Privacy Policy

Last updated: 17 October 2026

Who is responsible for your data

The data controller is Numiway, SASU with a share capital of 40 000 €, RCS La Rochelle 814 028 684, 2 rue du Parc, 17410 Saint-Martin-de-Ré, France. Numiway operates the trademarks Bixar and Laeka.

Contact for any question about your data: bixar@bixar.co

This policy applies to the online shop bixar.fr. The Club Bixar (club.bixar.co) and the Bixar application are also published by Numiway and use the same account: data specific to the Club, in particular the GPS position of your tracker and your animal’s profile, are described in the Club’s privacy policy.

The data we process

• Identity and contact details: surname, first name, e-mail address, telephone.
• Delivery and billing addresses.
• Account: login identifier, creation date, preferences. We neither see nor store your password: login is managed by our authentication provider.
• Orders: products purchased, amounts, delivery status, exchanges with customer service.
• Payment: your bank details are entered directly with our provider Stripe and do not pass through our servers. We only receive the payment status and do not store any card data.
• Technical data: IP address, browser type, pages requested, security logs.
• Traffic statistics, only if you accept audience measurement: pages viewed, referring site, device type, operating system and browser, approximate location (country, region, city) inferred from your IP address, which is not stored with these statistics, as well as time spent and reading depth of pages. A visit identifier that changes every day, calculated from your IP address and your browser and then deleted within 24 hours, prevents the same visit from being counted several times; it does not allow you to be followed from one day to the next. They contain neither your name, nor your e-mail, nor your order number, and are not linked to your account.
• Advertising data, only if you accept marketing cookies: product pages viewed, additions to cart, start of checkout and purchase (products, amount, order number), Meta and TikTok advertising identifiers, and, for a purchase, your e-mail address transmitted in encrypted form (hashed, not readable).

We do not collect any human health data or any sensitive data within the meaning of the GDPR.

Why we process them, and on what basis

• Managing your account, your orders, payments, delivery, returns and customer service: performance of the contract.
• Saving a bank card with Stripe for your future purchases, if you so choose: your consent, which can be withdrawn at any time.
• Sharing your account and your payment customer record between the shop and the Club Bixar, in order to activate the products purchased and spare you from re-entering your card: performance of the contract.
• Invoicing and accounting: legal obligation.
• Website security and fraud prevention: legitimate interest.
• Sending you offers and news, and a reminder when you leave a cart without confirming it (at most two or three e-mails, with no automatic discount): your consent, given by ticking the dedicated box at the time of ordering or in your account. Neither creating an account, nor placing an order, nor accepting the general terms and conditions constitutes consent. You can unsubscribe at any time, in one click, via the link included in each e-mail or in your account. We do not measure the opening of these e-mails; we only count the cart recoveries made from the link.
• Understanding traffic to the website (most viewed pages, countries and cities of origin of visitors) in order to improve it: your consent, given via the cookie banner (“Audience measurement” option), which can be withdrawn at any time via “Manage cookies”. Without your agreement, no traffic statistics are collected.
• Measuring the effectiveness of our advertising on Facebook, Instagram and TikTok, and showing you our ads: your consent, given via the cookie banner (“Marketing” option), which can be withdrawn at any time via “Manage cookies”. Without your agreement, no data is transmitted to Meta or to TikTok.

We do not take any automated decision producing legal effects concerning you, and we do not sell your data.

How long we keep them

• Customer account: for as long as the account is active, then 3 years after your last activity, unless you request its deletion.
• Orders and invoices: 10 years, the period required by the Code de commerce.
• Traffic statistics: they contain no information that identifies you. The technical identifier of a visit is automatically deleted after 24 hours by our service providers, and the statistics are kept for no more than 25 months.
• Advertising data transmitted to Meta and TikTok: we do not store them on our side; each platform keeps them in accordance with its own policy. Your cookie choice is kept for 6 months.
• Direct marketing: 3 years after our last contact with you, or until you withdraw your consent.
• Cart reminders (content of the cart concerned, messages sent, recoveries): 13 months.
• Proof of your consent or of its withdrawal (date, source, version of the text displayed): 5 years, so that it can be presented in the event of an inspection.
• Saved bank card: until you delete it or delete your account.
• Technical and security logs: 12 months at most.
• Cookies: see our Cookie Policy.

Who receives your data

Your data is accessible only to those people at Numiway who need it, and to our service providers, who act on our instructions:

• Vercel Inc. (United States, participant in the Data Privacy Framework): hosting of the website, whose server functions run in the Paris region; and, if you accept audience measurement, traffic statistics (Vercel Web Analytics).
• Plausible Insights OÜ (Estonia, hosting in the European Union): if you accept audience measurement, traffic statistics (Plausible Analytics). Plausible acts as our processor.
• Amazon Web Services EMEA SARL (Luxembourg): hosting of the shop’s servers and database, in the Paris region.
• Okta Inc., Auth0 service (United States, data hosted in the European Union): login to your account.
• Stripe Payments Europe Limited (Ireland): online payment and fraud prevention.
• Hostinger International Ltd (Cyprus): e-mail services.
• Postmark (ActiveCampaign, LLC, United States): sending of e-mails relating to your orders (confirmation, shipping, refund) and, if you have consented to it, of commercial e-mails.
• Zendesk Inc. (United States): management of requests sent to customer service.
• Institut national de l’information géographique et forestière (IGN, France), Base Adresse Nationale: address suggestions while you type. Only the text of the address typed is transmitted to it, by our servers, without any other data concerning you.
• Meta Platforms Ireland Limited (Ireland, parent company in the United States), for Facebook and Instagram: if you accept marketing cookies, conversion measurement and advertising (Meta pixel and Conversions API). Meta acts as joint controller for this measurement.
• TikTok Technology Limited (Ireland, parent company established outside the European Union): if you accept marketing cookies, conversion measurement and advertising (TikTok pixel and Events API). TikTok acts as joint controller for this measurement.
• Carriers: delivery of your orders.

Your data may also be disclosed to administrative or judicial authorities where required by law.

Transfers outside the European Union

Some service providers are established in the United States. These transfers are governed by the EU–United States data protection framework (Data Privacy Framework) where the provider participates in it, and failing that by the standard contractual clauses of the European Commission.

Cookies

The website uses cookies that are strictly necessary for its operation. Only with your agreement (“Marketing” option), it also loads the pixels of Meta (Facebook, Instagram) and of TikTok. Details are given in our Cookie Policy, and you can change your choices at any time via the “Manage cookies” link at the bottom of each page.

Your rights

You have a right of access, rectification, erasure, restriction, objection and portability with regard to your data, as well as the right to withdraw your consent at any time. You may also set out instructions regarding what happens to your data after your death.

To exercise these rights, write to bixar@bixar.co. We respond within one month. We may ask you to prove your identity in the event of reasonable doubt.

If you consider that your rights have not been respected, you may refer the matter to the CNIL (www.cnil.fr).

Minors

The shop is reserved for adults. If data concerning a minor has been transmitted to us, contact us to have it deleted.

Security

Exchanges with the website are encrypted, access to data is limited to authorised persons, and data and backups are encrypted. As no system is infallible, we will inform you, as well as the CNIL, in the event of a data breach presenting a risk to you.

Changes

This policy may change. The version in force is always published on this page, with its date of update.