Privacy policy

Last updated: 4 October 2026.

This policy explains what personal data we collect when you visit nkosiagro.com, place an order or write to us, why, who we share it with, how long we keep it and how to exercise your rights. It applies the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French Data Protection Act (loi Informatique et Libertés) of 6 January 1978.

Who is responsible for your data

NKOSI AGRO, SASU with share capital of €1,000, RCS Paris 922 273 784, 60 rue François 1er, 75008 Paris, France. For any question about your data: info@nkosiagro.com.

The data we collect

• Orders: surname, first name, delivery and billing addresses, email, phone number if required for delivery, products ordered, amounts, payment method used. We never receive your full card number.
• Customer service: your messages, our replies and the photos you send us.
• Withdrawal: the information entered in the “Withdraw from contract here” form.
• Newsletters: your email address and your preferences, if you sign up.
• Reviews: the name displayed (first name and initial), the rating, the text and the photos you publish.
• Browsing: pages viewed, device, browser, IP address, collected by cookies or analytics tools, depending on your choices (see “Cookies and audience measurement”).
• Job applications: your CV and your message, if you write to us about a job.

Why we use it, and on what legal basis

Purpose	Legal basis
Processing your order: payment, preparation, delivery, invoice, after-sales service, withdrawal and guarantees	Performance of the contract
Keeping our accounts and meeting our tax obligations	Legal obligation
Replying to your messages and complaints	Performance of the contract, or our legitimate interest in replying to you
Sending you our newsletters and offers, and reminding you about an unfinished basket or payment	Your consent, which you can withdraw at any time
Inviting you to leave a review after an order, and publishing reviews	Our legitimate interest in collecting our customers' feedback
Measuring the website's audience and improving it	Your consent; anonymous audience measurement by Matomo: our legitimate interest
Measuring the effectiveness of our advertising and our product listings (Google, Meta, Pinterest)	Your consent
Preventing fraud and securing payments	Our legitimate interest
Reviewing a job application	Steps taken at your request; your consent for us to keep your CV for another vacancy

We do not make any automated decision that produces legal effects concerning you.

Who receives your data

Only the NKOSI team has access to it, as far as its work requires, along with our service providers, each for its own task and in accordance with our instructions:

• Shopify: online shop and website hosting, payments (Shopify Payments), website messaging (Shopify Inbox);
• PayPal, Klarna (through Stripe) and Scalapay: payment, depending on the method you choose;
• SupplyFresh and its Wonderweb software: preparing and shipping parcels from Rungis;
• BaseLinker: centralised order tracking;
• Colissimo (La Poste) and Chronopost: delivery;
• Klaviyo: newsletters and reminders;
• Judge.me: review invitations and publication of reviews;
• Google: the team's email and documents (Google Workspace), audience measurement (Google Analytics), advertising measurement (Google Ads) and product listings (Google Merchant Center);
• Meta (Facebook, Instagram) and Pinterest: measuring our advertising and our catalogues, with your consent;
• PostHog (servers located in the European Union) and Microsoft Clarity: analysing how the website is used, with your consent;
• Hostinger: our server, located in the European Union, which hosts Matomo audience measurement, the withdrawal form and our internal tools;
• Cloudflare: security and routing of traffic to our tools;
• Anthropic: an artificial intelligence tool that helps our team sort customer service messages and prepare replies;
• Keobiz, our chartered accountant, and Pennylane, our accounting software: invoices and accounting;
• administrative or judicial authorities, when required by law.

We never sell your data.

Transfers outside the European Union

Some providers, in particular Shopify, Google, Meta, Pinterest, Klaviyo, Microsoft, Cloudflare, PayPal and Anthropic, may process data outside the European Union, particularly in the United States or Canada. These transfers are based on an adequacy decision of the European Commission (Canada, or the EU-US Data Privacy Framework for certified companies) or on the Commission's standard contractual clauses. You can ask us for details.

How long we keep it

Data	Retention period
Orders and invoices	10 years (accounting obligation)
Customer data needed for our relationship (contact details, history)	3 years after your last order or your last contact with us
Newsletters	until you unsubscribe, and no more than 3 years after your last contact with us
Exchanges with customer service, complaints, withdrawals	3 years after the end of the exchange
Published reviews	as long as the review is online (see our reviews charter)
Cookies and trackers	13 months at most; audience measurement data, 25 months at most
Job applications	until the end of the recruitment process; 2 years after our last exchange if you agree to our keeping your CV

At the end of these periods, the data is deleted or anonymised. It may be kept longer, in archives, if a dispute or a legal obligation requires it.

Your rights

You can access your data, have it corrected or erased, restrict its use, object to processing based on our legitimate interest, withdraw your consent at any time and receive the data you have provided to us in a commonly used format (Articles 15 to 21 of the GDPR). You can also set instructions on what happens to your data after your death.

Write to us at info@nkosiagro.com: we reply within one month. If we have any doubt about your identity, we may ask you to prove it. To stop receiving our newsletters, click the unsubscribe link at the bottom of each one.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL): www.cnil.fr/fr/plaintes.

If you give us your phone number, it is only used to deliver and track your order. You can register free of charge on Bloctel, the French list for opting out of telephone marketing (www.bloctel.gouv.fr).

Emails

Our newsletters and basket reminders are only sent to people who have agreed to receive them. We do not measure whether our emails are opened or whether their links are clicked. Each email contains an unsubscribe link.

After an order, Judge.me may send you an invitation to leave a review; you can decline it in one click from that email or by writing to us.

Cookies and audience measurement

On your first visit, a banner lets you accept or refuse cookies and trackers that are not essential. Refusing is as easy as accepting, and does not prevent you from ordering.

• Essential, without consent: basket, payment, security, remembering your cookie choice (Shopify, Cloudflare).
• Anonymous audience measurement, without consent: Matomo, hosted on our server, counts page views without cookies or visitor identifiers, with anonymised IP addresses; order data is only sent to it with your consent.
• Audience measurement and usage analysis, with your consent: Google Analytics, PostHog, Microsoft Clarity.
• Advertising and social networks, with your consent: Google Ads, Meta Pixel, Pinterest Tag, Klaviyo.
• Reviews, with your consent for measurement: Judge.me.

To change your mind at any time, use the “Manage cookies” link at the bottom of every page of the site. You can also delete the nkosiagro.com cookies in your browser settings: the banner will be shown to you again on your next visit.

Job applications

If you send us a job application, we only use it to review your profile. If we do not take it further, we delete it at the end of the recruitment process, unless you agree that we may keep it for 2 years for another vacancy.

Security

The website is encrypted (HTTPS), access to data is limited to the people who need it, and payments go through providers certified to PCI DSS. In the event of a data breach presenting a high risk to you, we will inform you as soon as possible (Article 34 of the GDPR).

Changes to this policy

We update this policy when our practices or the law change; the date of the last update is shown at the top of the page.