Privacy policy
Privacy policy
Last updated: 6 September 2026.
This policy explains how DATA HUB ("Rundavo", "we") processes your personal data when you visit rundavo.com, create an account, place an order or contact us, in accordance with the General Data Protection Regulation (GDPR).
1. Controller
DATA HUB, 32 rue des Marjoberts, 95000 Cergy, France — contact@rundavo.com · Phone: +33 1 84 80 99 96. We are not required to appoint a data protection officer; the email address above is your point of contact for data protection matters.
2. Data we collect
- Identity and contact data: name, email address, phone number, delivery and billing addresses.
- Order and payment data: products, amounts, history, delivery status, payment method and transaction data (full card details are processed only by Shopify Payments, Klarna or the relevant payment provider).
- Account data: login details, preferences, optional information about your dog.
- Communication data: emails, messages, reviews, customer service requests.
- Browsing data: IP address, device and browser, pages viewed, traffic source, cookie identifiers, interactions with our emails and ads (see section 8).
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Orders: payment, fulfilment, delivery, invoicing, returns, guarantees | Contract (b) |
| Customer account and customer service | Contract (b); legitimate interest (f) |
| Accounting, tax obligations, fraud prevention | Legal obligation (c); legitimate interest (f) |
| Newsletter and offers by email/SMS | Consent (a); legitimate interest (f) for existing customers with a right to object at any time |
| Abandoned cart reminders | Consent (a) |
| Audience measurement and statistics | Consent (a) |
| Personalised advertising and campaign measurement (Meta, TikTok, Google) | Consent (a) |
| Customer reviews | Consent (a) |
| Handling rights requests and disputes | Legal obligation (c); legitimate interest (f) |
4. Recipients and processors
| Recipient | Purpose | Location |
|---|---|---|
| Shopify International Ltd (Ireland) / Shopify Inc. (Canada) | Hosting, e-commerce platform, Shopify Payments, transactional emails | EU, Canada (adequacy decision), USA (Data Privacy Framework / standard contractual clauses) |
| Payment providers: Klarna Bank AB (Sweden), Stripe (via Shopify Payments), iDEAL, Bancontact, SEPA networks | Payment processing, fraud prevention | EU; partly USA (standard contractual clauses) |
| Fulfilment providers (order preparation and shipping) | Picking, packing and shipping of your orders: name, delivery address, phone, email, order contents | EU; for some providers, access from a third country governed by the EU standard contractual clauses (Art. 46 GDPR) with supplementary measures (data minimisation) |
| Carriers (DHL, DPD, GLS, Colissimo, PostNL, bpost) | Delivery, tracking notifications | EU |
| Klaviyo, Inc. (USA) | Newsletters, marketing emails and SMS, automations | USA (Data Privacy Framework, standard contractual clauses) |
| Meta Platforms Ireland Ltd | Personalised advertising, campaign measurement (Meta pixel, Conversions API) | EU / USA (Data Privacy Framework) |
| TikTok Technology Ltd (Ireland) | Personalised advertising, campaign measurement (TikTok pixel) | EU / USA, possible access from other countries under TikTok's policy (standard contractual clauses) |
| Google Ireland Ltd (Google Tag Manager, Google Analytics 4, Google Ads) | Tag management, audience measurement, advertising, conversion measurement | EU / USA (Data Privacy Framework) |
| Review, support and accounting providers | Reviews, customer support, accounting | EU |
We do not sell your personal data. It is disclosed to authorities only where required by law.
5. Transfers outside the EU
Transfers to third countries (mainly the USA and Canada, plus certain third countries for logistics) rely on an adequacy decision (Canada; USA for companies certified under the Data Privacy Framework) or on the EU standard contractual clauses (Decision 2021/914), supplemented by additional technical and organisational measures. Only the data strictly necessary for shipping is transferred to our fulfilment providers. A copy of the safeguards is available on request at contact@rundavo.com.
6. Retention periods
| Data | Period |
|---|---|
| Order, invoice and accounting data | 10 years (statutory retention) |
| Customer account | Duration of the relationship, then 3 years after last activity; deleted on request |
| Marketing data (newsletter, SMS) | 3 years after last contact or until consent is withdrawn |
| Payment/transaction data | 13 months (15 months for deferred payment) as evidence, longer in case of dispute |
| Customer service correspondence | 3 years after closure |
| Cookies and trackers | 13 months maximum; data collected 25 months maximum |
| Rights requests | 5 years (evidence) |
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, objection (at any time and without reason to direct marketing), data portability and withdrawal of consent at any time. Send requests to contact@rundavo.com or to DATA HUB, 32 rue des Marjoberts, 95000 Cergy, France; we reply within one month. Unsubscribe from emails via the link in each message, and from SMS by replying STOP.
You may also lodge a complaint with the French supervisory authority CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or with the supervisory authority of your country of residence.
8. Cookies and consent
On your first visit, our consent banner lets you accept, refuse or configure non-essential cookies by category — refusing is as easy as accepting. You can change your choice at any time via the "Manage cookies" link in the footer; your choice is stored for 6 months.
- Strictly necessary cookies (no consent required): store operation, cart, session, security, language and currency preferences, storage of your cookie choice (Shopify).
- Analytics cookies (with consent): Google Analytics 4 via Google Tag Manager, Shopify analytics.
- Marketing cookies (with consent): Meta pixel, TikTok pixel, Google Ads, Klaviyo for relevant advertising, campaign measurement and cart reminders.
Refusing non-essential cookies does not prevent browsing or purchasing. We honour the Global Privacy Control signal from your browser.
9. Security
We implement appropriate technical and organisational measures (TLS encryption, PCI DSS Level 1 certified hosting with Shopify, access controls, two-factor authentication for administrators, confidentiality commitments from our processors). In the event of a data breach likely to result in a high risk, we will inform you in accordance with Art. 34 GDPR.
10. Minors
The site is intended for adults. We do not knowingly collect data from children under 16 without parental consent.
11. Changes
We may update this policy to reflect legal or technical changes. The version published on the site applies; we will notify you of material changes via the site or by email.