PRIVACY POLICY
PRIVACY POLICY — runor.online
Last updated: 5 August 2026
ARTICLE 1 — WHO CONTROLS YOUR DATA
The data controller is:
RUNOR, Société par actions simplifiée (SAS) with a share capital of €5,000, publisher of runor.co.nz.
SIREN: 106 330 160
SIRET (registered office): 106 330 160 00016
Companies register: RCS Paris 106 330 160
EU VAT number: FR75106330160
Registered office: 47 rue Vivienne, 75002 Paris, France
Contact: runor.contact@gmail.com
Because Runor operates from France and sells to New Zealand, your personal information is handled under both the New Zealand Privacy Act 2020 and the European General Data Protection Regulation (GDPR).
RUNOR has not appointed a Data Protection Officer, not being required to do so under Article 37 of the GDPR. For any question about your personal information, contact us directly at the address above.
ARTICLE 2 — WHAT WE COLLECT
When you use runor.online and place orders, we collect:
Identity: first name, surname
Contact details: postal address, email address, phone number
Technical data: IP address, browsing data (cookies)
Payment information: handled securely by our payment providers — we never store card details
Order history and preferences
Reviews and photos, if you post a review through our provider Loox
We collect this information directly from you. If you don't provide it, we won't be able to process or deliver your order.
ARTICLE 3 — WHY WE COLLECT IT
Processing and tracking your orders
Delivering your products
Communicating with you through customer service
Sending newsletters and offers (only if you've asked for them)
Measuring site traffic and improving the site (analytics cookies)
Personalised advertising on social media and search engines (only if you've consented)
Handling returns and refunds
Fraud prevention
ARTICLE 4 — OUR LEGAL BASIS
Performance of the contract: processing your order, delivery, handling returns
Your consent: newsletters, non-essential cookies, personalised advertising
Runor's legitimate interest: improving the site, fraud prevention, transaction security
Legal obligation: retention of invoicing records (French Commercial Code)
Under the New Zealand Privacy Act 2020, we collect this information for lawful purposes connected to our business, and only what we actually need.
ARTICLE 5 — HOW LONG WE KEEP IT
Order and invoicing data — 5 years (accounting and tax obligation)
Customer account data — as long as the account is active, then 3 years of inactivity
Newsletter data — until you unsubscribe
Browsing data and cookies — 13 months maximum
Marketing prospect data — 3 years after last contact
ARTICLE 6 — WHO WE SHARE IT WITH
Your personal information may be passed to the following providers, strictly to process your orders and run our site:
Shopify Inc. — site hosting, order management — Canada / EU
Our logistics provider — parcel delivery — International
Stripe / Shopify Payments — secure payment processing — EU / United States
Klaviyo Inc. — newsletters (with your consent) — United States
Meta Platforms Inc. (Facebook, Instagram) — personalised advertising (with your consent) — United States
Google Ireland Ltd. — analytics and advertising (with your consent) — EU / United States
Loox Inc. — collecting and displaying customer reviews — United States
Yuntrack — delivery tracking — International
We never sell or transfer your information to third parties for commercial purposes.
ARTICLE 7 — TRANSFERS OUTSIDE NEW ZEALAND
Your personal information is stored and processed outside New Zealand, including in France, the European Union, Canada and the United States.
Under Information Privacy Principle 12 of the Privacy Act 2020, we only transfer your information to providers who are subject to comparable privacy safeguards. Our providers are bound by:
Standard contractual clauses adopted by the European Commission
Data Privacy Framework certification (for transfers to the United States)
European Commission adequacy decisions where applicable
By placing an order, you understand that your information will be held overseas and may not be subject to the same protections as information held in New Zealand.
ARTICLE 8 — YOUR RIGHTS
Under the New Zealand Privacy Act 2020, you have the right to:
Access the personal information we hold about you
Correct it if it's wrong or incomplete
Under the GDPR, you also have the right to:
Have your data erased (right to be forgotten)
Restrict how we process it
Receive your data in a portable format
Object to processing
Withdraw your consent at any time (particularly for newsletters and advertising)
Give instructions about what happens to your data after your death
To exercise any of these, contact us at contact@runor.store with proof of identity.
We will respond within 20 working days, as required by the Privacy Act 2020.
If you believe we have handled your information wrongly, you can complain to:
New Zealand — Office of the Privacy Commissioner, privacy.org.nz, 0800 803 909
European Union — CNIL, www.cnil.fr
ARTICLE 9 — COOKIES
runor.co.nz uses several types of cookies:
Essential — running the site (cart, login) — session
Analytics — visit statistics (Google Analytics) — 13 months max
Marketing — personalised advertising (Meta, Google) — 13 months max
Preferences — remembering your choices — 13 months max
On your first visit, a banner lets you accept or refuse non-essential cookies. You can change your preferences at any time through the "Cookie settings" link at the bottom of every page, or in your browser settings.
ARTICLE 10 — SECURITY
RUNOR puts appropriate technical and organisational measures in place to protect your personal information against unauthorised access, alteration, disclosure or destruction:
HTTPS protocol securing all exchanges
Hosting on Shopify certified servers (PCI-DSS compliant for payments)
Data access limited to authorised staff
Strong authentication on administrator accounts
If a privacy breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner, as required by the Privacy Act 2020.
ARTICLE 11 — CHANGES TO THIS POLICY
RUNOR may amend this Privacy Policy at any time, particularly to comply with regulatory changes. Any amendment will be published on this page with an updated date. We encourage you to check it regularly.