Privacy policy

1. Data controller

The data controller is [To be completed: company name and legal form], [To be completed: registered office address], who can be reached at contact@holabambino.fr.

2. Data collected

• Parents (account): name, email address, password (never stored in plain text: only an irreversible cryptographic hash is kept).
• Baby registries: the baby’s first name or name, due date, description, items added and, if you provide it, a delivery address. This address is only shown to your loved ones if you choose to share it.
• Loved ones (reservations): name, optional message, quantity or amount pledged and, only if the person provides it, their email address. The email address is optional and is never displayed on the list.
• Technical data: the IP address is used temporarily to limit abuse (number of sign-in or reservation attempts), without being stored in our database.

3. Purposes and legal bases

• Account management and authentication (performance of the service).
• Operation of baby registries and reservations, to avoid duplicate gifts (performance of the service).
• Service-related emails, when email sending is enabled on the platform: reservation confirmation with a cancellation link (only if the loved one provided their email address) and notifications to parents (performance of the service).
• Security and abuse prevention (legitimate interest).

We do not send advertising and we do not carry out profiling.

4. Recipients and processors

The data is accessible to the Hola Bambino! team and to our technical processors, strictly within the limits of their tasks: Vercel Inc. (website hosting), MongoDB, Inc. — MongoDB Atlas (database hosting, region: [To be completed: database hosting region (EU / United States)]) and, when email sending is enabled, Resend (sending of transactional emails). When data is transferred outside the European Union, these transfers are governed by the European Commission’s standard contractual clauses.

On a shared list, parents see the name, the message and, if provided, the email address of the loved ones who made a reservation. Other visitors only see that an item is reserved.

5. Retention period

• Your account and list data are kept for as long as your account exists.
• Loved ones’ data linked to a reservation is kept for as long as the list concerned exists. It is deleted together with the list or the parents’ account.
• You can delete your account at any time from the My account page: your account, your lists, their items and the related reservations are then immediately erased from our database. The host’s technical backups may keep a copy for a limited period ([To be completed: retention period of database backups]).

6. Cookies and local storage

Hola Bambino! only uses strictly necessary or functional cookies:

• Sign-in session and form protection: cookies that are strictly necessary for the service to work.
• Language (hb_locale): only set if you switch language with the “FR · EN” link at the bottom of the page. It stores the chosen language (“fr” or “en”) for 1 year. It is a functional cookie, never used for tracking. If you are signed in, this language is also saved in your account so that we write to you in the same language.

After a reservation, the cancellation link may be kept in your browser’s local storage so that you can find it easily. We use neither advertising cookies nor third-party audience measurement tools: no consent banner is therefore required.

7. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection. To exercise them, write to us at contact@holabambino.fr. A loved one who reserved an item can also ask us to delete their data. You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.