This Privacy Policy describes how we collect, use, store, and protect your personal data, in compliance with the General Data Protection Regulation (GDPR) and applicable regulations.
Your personal data is managed and processed by the following company:
CHANG BIO SAS
Address: Paris, France
Registration Number: SIREN 927667428
Contact Email: changbiofr@gmail.com
When you use our website, fill out request forms, or communicate with us, we may collect the following information:
• Identification data: your name, email address, phone number.
• Sourcing & purchasing request details: product links, purchase lists, specifications, quantities, recipient shipping details, and other information directly related to your inquiry.
In our contact forms, your name, contact email, and details of your request are mandatory fields, which are necessary for us to evaluate project feasibility, request supplier quotes, and reply to you. If you choose not to provide this basic information, CHANG BIO SAS will not be able to respond to your inquiry, nor evaluate or provide purchasing, consolidation, forwarding, or sourcing services.
We collect and process your personal data solely for the following purposes:
• Evaluating the feasibility of proxy purchasing and sourcing inquiries.
• Executing purchase agreements, handling receiving, inspection, consolidation, repacking, and shipping coordination.
• Managing client communication, replying to questions, and providing customer support.
• Preparing commercial invoices, packing lists, and other documents required for customs declarations.
Pursuant to Article 6 of the GDPR, the legal bases for processing your personal data are:
• Article 6(1)(b) GDPR: contract performance, or taking steps at your request prior to entering into a contract (e.g., providing sourcing evaluations or price quotes).
• Article 6(1)(f) GDPR: pursuing our legitimate commercial interests (e.g., answering customer messages, optimizing website performance, and preventing business fraud).
Your personal data is shared only with the following third-party service providers, strictly as necessary to fulfill the services:
• Tally: the online form service used on our site to process your requests (data is stored within the European Union).
• Third-party shipping and logistics carriers: such as La Poste/Colissimo, Chronopost, etc., to ship your goods to the destination address.
For daily business communications and email management, we use the following service:
• Google / Gmail: as our business email and collaboration suite provider. This service may involve data processing or transfers outside the EU (e.g., to the United States). The actual transfers and security safeguards (such as Standard Contractual Clauses - SCCs) depend on Google's Data Processing Terms and its corresponding security measures.
We do not store your personal data longer than necessary for the collection purposes and legal obligations:
• Inquiries without confirmed transactions: contact details and request descriptions are kept for 12 months from the last contact date, and then deleted or anonymized.
• General business correspondence, quotes, and communications: kept for up to 5 years depending on the case (in accordance with the commercial limitation periods under the French Commercial Code).
• Accounting, contract, purchasing, invoice, and delivery records (completed transactions): kept for a statutory period of 10 years (starting from the end of the relevant accounting fiscal year, in compliance with French accounting and tax laws).
In accordance with the GDPR, you have the following rights regarding your personal data:
• Right of access and right to rectification.
• Right to erasure ('right to be forgotten') and right to restrict processing.
• Right to object and right to data portability.
To exercise any of these rights, please contact us by email (changbiofr@gmail.com). We will review and process your request within one month as required by law.
If you believe that our processing of your personal data violates the GDPR or applicable privacy laws, you have the right to lodge a complaint with a supervisory authority. In France, the competent authority is the Commission Nationale de l'Informatique et des Libertés (CNIL), website: www.cnil.fr.
This website does not use any advertising tracking, marketing, or third-party analytical cookies. We only use your browser's local storage (LocalStorage) to store your language preference (key: qdf-lang). This storage is purely used to run the language selector and render the user interface smoothly. As such, it is strictly necessary to provide the service and is exempt from the requirement of prior consent.
We may update this Privacy Policy from time to time to reflect changes in our services or regulatory updates. Any changes will become effective immediately upon posting on this page. We recommend that you check this page regularly to stay informed.
Last updated: June 9, 2026