Cookie and privacy policy

Haru & Bom — EI ENILORAC Anne-Gaëlle · Last updated: March 2026

1. Data controller

The controller of the personal data collected on the website www.haruxbom.com is:

Haru & Bom – EI ENILORAC Anne-Gaëlle
81, rue Marius et Ary Leblond – 97410 Saint-Pierre, La Réunion (Reunion Island)
SIRET: 83310663600024
Email: info@haruxbom.com

2. Data collected

As part of its online sales activity, Haru & Bom may collect the following data:

Identification data: surname, first name, email address, delivery and billing address
Payment data: processed directly by our payment providers (Stripe, PayPal, Alma) — no bank details are stored on our servers
Browsing data: via technical cookies necessary for the website to function (see the Cookies section)
Order-related data: purchase history, product preferences

3. Purposes of processing

The data collected is used exclusively to:

Process and track orders
Communicate with customers (order confirmations, delivery tracking)
Send marketing communications, only with the customer's prior consent (Mailchimp newsletter)
Comply with our legal and accounting obligations

4. Legal basis for processing

The processing of your data is based on the following legal grounds, in accordance with the GDPR (Regulation (EU) No 2016/679):

Performance of a contract (order processing)
Consent (newsletter, non-essential cookies)
Legal obligation (retention of accounting data)
Legitimate interest (fraud prevention, website security)

5. Data retention

Customer data relating to orders is kept for a period of 3 years from the date of the last purchase, in accordance with the legal obligations applicable in France. Accounting data is kept for 10 years in accordance with the French Commercial Code (Code de commerce).

Newsletter data is kept until the subscriber unsubscribes.

6. Your rights

In accordance with the GDPR and the amended French Data Protection Act (loi Informatique et Libertés), you have the following rights:

Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure (“right to be forgotten”)
Right to object to processing
Right to data portability
Right to withdraw your consent at any time

To exercise these rights, contact us by email at info@haruxbom.com or by post at the address given above. We undertake to reply within a maximum of one month.

In the event of a dispute, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority) — www.cnil.fr.

7. Cookies

A cookie is a small text file placed on your device (computer, phone, tablet) when you visit a website. Cookies allow the website to function properly and improve your experience.

7.1 Strictly necessary cookies

These cookies are essential for the website to function. They cannot be disabled. They include in particular:

Shopify session cookies (basket management, authentication)
Security cookies (fraud protection, 3D Secure via Stripe/Alma)
Language preference cookie

7.2 Analytics and performance cookies

These cookies help us understand how visitors use the website (pages visited, session length). They are only placed with your consent.

7.3 Marketing cookies

These cookies may be used to display relevant advertising or to measure the effectiveness of marketing campaigns. They are only placed with your explicit consent.

To manage your cookie preferences, you can use your browser settings. Most browsers allow you to block or delete cookies through their privacy settings. Please note that disabling certain cookies may affect how the website works (basket, account login).

8. Sharing data with third parties

Haru & Bom does not sell any personal data to third parties. Data may be passed on to the following service providers, strictly within the scope of the service provided:

Shopify — hosting of the online shop (policy available at shopify.com)
Stripe / PayPal / Alma — secure payment processing
Mailchimp — sending newsletters (only to subscribers who have given their consent)
Carriers — delivery of orders (surname, first name, delivery address, phone number)

9. Data security

Haru & Bom implements appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure. The website uses the HTTPS protocol (SSL encryption). Payment data does not pass through our servers and is processed directly by our PCI DSS-certified providers.

10. Changes to this policy

This cookie and privacy policy may be updated at any time to reflect legal or technical changes. The date of the latest update is shown at the top of this document. We encourage you to consult it regularly.