Privacy Policy

Last updated: 15 September 2026.

This page explains what personal data GK Professional processes when you use the gkpro.fr website, why, for how long, who can access it and how to exercise your rights. It also lists the cookies used by the website.

The areas reserved for retailers (revendeur.gkpro.fr) and for municipal police forces and local authorities (pm.gkpro.fr) are not covered by this page.

1. Who is responsible for your data?

The data controller is:

GK PROFESSIONAL, société par actions simplifiée (simplified joint-stock company)
159 avenue Gallieni, 93170 Bagnolet, France
RCS Bobigny 444 484 042
Telephone: +33 1 55 82 15 00

2. Contacting us about your data

For any question about your data or to exercise your rights, write to our personal data officer:

• by e-mail: eshop@gkpro.fr
• by post: GK Professional, Référent données personnelles, 159 avenue Gallieni, 93170 Bagnolet, France.

3. The data we process and why

Summary

Each processing operation is described in detail below. We do not take any automated decision producing legal effects concerning you and we do not carry out profiling. We do not sell or rent your data.

Fields marked as mandatory in our forms are required to handle your request or your order. The others, such as date of birth or title, are optional.

Customer account

• Purpose: creating and managing your account, giving you access to your addresses, orders and invoices.
• Data: title (optional), last name, first name, e-mail address, password (stored in an encrypted form that we cannot read), date of birth (optional), delivery and billing addresses, telephone number, order history, date on which you accepted the terms and conditions and this policy.
• Legal basis: performance of the contract between us when you create an account (Article 6(1)(b) GDPR).
• Retention: as long as the account is used. After 3 years without any order, login or other activity, the account is automatically anonymised: your name, your e-mail address, any addresses that do not appear on an order and your pending carts are deleted. Order data and invoices are kept for the period stated below.

If you had an account on the former gkpro.fr website, your contact details, addresses and order history were transferred when we changed platforms in 2026. Former passwords were not transferred: use the “Forgot your password?” link to choose a new one.

Orders, payment and delivery

You can order with or without an account (guest checkout). The data is the same in both cases.

• Purpose: recording and preparing your order, collecting payment, delivering it to you, keeping you informed of its progress by e-mail and tracking the parcel.
• Data: identity, e-mail address, telephone number, delivery and billing addresses, items ordered, amounts, delivery method, selected pickup point, tracking number, payment method, transaction reference and status.
• Payment: card payments are made on the secure Systempay page, bank transfers on the Fintecture page and your bank’s page. GK Professional never receives or stores your card number or your banking credentials. Payment security checks (3-D Secure) are carried out by these providers and by your bank. For payment by cheque, we use the information on the cheque for the time needed to cash it.
• Internal management: your order and the relevant contact details are sent to our sales and accounting software (Sage 100), where a customer account is created for invoicing, and then to our logistics software (Log’n Track) to prepare the parcel and print the shipping label.
• Legal basis: performance of the sales contract (Article 6(1)(b) GDPR).
• Retention: 10 years from the order. This period corresponds to the obligation to keep contracts concluded electronically for an amount of 120 euros or more (Article L213-1 of the French Consumer Code) and accounting records (Article L123-22 of the French Commercial Code).
• Carts: a cart that did not result in an order is deleted 3 years after it was last modified.

Invoicing and accounting obligations

• Purpose: issuing invoices and credit notes, keeping the accounts, responding to checks by the authorities.
• Data: identity, billing address, details and amounts of orders, invoices, credit notes, payment and refund references.
• Legal basis: legal obligation (Article 6(1)(c) GDPR).
• Retention: 10 years from the end of the financial year.

We may also keep the information needed to prove an order or an exchange for the applicable limitation period (generally 5 years), in order to establish or defend our rights in the event of a dispute. This retention is based on our legitimate interest.

Returns, withdrawal, exchanges and refunds

• Purpose: handling a withdrawal, a return, an exchange or a claim under the legal guarantees, issuing the return label, processing the refund.
• Data: order number, items concerned, reason, exchanges with customer service, return label and tracking number, refund amount and reference. Your bank details (IBAN) are only requested if the refund cannot be made using the payment method used for the order, for example for an order paid by cheque.
• Legal basis: performance of the contract and compliance with our legal obligations (right of withdrawal, legal guarantee of conformity).
• Retention: for the time needed to handle the request, then kept with the order for 10 years.

Refunds of card payments are made through Systempay, to the card used for the order.

Customer service and contact form

• Purpose: answering your questions and your requests for quotes or prices, and following up on our exchanges.
• Data: name, e-mail address, order or product reference where applicable, content of the message and attachments, replies given.
• Legal basis: our legitimate interest in replying to people who contact us (Article 6(1)(f) GDPR); for a quote request, pre-contractual steps taken at your request (Article 6(1)(b)).
• Retention: 3 years after the last exchange, then automatically deleted.

Back-in-stock alerts

• Purpose: letting you know by e-mail when an out-of-stock item is available again, if you asked for it on the product page.
• Data: e-mail address, item concerned.
• Legal basis: consent (Article 6(1)(a) GDPR).
• Retention: the request is deleted as soon as the alert is sent. If the item does not come back in stock, the request is deleted no later than 1 year after it was recorded.

“GK Letter” newsletter

• Purpose: sending you our new products and offers by e-mail.
• Data: e-mail address, date of subscription and date of confirmation.
• Legal basis: consent (Article 6(1)(a) GDPR). After filling in the form, you receive a confirmation e-mail: your subscription only takes effect once you have clicked the link in that e-mail.
• Unsubscribing: at any time, using the link included in every newsletter or by writing to us. Withdrawing your consent does not affect e-mails already sent.
• Retention: until you unsubscribe. After you unsubscribe, your address is kept on a suppression list, solely to make sure we no longer write to you.
• Open tracking: our e-mails, whether the newsletter or messages about your account and your orders, are not individually tracked for opens or link clicks.

We do not send you commercial offers by e-mail unless you have subscribed to the newsletter.

Retailer map

The “Our retailer network” page shows the professional points of sale that distribute our products.

• Persons concerned: our professional retailers. For a sole trader, the name displayed may be that of the owner.
• Published data: trade name or company name, address of the point of sale, position on the map. The telephone number is not displayed.
• Source of the data: our customer file (Sage 100), updated daily.
• Legal basis: our legitimate interest and that of our retailers in directing the public to a point of sale (Article 6(1)(f) GDPR).
• Retention: as long as the retailer is part of our network and appears on the map. A retailer who no longer wishes to appear can ask us through the contact form or at the address given in section 2; it is removed from the map no later than the day after our file is updated.

For visitors to the map:

• The town or postcode entered in the search box is converted into geographical coordinates by our server, which queries the IGN geocoding service (for France) or the OpenStreetMap Nominatim service (for other countries). Only the text entered is sent, never your IP address. Results are kept for 90 days to speed up later searches, with no link to the person who made them.
• The “Near me” button uses your browser’s location feature, only after you click it and give your consent in the browser prompt. Nearby retailers are calculated in your browser: your location is neither sent to our servers nor stored.
• The map background is loaded from the servers of the OpenStreetMap Foundation, which receive your IP address when it loads (see section 6).
• The “Directions” link opens Google Maps in a new tab. Only the retailer’s address is included in the link; Google then processes your data under its own policy.

Website security and fraud prevention

• Purpose: protecting the website and your data against attacks, intrusion attempts and fraudulent use, diagnosing technical incidents.
• Data: IP address, date and time, page requested, referring website, browser type, technical error messages.
• Legal basis: our legitimate interest in ensuring the security of the website and of our customers (Article 6(1)(f) GDPR).
• Retention:
  • web server logs: one month at most;
  • website visit log (IP address, landing page, referring website): 13 months;
  • shop technical log: 12 months;
  • blocking of an IP address that behaved maliciously: from a few hours to a few days.

The website is protected by the CrowdSec software. When an IP address behaves in a way typical of an attack, it is blocked and reported to the community network of the software publisher, CrowdSec SAS, in order to protect other websites. No other data is sent.

4. Who has access to your data?

Within GK Professional

Only the people who need it for their work have access to your data: customer service, logistics, accounting, and the people in charge of administering the website.

Our service providers

Our service providers act on our instructions and solely for the purposes of their assignment. They are required to protect your data and not to use it for any other purpose.

Our management software (Sage 100, Log’n Track and our internal management application) runs on servers located on GK Professional’s premises in France. The following may access them, solely for the purposes of their work: DavySoft, our technical service provider, and the publishers or integrators of this software as part of its maintenance.

When you pay, your bank and, for a bank transfer, Fintecture also process your data on their own behalf, under their regulatory obligations.

Other recipients

Your data may be disclosed to administrative or judicial authorities where required by law (for example following an official request), and to our advisers (lawyer, chartered accountant, statutory auditor) in the course of their work.

5. Transfers outside the European Union

Your data is hosted in France. Some of the service providers listed above are located outside the European Union:

• Mapbox, Inc. and Cloudflare, Inc. (United States): these companies participate in the EU-U.S. Data Privacy Framework, recognised by the European Commission as providing an adequate level of protection.
• The OpenStreetMap Foundation (United Kingdom): the United Kingdom benefits from an adequacy decision of the European Commission.

You can obtain further information about these safeguards by writing to us at the address given in section 2.

6. Cookies and trackers

What we use

A cookie is a small file placed in your browser. The gkpro.fr website only uses cookies and trackers that are essential for it to work. In accordance with Article 82 of the French Data Protection Act (loi Informatique et Libertés), they do not require your consent, which is why no banner asks you for it.

When you are redirected to the payment page of Systempay, Fintecture or your bank, these websites may set their own cookies, governed by their own policies.

What we do not use

The website does not use any audience measurement tool, advertising cookie, social media sharing button or video embedded from a third-party platform. If we were to add one of these tools, a banner would let you accept or refuse it, just as easily either way, before anything is stored, and this page would be updated.

Content loaded from other websites

Some pages load elements hosted by third parties, which then receive your IP address, as with any connection to a website:

• if you choose Colissimo pickup point delivery, the map of pickup points is provided by Mapbox;
• if you choose Mondial Relay, the relay point selector is loaded from the Mondial Relay website;
• at the payment step, a Fintecture script is loaded;
• on the retailer page, the map background is loaded from OpenStreetMap.

The website’s fonts and icons are hosted on our own servers.

Your settings

You can delete or block cookies from your browser settings. If you block the website’s cookies, the cart and your account login will no longer work.

7. Your rights

You have the following rights over your data:

• right of access: to know what data we hold about you and obtain a copy;
• right to rectification: to have inaccurate or incomplete data corrected;
• right to erasure: to have your data deleted, except where the law requires us to keep it (invoices, for example);
• right to restriction: to ask for your data to be kept but not used, for example while a dispute is being checked;
• right to data portability: to receive the data you have provided to us in a machine-readable format;
• right to object: to object to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time, without giving any reason, to receiving direct marketing;
• withdrawal of consent: to withdraw at any time your consent to the newsletter or to a back-in-stock alert;
• instructions after your death: to set instructions for the storage, erasure and disclosure of your data after your death (Article 85 of the French Data Protection Act).

How to exercise them

• From your account: the “Account” section lets you edit your personal information, the “Addresses” section your addresses, and “My stock alerts” lets you delete a back-in-stock alert. The “My personal data” button on the “Your account” page lets you download a copy of your data in PDF or CSV format.
• Newsletter: unsubscribe link included in every e-mail.
• For any other request, including deleting your account: write to us at eshop@gkpro.fr or at the postal address given in section 2.

We reply within one month of receiving your request. This period may be extended by two months for a complex request; in that case we will let you know within the first month. We only ask for proof of identity if there is reasonable doubt about your identity.

Complaint to the CNIL

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority (Commission nationale de l’informatique et des libertés, CNIL), online at https://www.cnil.fr or by post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. We encourage you to contact us first so that we can look into your request.

8. Security of your data

We take appropriate technical and organisational measures to protect your data:

• all pages of the website are served over an encrypted connection (HTTPS);
• passwords are stored in an irreversible encrypted form;
• card data does not pass through our servers;
• access to the website’s administration is restricted to authorised persons and protected, for all our employees, by two-factor authentication;
• the website is protected against attacks and backed up daily; backups are encrypted and kept for 30 days by our hosting provider in France.

In the event of a data breach presenting a risk to your rights, we notify the CNIL and, where required by law, we inform you.

9. Minors

The gkpro.fr website is intended for adults. Some categories of items, in particular weapons and regulated equipment, are reserved for buyers who meet the conditions laid down by the applicable regulations. A minor using the website does so under the responsibility of their parents or legal guardian.

We do not knowingly collect data about minors under the age of 15; if you believe we have, write to us and we will delete it.

10. Changes to this policy

We may change this policy, in particular when we add a service or change service provider. The date of the latest version is shown at the top of this page. In the event of a significant change, we will let you know by e-mail or by a message on the website.