Version 2026-09-20 · in force from 2026-09-20
Effective from 20 September 2026
BNB DIGITAL, a French société par actions simplifiée à associé unique with share capital of EUR 1,000, registered office at 23 avenue de Verdun, 93150 Le Blanc-Mesnil, France, registered with the Bobigny Trade and Companies Register under number 109 183 467, SIRET 109 183 467 00017, trading as BNB CLEAN, is the controller of the personal data collected through its platform.
Contact: admin@bnbclean.au
Because BNB DIGITAL is established in France, the General Data Protection Regulation (GDPR) applies to all of its processing activities, including where the individuals concerned reside outside the European Union.
The company also seeks to comply with the Australian Privacy Principles in handling the data of its users located in Australia.
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact details | Email address, phone number |
| Properties | Address, type, number of bedrooms and bathrooms, floor area, access instructions, photographs |
| Bookings | Job history, dates, durations, services requested, amounts |
| Communications | Messages sent through the platform |
| Payment | Handled directly by Stripe. BNB DIGITAL stores no card numbers and no bank details |
| Technical | IP address, session identifiers, connection logs |
| Proof of acceptance | Version of the terms accepted, timestamp, IP address, browser identifier (user agent) |
| Category | Data |
|---|---|
| Identity | First name, last name, date of birth |
| Contact details | Postal address, email address, phone number |
| Professional | ABN, specialities, availability, equipment, insurance where applicable |
| Activity | Applications, jobs completed, amounts owed and paid |
| Profile | Photograph, biography |
| Payment | Bank details are held by the Provider's Stripe account. Where no Stripe account has yet been set up, BNB DIGITAL holds them for the sole purpose of making payment, and deletes them once the Stripe account is active |
| Technical | IP address, session identifiers, connection logs |
| Proof of acceptance | Version of the terms accepted, timestamp, IP address, browser identifier (user agent) |
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing a user account | Performance of a contract |
| Connecting clients and providers | Performance of a contract |
| Enabling payment and payouts | Performance of a contract |
| Issuing and retaining invoices | Legal obligation |
| Customer support and complaint handling | Performance of a contract |
| Fraud prevention and platform security | Legitimate interests |
| Improving the platform and measuring usage | Legitimate interests |
| Retaining proof that our terms were accepted | Legal obligation and legitimate interests |
| Sending commercial communications | Consent |
Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
BNB DIGITAL does not sell or rent any personal data.
Data is disclosed:
Between users, strictly as needed for a job. When a job is assigned, the provider receives the property address and access instructions; the client receives the provider's name and profile.
To the following processors:
| Provider | Role | Data location |
|---|---|---|
| Supabase, Inc. | Database hosting | Sydney, Australia |
| Vercel Inc. | Application hosting | United States |
| Stripe Payments Europe, Ltd | Payment processing and payouts | European Union, United States |
| Resend, Inc. | Transactional email delivery | United States |
To competent authorities, upon lawful request.
Our data is hosted in Australia and the United States, outside the European Economic Area.
These transfers are governed by the Standard Contractual Clauses adopted by the European Commission, incorporated into our agreements with each processor, together with the supplementary security measures they implement.
Hosting in Australia reflects an operational need: almost all of our users are located there, and keeping data close to them delivers a faster, more reliable service.
| Data | Retention period |
|---|---|
| Active user account | For the duration of the relationship |
| Inactive account | 3 years from last use, then deleted or anonymised |
| Job history | 3 years after the last job |
| Invoices and accounting records | 10 years, as required by article L. 123-22 of the French Commercial Code |
| Messages | 3 years |
| Connection logs | 12 months |
| Proof of acceptance of our terms | 5 years after the end of the contractual relationship |
| Marketing data | 3 years from last contact |
The platform uses automated processing to offer jobs to available providers and, in some cases, to assign a job automatically based on availability, geographic area and order of application.
This processing does not produce legal effects or similarly significant effects within the meaning of Article 22 GDPR: no application is rejected on this basis alone, and any provider may request human intervention by writing to admin@bnbclean.au.
We implement appropriate technical and organisational measures: encrypted transmission (HTTPS), access segregation through row-level security policies on the database, user authentication, access logging, and full outsourcing of payment card handling to an authorised payment institution.
No system is entirely secure. Should a data breach occur that is likely to result in a high risk, we undertake to notify the individuals concerned and the competent supervisory authority in accordance with the GDPR.
You have the right to:
To exercise these rights: write to admin@bnbclean.au. We respond within one month, extendable by two months for complex requests.
Account deletion: you can request deletion of your account by writing to admin@bnbclean.au. Your request is processed within one month. Here is exactly what happens, because two obligations have to be reconciled.
What is permanently erased. Your profile, photograph, biography, messages, reviews, property details and job history are irreversibly deleted or anonymised. Your login credentials are removed and you can no longer access the platform. There is no lookup table allowing your identity to be recovered from the remaining data.
What is retained, and why. Invoices, payment records and refund records are kept for ten years, together with the identifying information they contain. This is not a choice on our part: article L. 123-22 of the French Commercial Code requires it, and Article 17(3)(b) of the GDPR expressly provides for this exception to the right to erasure. These records are not accessible through the platform and are used only to meet our accounting and tax obligations. They are destroyed at the end of the statutory period.
Proof of acceptance of our terms is likewise retained for five years after the end of the relationship, so that we can establish, if a dispute arises, which version of the terms was accepted and when.
Complaints: you may lodge a complaint with the French data protection authority — Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.
Users residing in Australia may also contact the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au.
The platform uses strictly necessary cookies only: session management, authentication and security.
These cookies are essential to providing the service and do not require your consent.
We do not use any advertising cookies or third-party analytics tools. Should this change, this policy will be updated and your prior consent will be obtained.
We may update this policy. Any material change will be notified by email or through a visible notice on the platform, at least fifteen days before it takes effect.