Privacy Policy
Effective as of October 6, 2026
This page explains what personal data Halume collects when you visit halume.fr or place an order, why, how long it is kept, and what you can request regarding it.
The essentials in three sentences. We only collect data necessary to process an order or to operate the site. We do not sell any data, to anyone. You may at any time request to access, correct, or delete your data by writing to contact@halume.fr.
1Who is responsible for your data
Halume
Sole proprietorship (micro-enterprise), operating under the trade name Halume
Represented by Paul EVROT-CARRICAN
Registered office: 12 rue Paul Valéry, 21850 Saint-Apollinaire, France
SIRET: 131 056 467 00015 — RCS Dijon 131 056 467
Email: contact@halume.fr
Phone: 07 69 79 00 09
Halume has not appointed a data protection officer: the structure and volume of data processing do not require it. All requests should be sent to the address above.
2The data we collect
Depending on what you do on the site, we may process:
- Your contact details — last name, first name, shipping and billing address, email, phone number.
- Your orders — products purchased, amount, date, order number, package tracking, returns and refunds.
- Your communications with us — the content of your emails and messages sent via the contact form.
- Your account information, if you create one — identifiers, preferences, history.
- Technical data — IP address, browser and device type, pages visited, date and time of visit.
We never see your banking details. The card number is entered directly at the payment provider's site and does not pass through Halume. We only receive payment confirmation and the last four digits.
3Why, on what basis, and for how long
The GDPR requires justifying each processing activity with a legal basis. Here are ours.
| Purpose | Legal basis | Retention period |
|---|---|---|
| Process and deliver your order, provide customer service | Contract performance | Duration of relationship, then archiving |
| Billing and accounting | Legal obligation | 10 years (Art. L123-22 of the Commercial Code) |
| Manage your customer account | Contract performance | Until deletion, or 3 years of inactivity |
| Respond to your messages | Legitimate interest | 3 years after last communication |
| Newsletter and offers | Your consent | 3 years after last contact, or until unsubscribe |
| Audience measurement and non-essential cookies | Your consent | 13 months maximum |
| Site security, fraud prevention | Legitimate interest | 12 months |
| Exercise or defense of legal claims | Legitimate interest | Applicable statute of limitations |
When processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
4Who has access to your data
Your data is neither sold, rented, nor traded. It is only shared with those who need it so that your order reaches you:
- Shopify — site hosting, order and customer account management.
- Payment providers — to collect and secure the transaction.
- Carriers and order preparers — name and delivery address, to route the package.
- Our email and package tracking tools — to send you confirmation and tracking numbers.
- Competent authorities, if required by law.
5The role of Shopify
The site is powered and hosted by Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland).
Shopify processes your data on our behalf to operate the store. For certain features, Shopify acts as a data controller for its own purposes. You can consult its privacy policy and exercise your rights with Shopify via its privacy portal.
6Transfers outside the European Union
Some of our service providers may process data outside the European Economic Area. In such cases, the transfer is governed by the European Commission's standard contractual clauses, or by an adequacy decision recognizing an equivalent level of protection.
7Cookies
A cookie is a small file placed on your device. We use two types:
- Necessary cookies — cart, session, security. They do not require your consent, as the site cannot function without them.
- Measurement and personalization cookies — these are only placed after your consent, collected via the banner displayed on your first visit.
You can change your choice at any time from this banner, or configure your browser to refuse cookies. Their lifespan does not exceed 13 months.
8Your rights
Regarding your personal data, you have the following rights:
- Access — obtain a copy of the data we hold about you.
- Rectification — have inaccurate or incomplete information corrected.
- Erasure — request the deletion of your data, except for that which we are legally obligated to retain (e.g., invoices).
- Restriction — request that processing be frozen while a verification is conducted.
- Portability — receive your data in a machine-readable format, or have it transferred.
- Opposition — object to processing based on our legitimate interest, or to direct marketing.
- Withdrawal of consent — at any time, for newsletters as well as cookies.
- Post-mortem directives — define instructions regarding your data after your death.
An email to contact@halume.fr is sufficient. Please specify your request and, if necessary, your order number.
We will respond within one month, a period that may be extended to three months for complex requests — we will inform you of this.
Proof of identity may be requested if there is serious doubt about your identity, and only in that case.
9Complaint to the CNIL
If our response does not satisfy you, you may contact the French supervisory authority:
CNIL — Commission Nationale de l'Informatique et des Libertés
3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr
10Security
The site is served over HTTPS and access to the store's administration is protected. No measure is foolproof: we recommend that you never transmit sensitive information via an unsecured channel, and that you choose a password distinct from those used elsewhere.
In the event of a data breach likely to create a high risk for your rights, you will be informed as soon as possible, in accordance with Article 34 of the GDPR.
11Minors
The site is not intended for children and we do not knowingly collect data concerning a minor under 15 years of age. If you are a parent or guardian and believe your child has transmitted data to us, write to us: it will be deleted.
12Modifications
This policy may be updated to reflect changes in our practices or regulations. The applicable version is the one online, whose effective date appears at the top of this page.
13Contact
For any questions about your data: contact@halume.fr — response within 24 to 48 business hours for a simple question, within one month for the exercise of a right.
See also our General Terms and Conditions of Sale, our General Terms and Conditions of Use, our Return and Refund Policy and our legal notices.