Effective date: 21 April 2026
Last updated: 21 April 2026
Bama Heritage SARL (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit bama-heritage.com (the “Site”) or purchase our products.
1. Data Controller
Company name: Bama Heritage SARL
Registered address: Institut Denis Dumont, Boulevard la grande ceinture, 35100, Guercif, Région de l’Oriental, Morocco
Legal representative: Khaoula Belkacemi
Contact email (data protection inquiries): [email protected]
We act as the data controller for your personal information collected through the Site.
2. What Personal Data We Collect
We may collect the following categories of personal data:
Identity Data: Name, surname.
Contact Data: Billing address, shipping address, email address, phone number.
Transaction Data: Details about orders, payments made (but we do not store full payment card details – they are processed by our payment providers), purchase history.
Technical Data: IP address, browser type and version, time zone setting, operating system, device identifiers.
Usage Data: Information about how you use our Site (pages viewed, clicks, time spent).
Marketing & Communications Data: Your preferences in receiving marketing emails from us.
3. How We Collect Your Data
We collect data in the following ways:
Direct interactions: When you place an order, create an account (if applicable), subscribe to our newsletter, contact us via email, or request customer support.
Automated technologies: Through cookies and similar tracking technologies when you browse our Site (see Section 8 below).
Third parties: Payment processors (PayPal, Stripe, etc.) provide us with transaction confirmation but not full payment details.
4. How We Use Your Personal Data
We use your personal data for the following purposes:
| Purpose | Legal basis (for GDPR purposes) |
|---|---|
| To process and deliver your orders (including payment, shipping, and sending order confirmations) | Performance of a contract with you |
| To manage your account (if you create one) | Performance of a contract |
| To respond to your inquiries, complaints, or withdrawal requests | Legitimate interest |
| To improve our Site, products, and customer service | Legitimate interest |
| To send you marketing communications (only if you have opted in) | Consent |
| To comply with legal obligations (e.g., tax, customs) | Legal obligation |
| To detect and prevent fraud | Legitimate interest |
We will not use your personal data for purposes incompatible with those listed above without informing you.
5. Sharing Your Personal Data
We do not sell or rent your personal data to third parties. However, we may share your data with:
Service providers: Shipping carriers (Aramex, DHL, FedEx, etc.), payment processors (PayPal, Shopify Payments, Stripe), email marketing platforms (if you opt in), and IT hosting services (WordPress hosting providers).
Legal authorities: If required by Moroccan law or to protect our rights, safety, or property.
Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the new owner.
All third-party service providers are contractually obligated to protect your data and use it only for the services they provide to us.
6. International Data Transfers
Because we sell worldwide, your personal data may be transferred to and processed in countries outside Morocco, including the European Union, the United States, or other countries where our service providers are located.
When we transfer data from the European Economic Area (EEA) to a country not deemed adequate by the European Commission, we rely on appropriate safeguards such as Standard Contractual Clauses. By placing an order, you acknowledge and consent to such transfers.
7. Data Retention
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.
Order data: Retained for 5 years (for tax and warranty purposes).
Customer inquiry emails: Retained for 2 years after resolution.
Marketing data: Retained until you unsubscribe.
Technical/usage data: Retained for 12 months.
After the retention period, your data will be securely deleted or anonymized.
8. Cookies & Tracking Technologies
Our Site uses cookies to enhance your browsing experience, analyze traffic, and personalize content. Cookies are small text files stored on your device.
Types of cookies we use:
Essential cookies: Necessary for the Site to function (e.g., shopping cart, checkout).
Functional cookies: Remember your preferences (e.g., language, currency).
Analytics cookies: Help us understand how visitors use our Site (e.g., Google Analytics).
Marketing cookies: Used to display relevant ads (only if you consent).
You can manage or disable cookies through your browser settings. However, disabling essential cookies may affect the Site’s functionality.
9. Your Rights (GDPR for EU customers & Moroccan law)
Under Moroccan Law No. 09-08 on the protection of individuals with regard to personal data, and for EU residents under the GDPR, you have the following rights:
Right to access: Request a copy of the personal data we hold about you.
Right to rectification: Correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”): Request deletion of your data where no legal obligation requires us to retain it.
Right to restriction: Limit how we use your data.
Right to data portability: Receive your data in a structured, machine-readable format.
Right to object: Object to processing based on legitimate interests or direct marketing.
Right to withdraw consent: For marketing communications, you can unsubscribe at any time.
To exercise any of these rights, please contact us at [email protected] with the subject “Privacy Request” and your order number or email address used. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority (for EU residents) or with the Moroccan National Commission for the Control of Personal Data Protection (CNDP) – though we hope to resolve any concerns first.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, alteration, or disclosure. These include SSL encryption on our Site, secure hosting, and limited access to personal data by our staff.
However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
11. Children’s Privacy
Our Site and products are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.
12. Third-Party Links
Our Site may contain links to external websites (e.g., payment gateways, social media). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be posted on this page, with the effective date at the top. We encourage you to review this page periodically.
14. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
Email: [email protected]
Postal address: Institut Denis Dumont, Boulevard la grande ceinture, 35100, Guercif, Morocco
We will respond to all legitimate requests within 30 days.
This Privacy Policy was last updated on 21 April 2026.