troubleshoot the Site and prevent abuse of our forms: our legitimate interest in running a safe website (Article 6(1)(f)).

We do not sell your personal data, we do not share it for advertising, and we do not add you to a newsletter. If we ever send marketing emails, we will do so only where the law allows and with an easy way to opt out. We do not make decisions about you based solely on automated processing.

Inside Achat Avis, only the people who handle requests and campaigns can access your data. We also use the following service providers, which act as processors on our behalf and may only use the data to provide their service to us:

• Vercel Inc. (United States), which hosts the Site and processes the technical data described above.
• Our email delivery provider, which relays form submissions to our team by SMTP, and Google (Gmail), which hosts the mailboxes that receive them.
• Google (Google Sheets and Google Apps Script), which stores a copy of each form submission in a spreadsheet used to track and follow up on requests.
• WhatsApp, operated by Meta, only if you choose to contact us on WhatsApp. WhatsApp also processes your data under its own terms and privacy policy.

The Site does not use analytics, advertising, or social-media tracking tools. Fonts are served from our own domain, so loading a page does not send your data to a font provider. We may disclose data if required by law or to protect our rights, for example in a dispute.

Some of our providers, including Vercel and Google, are based in the United States or may access data from there. When personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU-U.S. Data Privacy Framework, together with the additional safeguards the provider offers. You can ask us for more information about these safeguards by email.

We keep personal data only as long as needed for the purpose it was collected for:

• Requests from prospects who do not become clients: up to 3 years from our last contact with you, then deleted.
• Client account and contract data: for the duration of the business relationship, then up to 5 years to handle possible claims, in line with the French statute of limitations for commercial matters.
• Invoices and accounting records: 10 years, as required by French accounting law.
• Customer records shared for a campaign: deleted or returned at the end of the Services, unless the law requires us to keep them.
• Server logs: kept for a short period for security and troubleshooting, and no longer than 12 months.

The Site does not set advertising, analytics, or tracking cookies, so we do not show a cookie consent banner.

The Site uses your browser's session storage to remember, during your visit, that you already closed the information pop-up or the callback pop-up, so they are not shown again. This information stays in your browser, is not sent to us, contains no personal data, and is deleted when you close the tab. You can clear it at any time in your browser settings.

Under the GDPR, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify data that is inaccurate or incomplete.
• Erase your data, where there is no longer a valid reason to keep it.
• Object to processing based on our legitimate interest, and object at any time to direct marketing.
• Restrict processing while a request or dispute is being reviewed.
• Receive the data you provided in a portable format, where processing is based on a contract or consent.
• Give instructions on what happens to your data after your death, as French law allows.

To exercise a right, email contact@bestbuyreview.net. We answer within one month, which may be extended in complex cases, and may ask for information to confirm your identity. These rights are also available to visitors outside the European Union, including residents of the United States.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), at www.cnil.fr, or with the authority of your country of residence.

The Site is served only over encrypted HTTPS connections. Form submissions are transmitted to a protected server endpoint, access to our mailboxes and spreadsheets is limited to the people who need it, and our providers apply their own security measures. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a data breach where the law requires it.

The Site and the Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, contact us and we will delete it.

We may update this policy when our practices, providers, or the law change. The date at the top of this page shows the latest version. If a change significantly affects how we use data you already gave us, we will inform you by email where we can.

Achat Avis, operator of BestBuyReview, Île-de-France, France. Publication director: Achat Avis. Email: contact@bestbuyreview.net. WhatsApp: +33 6 44 67 86 42.