Privacy policy

Operator and contact details

Preview template. The operator’s details and contact for personal data requests have not yet been provided. Complete this section and approve the policy before launching the service in production.

• Operator’s full legal name: [to be provided]
• Country of registration and legal form: [to be provided]
• Registration number and tax identifier (if applicable): [to be provided]
• Registered or postal address: [to be provided]
• Email for personal data enquiries: [to be provided]
• Additional contact channel: [to be provided, if used]
• Representative / data protection contact: [to be provided, if required]

About this policy

This policy describes the processing of visitors’ personal data by BDPM. The service provides medicine information and helps you send an information request to a manager. The website does not accept payments or complete medicine purchases.

The BDPM administration is responsible for processing data within the service. Send privacy questions and requests to exercise your rights through the contact channels in the “Operator and contact details” section. This policy applies subject to the laws applicable to the operator and user, including the EU General Data Protection Regulation (GDPR) where applicable.

Visiting the website is not consent to all processing. Consent is requested separately where needed. You can browse the catalog without registering.

Data we process

Data comes from you when you use website features and automatically when you connect to the service.

• Account: email, address verification details, password hash, active sessions and linked inquiry history. Passwords are not stored in plain text.
• Inquiry: selected medicines and quantities, indicative estimate, language and currency, chosen contact channel, email, phone number or messenger username, comment, status and handling history.
• Reviews: name or pseudonym, optional city or country, text, language, publication consent and moderation details.
• Technical data: IP address, browser and device information, request times and parameters, session identifiers and security records. Some security checks use hashed values.
• Browser preferences: language, currency, wishlist, inquiry confirmations and information used to access inquiry status.

Purposes and legal bases

We process the data needed for each feature. The legal basis depends on the purpose and applicable law.

• Providing an account and responding to an inquiry you initiate: fulfilling your request and taking steps before a possible contract, where this basis applies.
• Storing your inquiry and contacting you through your chosen channel: the separate consent requested before submission. Consent to a reply is not consent to advertising messages.
• Publishing a moderated review, your name or pseudonym and stated location: separate publication consent.
• Account protection, abuse prevention and website operation: legitimate interests in service security, balanced against users’ rights.
• Meeting mandatory requirements and responding to lawful authority requests: applicable legal obligations.

Health information

Medicine selections or comments may indirectly reveal health information. Such information may be special category personal data and require an additional lawful basis.

The website is not intended to collect medical documentation. Do not submit diagnoses, examination results, prescriptions, identity documents or other people’s health information. A medicine name and contact are enough for an initial inquiry. If further assistance requires sensitive data, the conditions and lawful basis must be agreed separately before sharing it.

Cookies and browser storage

The website uses cookies for language, currency, sign-in and request protection. Language and currency cookies are set for up to one year; authentication and session protection cookies for up to 30 days. Sessions may end earlier when you sign out or access is revoked.

localStorage holds your language, currency, wishlist and inquiry confirmations. A confirmation may contain selected items, an inquiry reference and a guest token for status access. Your inquiry contact and comment are not stored in these confirmations. Local data may remain until you clear it in your browser; closing a tab does not clear localStorage. Some temporary state uses sessionStorage and tab history.

To measure how the site performs we use the anonymised Yandex Metrica and Google Analytics counters: they record page views, navigation and goal completions (such as sending a request) and set their own cookies for up to two years. Session recording (webvisor) is off. No advertising trackers are used. You can block the counters in your browser settings or with an extension; the site keeps working.

You can restrict cookies and clear website data in your browser settings. This may sign you out, erase your wishlist and remove guest status access. Clearing browser data does not delete data already submitted to the server. Sign out on shared devices and do not share guest tokens.

Who may receive data

Authorized staff have access within their responsibilities, as do infrastructure, storage and service email providers where used to operate the service. Data may be disclosed to public authorities on a lawful basis.

Choosing Email, WhatsApp, Telegram or phone means communication through that channel. If internal Telegram notifications are enabled, inquiry details may also be sent to that provider to notify a manager. Communication providers process data under their own privacy policies.

Published reviews, names or pseudonyms and stated locations are publicly visible and may be copied by third parties. Inquiry contact details are not published with reviews. We do not sell personal data.

International transfers

Foreign infrastructure or your chosen messenger may involve processing in another country. The conditions depend on the provider actually used.

Where GDPR applies, transfers outside the European Economic Area require a lawful mechanism: an adequacy decision, appropriate safeguards such as standard contractual clauses, or an applicable derogation. You may ask the BDPM administration about actual recipients, processing countries and safeguards.

Retention periods

Account data is needed to maintain your account, inquiry data to respond, provide assistance and resolve related matters, and consent records to demonstrate the basis for processing. Reviews are retained for moderation and publication until consent is withdrawn or publication is no longer needed, subject to lawful grounds for retaining particular records.

The period depends on the purpose, inquiry status, mandatory requirements and the need to protect legal rights. The current version has no single automatic deletion period for server-side inquiries, accounts or reviews. You can request deletion or information about the retention of your data from the administration.

Guest status access tokens last up to 30 days; token expiry does not delete the inquiry itself. Backups and security records may be retained separately for the necessary period; deleted data should not return to active processing when backups are restored.

Data security

Measures include access controls, session checks, protection against forged requests, rate limits and staff activity logs. Inquiry contact details and comments are encrypted at rest; passwords are hashed. No method of transmission or storage eliminates every risk.

After an incident, the administration assesses the risk, takes action and notifies the competent authority and affected users where and within the time limits required by applicable law.

Your rights and how to make a request

Subject to applicable law, you may request access and a copy, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. Withdrawing contact consent may prevent further handling of your inquiry.

Contact the BDPM administration with the subject ‘Personal data’, your request and, if available, your inquiry reference. Use the same contact as your inquiry or registration. Proportionate identity verification may be needed to protect your data; do not send passwords or identity documents without a separate justified request.

Where GDPR applies, a response is normally provided within one month; you will be notified within that first month of a justified extension. Otherwise the applicable law’s time limits apply. You may complain to the competent data protection authority; in France, this is CNIL. The website does not make decisions with legal or similarly significant effects solely through automated processing.

Children and other people’s data

The service is intended for adults. Do not share a child’s or another person’s data without an appropriate lawful basis. Contact the administration if you believe such data has been shared unlawfully so that deletion can be considered.

Policy updates

The current version is published on this page with its update date. Material changes to processing purposes or conditions require further information and, where processing relies on consent, consent before the new processing begins.