Privacy policy
This policy explains which personal data we collect when you use the LAMA Organics website, why we use it, how long we keep it and how to exercise your rights. It follows the Data Protection Act 2017 of the Republic of Mauritius.
We only collect the data needed for your order and our relationship with you. We do not sell your data.
1. Who is responsible for your data?
LAMA Organics®, reachable at hello@lamaorganics.com.
2. The data we collect
When you send an order
First and last name, email address, phone number, products ordered and amounts, preferred payment method and, if you write one, your message. No payment is made on the website: we collect no bank data.
When you ask to be told about a restock
Your email address and the product concerned.
When you sign up to the newsletter
Your email address and the date you signed up. Sign-up is never pre-ticked.
When you write to us
By email or on Instagram: your name, contact details and the content of your messages. If you share health information to get advice (pregnancy, allergy, reactive skin), we use it only to answer you. Please share only what is necessary.
When you browse the website
- Strictly necessary data: your basket, your wishlist and your cookie choice, stored in your browser, as well as technical logs (IP address, date and time) used for website security.
- Audience and advertising measurement: only if these tools are enabled and with your consent. Details are in our cookie policy.
3. Why we use your data
| Purpose | Legal basis |
|---|---|
| Process your order, contact you about payment and pick-up | Performance of the contract |
| Handle returns and customer care | Performance of the contract |
| Tell you when a product is back in stock | Consent (your request) |
| Answer your messages and advice requests | Legitimate interest |
| Keep our accounts | Legal obligation |
| Send you the newsletter | Consent, which you can withdraw |
| Measure website and advertising audience, if these tools are enabled | Consent |
| Keep the website secure | Legitimate interest |
We do not make any fully automated decision about you.
4. Who has access to your data?
Your data is only accessible to the people at LAMA Organics who need it, and to service providers acting on our behalf:
- Vercel: website hosting.
- Resend: sending emails (order summaries, restock requests, newsletter sign-ups).
- Titan (the hello@lamaorganics.com mailbox): receiving these emails.
- Natural Hair Culture, the pick-up point: your name and order number, to hand over your order.
If you contact us on Instagram, those exchanges are also subject to that service's terms. We may also share data with the authorities when the law requires it.
5. Transfers outside Mauritius
Some of our providers (Vercel, Resend, Titan) may store data outside Mauritius, including in the United States or the European Union. These transfers are covered by the safeguards these providers offer, in line with the Data Protection Act 2017.
6. How long we keep your data
| Data | Duration |
|---|---|
| Orders | While we process the order, then as required by accounting and tax obligations |
| Messages and advice requests | 3 years after the last exchange |
| Restock requests | Until the product is back in stock |
| Newsletter | Until you unsubscribe |
| Basket, wishlist, cookie choice | See the cookie policy |
After these periods, data is deleted or anonymised.
7. Your rights
Under the Data Protection Act 2017, you have the following rights:
- Access: find out which data we hold about you and get a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: ask for your data to be deleted, unless we must keep it to meet a legal obligation.
- Objection: object to the use of your data based on our legitimate interest, and to direct marketing at any time.
- Withdrawal of consent: withdraw a consent at any time, without affecting what was done before.
8. How to exercise your rights
Email hello@lamaorganics.com with the subject "Personal data". We may ask you to prove your identity. We reply within one month.
9. Complaints to the Data Protection Office
If you feel your rights have not been respected, you can lodge a complaint with the Data Protection Office of Mauritius (dataprotection.govmu.org). Please feel free to write to us first: we will look for a solution with you.
10. Security
We protect your data with appropriate measures: encrypted connection (HTTPS), access limited to the people who need it and providers chosen for their security guarantees. If a data breach is likely to put you at risk, we inform the Data Protection Office and, where the law requires it, the people concerned.
11. Children
The website is not intended for children. We do not knowingly collect data about children under 16 without the consent of a parent or legal guardian. If you think a child has sent us data, write to us and we will delete it.
12. Updates to this policy
We may change this policy to reflect changes to the website, our providers or the law. The date of the last update is shown at the top of this page. See also our terms and conditions.