Privacy policy

Here we explain what data of yours we use when you visit bkmodules.com, buy from us, install one of our modules or ask us for something: what for, by what right, who we share it with and how long we keep it. And, above all, how you can see, correct or delete what we hold about you. We are a United States company, but because we offer our products in the European Union, we look after your data under the same rules as a European company.

Who processes your data

• Controller: BK Modules LLC, a New Mexico (United States) limited liability company, EIN 35-2838640, with its registered address at 102 Gold Ave SW, Albuquerque, NM 87102, United States. More details in the legal notice.
• Contact for anything relating to your data: bkmodules@bkmodules.com.

We do not have a data protection officer because our activity does not require one; write to the address above and the person in charge of data protection will reply.

What data we use and what for

For each use we tell you what the data is, why we are allowed to use it and how long we keep it. When that period ends, we delete it or keep it blocked solely to deal with possible claims for as long as the law allows.

Your account, your orders and your invoices

• Data: name, email, password (encrypted), company, billing address, tax ID or VAT number, phone number if you give it to us, orders, payments (without your card details, which we do not see) and invoices.
• What for: to create your account, process your purchases, take payment, invoice them and look after you.
• Why we're allowed to: the contract we have with you and, for invoices, our tax and accounting obligations.
• Retention: for as long as you have the account. Orders and invoices, for the time required by the tax and accounting rules that apply to us.

Licences, downloads and licence checks

• Data: the licences you hold, the addresses of the shops you link to them and the downloads you make (which version and when). When a module checks its licence, we receive from your shop: its address and name, the module and its version, the language and, for the connector, the Odoo database that talks to it (identifier, address and versions), plus the IP address of the server making the request.
• What for: to give you access to what you have bought, know which version you are entitled to and confirm to your shop that the licence is valid.
• Why we're allowed to: the contract.
• Retention: for as long as the licence exists.

Module installation log

When one of our modules is installed, updated or uninstalled in a shop, it notifies us with this data and nothing else: the module and its version, what happened (installation, update or uninstallation), the shop's domain and address, and the PrestaShop and PHP versions. No data about your customers, your orders or your configuration leaves your shop. When requesting the list of modules and articles shown on its configuration screen, the module also tells us the language and its own name.

• What for: to know which versions are in use so we can maintain compatibility, alert you in your shop when there is a new version, link the installation to its licence and know when to ask you whether the module is working for you.
• Why we're allowed to: our legitimate interest in maintaining and supporting the modules. This is usually business data, not data about an individual; if your shop is in your own name, you can object by writing to us.
• Retention: while the module remains installed or its licence exists, and at most two years from the last notification.

Business registration and VAT number check

• Data: your company details in the business registration and your intra-EU VAT number, which we check in VIES, the European Commission's system.
• What for: to create your business account and check that the VAT number is valid.
• Why we're allowed to: the contract and steps taken prior to entering into it and our tax obligations.
• Retention: that of your account. The result of the check, seven days in cache and then for as long as your account lasts.

Support, maintenance and support hours

• Data: what you tell us about your problem, your shop's address and version, the files you attach and, if you give them to us, access credentials to your shop or your server.
• What for: to resolve what you ask us. We use access credentials only for that work; we recommend that you give us temporary ones and revoke them when the work is finished.
• Why we're allowed to: the contract.
• Retention: for as long as the service lasts and, after that, the same as your orders. If you want us to delete attachments or access credentials sooner, just ask.

If, to do the work, we see data about your customers, we process it as your data processor, with the safeguards set out in the “Personal data” section of the general terms and conditions.

“What do you need?” and contact form

• Data: name, email, phone, company, website and what you tell us, together with the answers you choose in the assistant. From the assistant we also record which steps you go through, without any data about you until you send us the form.
• What for: to reply to you, prepare your proposal and, with the steps, understand where people get stuck so we can improve the assistant.
• Why we're allowed to: your request and steps prior to entering into a contract; for the steps, our legitimate interest in improving the website.
• Retention: if we end up working together, that of the contract; if not, two years from your last contact.

Agency programme

• Data: your website, how many shops you manage and what you do, the customers who arrive through your link or code, their purchases for commission purposes, and the bank or PayPal account where you want to be paid.
• What for: to assess your application, and to calculate and pay your commissions.
• Why we're allowed to: the programme contract and our accounting obligations.
• Retention: for as long as you are in the programme and, for payments, the period set by tax and accounting rules.

If you reach the shop through an agency's link, we keep that reference to attribute your purchase to it. The agency sees that you are its customer and the commission amount, not your payment details.

Marketing communications

We only send you marketing information in two cases, and neither is a condition for buying or downloading:

• News and offers, if you tick the box to receive them when registering, in the business registration or when placing a free order. We do this because you give us your consent.
• Modules and services similar to those you have already bought, if you are a customer (including with a free licence) and have not objected. We do this on the basis of our legitimate interest: the law allows us to write to existing customers about products similar to those they bought, as long as they do not object. We remind you of this at the payment step of each order, with the link to object.

Every marketing email includes a link to unsubscribe in one click and without signing in. You can also unsubscribe by writing to us. Unsubscribing applies to both cases until you tick a consent box again.

Retention: until you unsubscribe.

Feedback requests and reviews

• Data: your name, your email, the module you bought and when you installed it.
• What for: a few days after you start using a module, we ask you by email whether it is working for you and invite you to give your opinion. If you publish a review, it is shown with the name you write in it.
• Why we're allowed to: our legitimate interest in knowing whether what we sell works and in showing genuine opinions from buyers. You can object by writing to us and we will not ask you again.
• Retention: the review, for as long as it remains published; the record of the request, the same as your order.

Where each order comes from

• Data: when you place an order, we record with it how you reached the shop the first and the last time: channel (search engine, link, campaign…), source, campaign, landing page and referring page. Without an order, nothing is stored.
• What for: to know which channels bring us sales.
• Why we're allowed to: our legitimate interest in measuring our commercial activity.
• Retention: the same as your order.

Analytics and cookies

We use Google Analytics 4 through Google Tag Manager to understand how the website is used. It is only activated if you accept it in the cookie banner; until you do, it runs in restricted mode, without analytics cookies. You can change your choice at any time from the cookies policy, which lists the cookies we use.

• If you accept analytics, when recording a purchase we also send Google, from our server, the order together with your email, phone, name and address in hashed form (converted into a code from which the data cannot be recovered), so that the sale is measured even if the browser fails to send it. Why we're allowed to: your consent.
• If you do not accept it, we send Google only the amount and the products of the sale, without any data about you or any identifier of your browser, so that our sales figures add up. Why we're allowed to: our legitimate interest in measuring sales.
• Retention: Google keeps analytics data for 14 months.

We also keep a record of your choice in the cookie banner (what you accepted and when) so that we can show that you gave us your consent.

Language, country and currency

We use your IP address to work out your country so we can show you the shop in your language and currency; the shop stores your choice in a technical cookie. The IP address is not stored for this. Why we're allowed to: our legitimate interest in showing you the right shop for you.

Website security

Our server logs visits (IP address, date, page requested and browser) to detect attacks and faults, and some forms include an anti-bot check: the business registration uses Google reCAPTCHA, which analyses how you interact with the page; the others use our own check, which does not send data to anyone. Why we're allowed to: our legitimate interest in protecting the website and its users.

Withdrawal requests

If you withdraw from a purchase using our form, we keep your request, your order and our reply in order to process it and show that we did so. Why we're allowed to: the legal obligation to handle withdrawals. Retention: the same as your order.

Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Nor do we create profiles to set prices.

Who we share your data with

We do not sell your data. The following providers use it on our behalf and only for what we ask them to do:

Providers in the United States

• Stripe: card payments and other methods, and charging Subscriptions.
• PayPal: PayPal payments. PayPal also uses your data on its own account, under its own privacy policy.
• Cloudflare: all the website's traffic goes through its network, which speeds it up, protects it from attacks and tells us which country you are visiting from; it also stores our backups, encrypted and in data centres in Europe.
• Google: analytics and campaign measurement (Google Analytics and Google Tag Manager) if you accept them, the anti-bot check in the business registration (reCAPTCHA) and the website's typeface (Google Fonts), which your browser downloads from Google's servers.

Providers in Europe

• IONOS: the email service we use to write to you, including your order emails.
• PrestaShop (PrestaShop SA, France): connects the shop to PayPal for PayPal payments.
• European Commission: VAT number checks in VIES.

The website, the shop and our management and invoicing system (Odoo) run on our own server, which we manage ourselves, located in Europe. We also disclose data to public authorities, judges and courts when the law requires us to.

Data outside the European Economic Area

BK Modules LLC is a United States company: the data you give us is received by a US company, which looks after it under the same rules the European Union requires, because it offers its products to people there. Some of the providers listed above, or their parent companies, are also in the United States. We work with them under the safeguards the European Union recognises for these transfers: the EU-US Data Privacy Framework, where the provider is certified under it, or the standard contractual clauses approved by the European Commission. You can ask us for a copy of these safeguards by writing to us.

Your rights

You can ask us at any time, free of charge, for:

• Access: to know what data we hold about you and get a copy.
• Rectification: to correct any that is wrong.
• Erasure: to delete any we no longer need or that we use on the basis of your consent.
• Objection: for us to stop using the data we process on the basis of legitimate interest, and always the data used for marketing communications.
• Restriction: for us to keep your data without using it while we resolve a complaint of yours.
• Portability: to receive the data you gave us in a commonly used format, or have us pass it to someone else.
• Withdrawal of your consent whenever you like, without affecting anything done before.

You can exercise many of these yourself from “My account”: changing your details, downloading them or unsubscribing from communications. For anything else, write to us at bkmodules@bkmodules.com from your account's email address. If we have reasonable doubts about your identity, we will ask for only what is needed to verify it. We reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the data protection authority of your country. We would be grateful if you told us first: it can almost always be sorted out sooner.

How we keep your consents

So that we can show what you agreed to, we keep a record of each consent and each unsubscription from marketing communications: your account, your email, what you did (accepted, unsubscribed or the notice that accompanied your order), where, the order if there is one, the IP address, the exact text you saw in your language and the date. That record is never modified: a later unsubscription is recorded as a new line. We also keep your choices in the cookie banner. We keep them for as long as our relationship with you lasts and, after that, for the period during which a claim could be brought against us.

Other things you should know

• Required data: forms show which data is required. Without it we cannot give you what you ask for.
• Accurate data: the data you give us must be yours and up to date. If you give us someone else's data, for example a colleague's, make sure they can be aware of it.
• Age: the shop is aimed at adults. We do not knowingly collect data from children under 14.
• Security: the website is encrypted, passwords are stored encrypted, access to data is limited to those who need it and we make encrypted backups.

Changes to this policy

If we change anything important about how we use your data, we will publish it here with its date and, if it affects you, we will notify you by email before it applies.