Privacy policy

Last updated: 02/10/2026 at 17:31

1. Who is responsible for your data

This website and its marketplace are published by NVBB Nederland, which works in Benin with MedA Conseils, to support artisans and check product quality, and with NVBB SARL, its company in Benin, to pay artisans. These partners act as joint controllers within the meaning of Article 26 GDPR:

NVBB Nederland - Kerkraderweg 38, 6416 CK Heerlen, Netherlands. Publication and operation of the platform, commercialisation, development and hosting. Chamber of Commerce (KvK): 42115943 · VAT NL005506418B96.
NVBB SARL - Abomey-Calavi, Benin (RCCM RB/ABC/22 B 5610, IFU 3202282896470). Payment of artisans.
MedA Conseils - Abomey-Calavi, Benin (RCCM RB/COT/08-B-3374, IFU 3200801419114). Support for artisans, product quality checks (certified by CIAAC), issuing of membership numbers.

For any question about your personal data, use our form for requests about your data: you receive an e-mail to confirm your request, then you follow the answer and write to us from a personal link. You may exercise your rights with either partner; they forward requests to one another.

2. What data we collect

We collect only what the service requires. We do not ask for any of the special categories of Article 9 GDPR: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, genetic or biometric data. Some data nevertheless needs extra protection; it is listed below: copy and number of an identity document (artisans), gender (optional, scouting records), a shop's country of origin.

If you place an order

Surname, first name, email address, phone number
Delivery address and, if different, billing address
Order contents, amounts, payment status
IP address and browser used at the time of the order

If you withdraw from an order

Order reference, name, email address and address (taken from the order or entered by you), names of any other consumers concerned
Items returned, date of receipt, reason and condition of the product if you give them, return method and refund preference
The form frozen on submission (with its SHA-256 fingerprint) and its PDF, an encrypted fingerprint of your IP address (never the address itself), the messages exchanged, the return tracking number and the refund reference

If you report a parcel problem

Order reference, name and email address (taken from the order), items concerned, type of problem, date of receipt, condition of the packaging, description and wish
The photos you add: we save them again ourselves, without the GPS location or other hidden device data, in a private space that is never published; only the people handling the claim see them
The claim frozen on submission (with its SHA-256 fingerprint), an encrypted fingerprint of your IP address (never the address itself), the messages exchanged, the carrier's case reference and the solution chosen
They are shared, for this case only, with the artisan or the shop, MedA Conseils and the carrier concerned

If you browse without ordering

A small file the site places on your device, used only to remember what you have put in your basket. Without it, your basket would be empty every time you change page. It contains a randomly generated number and nothing else: not your name, not your address, not what you look at. It erases itself after 30 days.
IP address and browser linked to the basket, to prevent abuse

If you buy a ticket for the Expo

Surname, first name, email and phone of the ticket holder
A unique QR identifier, used at access control

If you are an artisan or a prospective partner

Identity, contact details, workshop address
Identity verification (KYC): type, number and copy of an identity document (identity card, passport, NPI, driving licence or residence permit), viewed only by our authorised staff and those of MedA Conseils, never published. For a Dutch document, hide the BSN number and the photo before sending it: we do not need them. Bank details required for payouts.
For professional applications: company name, manager, IP address and browser at submission

If a regional representative has recorded you as an artisan

Name, workshop name, craft, phone, e-mail, town, KVK number if any, photo of a piece, your consent (date) and the representative's notes
Gender, only if you agree to give it (woman, man or "prefer not to say"): it is used only for the region's figures on the independence of women artisans (SDG 5), is never shown publicly and never used for a decision about you.
The record is only saved with your consent; you can ask for it to be deleted at any time.

If you order a made-to-measure bag or a shop item

The same data as for an order, plus the model, fabric and carrier chosen
For collection at the shop: a single-use collection code, stored in encrypted form

If you agree to receive our news

Email address, language, text of the consent you gave, date, IP address and browser

Security logs

Login attempts to the artisan and administrator areas are logged: email address entered, IP address, browser, date. This logging protects accounts against unauthorised access.

3. Why we process them, and on what basis

Fulfilling your order - processing, shipping, after-sales. Basis: performance of the contract.
Handling your withdrawal - acknowledgement with the PDF of the form, return of the product, refund. Basis: legal obligation (Directive 2011/83/EU, Dutch Civil Code art. 6:230o et seq.).
Answering your requests about your data - form, confirmation e-mail, messages and answer. Basis: legal obligation (GDPR, articles 12 to 22).
Handling your parcel claim - acknowledgement, review with the artisan or the shop, MedA Conseils and the carrier, solution (replacement, repair or refund). Basis: performance of the contract and legal obligation (guarantee of conformity, Dutch Civil Code art. 7:17 et seq.).
Issuing mandatory documents - invoice, CN23 customs declaration. Basis: legal obligation.
Paying the artisans - statements, payouts. Basis: performance of the contract.
Securing the platform - logs, fraud prevention. Basis: legitimate interest.
Replying to you - contact form, partnership enquiries. Basis: legitimate interest, or consent.
Arranging an appointment - day, time, type (video call or at your premises), contact details and, for a meeting at your premises, your address. Basis: your request (pre-contractual steps) and your consent.
Registering your shop - shop name and legal name, the shop's country of origin (shown on its page, as the culture of its products), company and VAT numbers (KVK and BTW in the Netherlands, RCCM and IFU in Benin), website or Facebook or Instagram page, address, province, manager and contact details, to review the registration, contact you and then present the shop. Basis: your request and your consent.
A shop's country of origin describes the culture of its products; it is shown on the shop's page with the shop's agreement. It says nothing about the origin of the people who run the shop and is not used as such.
Counting clicks to money transfer providers - a random code, without personal data, to receive the referral commission. Basis: legitimate interest.
Keeping you informed - events and news, only if you agreed to it. Basis: consent, which you can withdraw at any time with the unsubscribe link in every message.
Keeping the accounts - entries for commissions and payments. Basis: legal obligation.

We carry out no profiling, no automated decision-making and no targeted advertising. We do not sell or rent your data.

4. Who else has access

Only service providers necessary to deliver the service, each for the stated purpose alone:

Kkiapay (Benin) - payment processing. Your card details pass through this provider and are never stored on our servers.
Mollie (Netherlands) - processing of international payments in euros. Your card details pass through this provider and are never stored on our servers.
MedA Conseils (Benin) - collection of parcels from the artisans and handover to the carriers (recipient name, address and phone, parcel contents).
La Poste du Bénin - parcel carriage, CN23 customs declaration (recipient name, address, phone, description and value of the items).
DHL and PostNL - transport and delivery of parcels, including from the relay shops in Europe (recipient name, address and phone). For a shop item delivered to your home, we arrange the shipment and pass these details to the carrier you choose; the shop does not receive your address.
LWS - server and database hosting.
Licensed money transfer providers - if you click through to one of them, you leave our website; the provider only receives a random code that identifies us as the referrer. The data you then give the provider is processed by that provider under its own privacy policy.
Netherlands Chamber of Commerce (KVK) - when a shop registers, the name entered is sent to its search service to find the business.
Our administrators and those of MedA Conseils and NVBB SARL - a limited number of authorised people, who access orders, artisan accounts and application files in order to handle sales, pay artisans and answer your requests. Every access is named and logged.
Fonts and flags - hosted on our own servers: displaying the site sends no data to Google or any other service. Google Maps and Google Forms open only if you click the corresponding link.
Google (calendar and Google Meet) - appointments are entered in our Google calendar: your name, email, the topic and, for a meeting at your premises, your address; Google sends you the invitation with the video call link. Google may process this data in the United States, under the EU-US Data Privacy Framework.
Remitly (Ireland) and its partner platform Impact - receive only the random code of a click to Remitly, never your name, email address or IP address.

The artisan concerned receives the details needed to ship your order: name, delivery address, phone.

Tracking your parcel

When the parcel is handed over, an authorised courier from our team or from MedA Conseils, logged in with a personal code, sees the recipient's name, address and phone number, and records the tracking number given by the carrier. This number appears on your order tracking page and is sent to you by e-mail.

PostNL or DHL shipment - the tracking link opens the carrier's website (the PostNL link also contains the delivery country and postcode, which PostNL already knows). On that website, the carrier's privacy policy applies.
Shipment with La Poste du Bénin - the steps (in transit, customs clearance, out for delivery, delivered) are reported on our website by MedA Conseils, from La Poste du Bénin's international tracking.
No automatic tracking for now - our website does not query any carrier on its own. If automatic tracking is introduced, only the tracking number will be sent to the carrier to read the parcel status, and this page will be updated beforehand.

5. Transfers outside the European Union

The service operates between Benin and the Netherlands, and to the destination country you choose. Benin is not covered by an adequacy decision of the European Commission. Transfers to Benin are governed by the European Commission standard contractual clauses and limited to what is necessary to fulfil your order.

6. How long we keep them

Orders, invoices and customs documents: 7 years, accounting and tax retention period.
Withdrawals: 7 years, like the order and its refund.
Parcel claims and their photos: 7 years, like the order and the solution provided.
Artisan accounts: for the duration of the relationship, then only the accounting records required by law, for 7 years.
Expo tickets: until the close of the edition concerned.
Security logs: 12 months.
Unconverted basket: the cookie expires after 30 days.
Contact messages: 24 hours after the last reply.
Appointments: 1 year after the appointment date, then deleted automatically (including from the Google calendar).
Shop registrations: for as long as the shop is part of the network; a refused or abandoned registration is deleted automatically 1 year after the request.
Clicks to money transfer providers: 24 months, without personal data, to reconcile commissions.
Consent to receive our news: until you unsubscribe; proof of the consent and of its withdrawal is then kept so that it can be demonstrated.
Content of notifications sent: erased after 180 days.

7. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. You may withdraw your consent at any time where processing relies on it.

Make your request with our form for requests about your data: access, correction, erasure, restriction, objection, portability, withdrawal of consent or a simple question. We reply within one month; for a complex request this period may be extended by two months, and we tell you why. Some requests cannot be granted: an issued invoice cannot be erased before the end of the statutory retention period.

To check that it is you, without asking for an identity document, we have you confirm your e-mail address through a link, then compare it with the address of your order or account; if in doubt, we ask you for more information. Another person may make the request for you: they then attach your written, signed authorisation (or, for a parent or guardian, the official document) and your identity document, with the photo and number masked. These proofs are erased 30 days after our answer.

The order or account reference you give must be linked to your e-mail address. Without an order or account with us, you do not declare that you are the person concerned: you explain why we would hold data about you, and we check that explanation, asking you for more information if needed, before we answer.

If our answer does not satisfy you, you may lodge a complaint with:

in the Netherlands, the Autoriteit Persoonsgegevens - autoriteitpersoonsgegevens.nl
in Benin, the Autorité de Protection des Données à Caractère Personnel (APDP) - apdp.bj
the supervisory authority of your country of residence in the European Union

8. Cookies

A cookie is a small file that the website places on your device to remember something from one page to the next. Our website only uses cookies that are necessary for it to work:

Session cookie - keeps you logged in (artisan, shop or administrator account), protects forms against fraudulent submissions and remembers your recent orders, so that only this browser can open their payment, confirmation and invoice pages. It is deleted when you close the browser.
Cart cookies (artisans' creations, shop items) - a random number that remembers the contents of your cart, for up to 30 days.

They cannot recognise you on other websites, do not count your visits and are not shared with anyone. We use no advertising cookies, no third-party trackers and no behavioural statistics tools. No consent banner is therefore needed.

9. Security

Traffic is encrypted with HTTPS. Access to the artisan and administrator areas is protected by a one-time code sent by email, with logging of attempts; administrators also confirm every sign-in with a code from an authenticator app (two-factor authentication). The browser must use HTTPS (HSTS) and only runs resources from our site and our payment providers (content security policy). Payment card data never passes through our servers.

The payment, confirmation and invoice pages of an order (tickets and applications included) only open in the browser that placed the order, or for a signed-in administrator. Order numbers follow each other; this way nobody can see another customer's data or tickets by guessing a number. Your tickets, confirmation and invoice are sent to you by email.

To protect payments, the delivery country (and, in the shops, the payment method) is the country you connect from: it is derived from your IP address when you order, on our own server, without any outside service, and this check creates no additional record. Orders placed through a VPN, a proxy, the Tor network or a data centre are refused. Location data: IP Geolocation by DB-IP (CC BY 4.0 licence).