Privacy policy
This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from www.bumboo.eco (the “Site”).
Last updated: 16 July 2026
PERSONAL INFORMATION WE COLLECT
When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and information about how you interact with the Site. We refer to this automatically-collected information as “Device Information”.
We collect Device Information using cookies and similar technologies, including local storage, session storage, log files, web beacons, tags and pixels. These technologies may be provided by us or by third-party service providers. Where required by law, non-essential analytics, personalisation and advertising technologies are used only after you have provided consent through our cookie banner.
Additionally when you make a purchase or attempt to make a purchase through the Site, we collect certain information from you, including your name, billing address, shipping address, payment information (including bank card numbers and paypal details, if relevant), email address, and phone number. We refer to this information as “Order Information”.
When we talk about “Personal Information” in this Privacy Policy, we are talking both about Device Information and Order Information.
HOW DO WE USE YOUR PERSONAL INFORMATION?
We use the Order Information that we collect generally to fulfill any orders placed through the Site (including processing your payment information, arranging for shipping, and providing you with invoices and/or order confirmations). Additionally, we use this Order Information to:
- Communicate with you;
- Screen our orders for potential risk or fraud; and
- When in line with the preferences you have shared with us, provide you with information or advertising relating to our products or services.
We use the Device Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Site (for example, by generating analytics about how our customers browse and interact with the Site, and to assess the success of our marketing and advertising campaigns).
As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.
You can opt out of targeted advertising by using the links below:
- Facebook: https://www.facebook.com/settings/?tab=ads
- Google: https://www.google.com/settings/ads/anonymous
- Bing: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads
Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: http://optout.aboutads.info/.
The cookies listed below may vary depending on the pages and features you use, whether you accept optional cookies, whether you arrive through an advertising link, and whether you use checkout, Shop Pay, customer accounts, subscription-management or support features. Durations are maximum or typical periods and may be shortened by browser settings or deletion.
Essential Cookies
| Strictly Required Cookies | ||||
| Name | Description | Category | Provider | Duration |
| _orig_referrer | This cookie is generally provided by Shopify and is used to track landing pages. | Strictly Required Cookies | Shopify | 2 weeks |
| _landing_page | This cookie is generally provided by Shopify and is used to track landing pages. | Strictly Required Cookies | Shopify | 2 weeks |
| _ab | This cookie is generally provided by Shopify and is used in connection with access to the admin view of an online store platform. | Strictly Required Cookies | Shopify | 2 weeks |
| _secure_session_id | This cookie is generally provided by Shopify and is used to track a user's session through the multi-step checkout process and keep their order, payment and shipping details connected. | Strictly Required Cookies | Shopify | 1 day |
| cart | This cookie is generally provided by Shopify and is used in connection with a shopping cart. | Strictly Required Cookies | Shopify | 2 weeks |
| cart_sig | This cookie is generally provided by Shopify and is used in connection with checkout. It is used to verify the integrity of the cart and to ensure performance of some cart operations. | Strictly Required Cookies | Shopify | 2 weeks |
| cart_ts | This cookie is generally provided by Shopify and is used in connection with checkout. | Strictly Required Cookies | Shopify | 2 weeks |
| cart_ver | This cookie is generally provided by Shopify and is used in connection with the shopping cart. | Strictly Required Cookies | Shopify | 2 weeks |
| cart_currency | This cookie is generally provided by Shopify and it is set after a checkout is completed to ensure that new carts are in the same currency as the last checkout. | Strictly Required Cookies | Shopify | 2 weeks |
| checkout_token | This cookie is generally provided by Shopify and is used in connection with a checkout service. | Strictly Required Cookies | Shopify | 1 year |
| storefront_digest | This cookie is generally provided by Shopify and it stores a digest of the storefront password, allowing merchants to preview their storefront while it's password protected. | Strictly Required Cookies | Shopify | 2 years |
| cookieconsent_status | This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent. | Strictly Required Cookies | Consentmo | 1 year |
| cookieconsent_preferences_disabled | This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent. | Strictly Required Cookies | Consentmo | 1 day |
| _shopify_m | This cookie is generally provided by Shopify and is used for managing customer privacy settings. | Strictly Required Cookies | Shopify | 1 year |
| _shopify_tm | This cookie is generally provided by Shopify and is used for managing customer privacy settings. | Strictly Required Cookies | Shopify | 30 minutes |
| _shopify_tw | This cookie is generally provided by Shopify and is used for managing customer privacy settings. | Strictly Required Cookies | Shopify | 2 weeks |
| _tracking_consent | This cookie is generally provided by Shopify and is used to store a user's preferences if a merchant has set up privacy rules in the visitor's region. | Strictly Required Cookies | Shopify | 1 year |
| tracked_start_checkout | This cookie is generally provided by Shopify and is used in connection with checkout. | Strictly Required Cookies | Shopify | 1 year |
| _customer_account_shop_sessions | Used in combination with the _secure_account_session_id cookie to track user sessions for new customer accounts. | Strictly Required Cookies | Shopify | 30 days |
| _secure_account_session_id | Used to track user sessions for new customer accounts. | Strictly Required Cookies | Shopify | 30 days |
| _shopify_country | For stores where the currency/price page is determined by GeoIP, this cookie stores the page we found. This cookie helps to avoid GeoIP verification after the first application. | Strictly Required Cookies | Shopify | session |
| _storefront_u | Used to facilitate updating customer account information. | Strictly Required Cookies | Shopify | 1 minute |
| _cmp_a | Used to manage customer privacy settings. | Strictly Required Cookies | Shopify | 1 day |
| checkout | Used in connection with payments. | Strictly Required Cookies | Shopify | 4 weeks |
| customer_account_locale | Used in connection with new customer accounts. | Strictly Required Cookies | Shopify | 1 year |
| dynamic_checkout_shown_on_cart | Used in connection with payments. | Strictly Required Cookies | Shopify | 30 minutes |
| hide_shopify_pay_for_checkout | Used in connection with payments. | Strictly Required Cookies | Shopify | session |
| shopify_pay | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 year |
| shopify_pay_redirect | Used in connection with payments. | Strictly Required Cookies | Shopify | 60 minutes |
| shop_pay_accelerated | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 year |
| keep_alive | Used in conjunction with buyer localization. | Strictly Required Cookies | Shopify | 2 weeks |
| source_name | Used in combination with mobile apps to provide personalized checkout behavior when browsing a compatible mobile app store. | Strictly Required Cookies | Shopify | session |
| master_device_id | Used in conjunction with merchant login. | Strictly Required Cookies | Shopify | 2 years |
| previous_step | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 year |
| discount_code | Used in connection with payments. | Strictly Required Cookies | Shopify | session |
| remember_me | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 year |
| checkout_session_lookup | Used in connection with payments. | Strictly Required Cookies | Shopify | 3 weeks |
| checkout_prefill | Used in connection with payments. | Strictly Required Cookies | Shopify | 5 minutes |
| checkout_queue_token | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 year |
| checkout_queue_checkout_token | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 year |
| checkout_worker_session | Used in connection with payments. | Strictly Required Cookies | Shopify | 3 days |
| checkout_session_token | Used in connection with payments. | Strictly Required Cookies | Shopify | 3 weeks |
| cookietest | Use it to make sure our systems are working properly. | Strictly Required Cookies | Shopify | 1 minute |
| order | Used in conjunction with the order status page. | Strictly Required Cookies | Shopify | 3 weeks |
| identity-state | It is used in connection with user identification. | Strictly Required Cookies | Shopify | 1 day |
| card_update_verification_id | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 day |
| customer_account_new_login | It is used in connection with user identification. | Strictly Required Cookies | Shopify | 20 minutes |
| customer_account_preview | It is used in connection with user identification. | Strictly Required Cookies | Shopify | 7 days |
| customer_payment_method | Used in connection with payments. | Strictly Required Cookies | Shopify | 60 minutes |
| customer_shop_pay_agreement | Used in connection with payments. | Strictly Required Cookies | Shopify | 1 minute |
| pay_update_intent_id | Used in connection with payments. | Strictly Required Cookies | Shopify | 20 minutes |
| localization | Used in connection with payments. | Strictly Required Cookies | Shopify | 2 weeks |
| profile_preview_token | Used in connection with payments. | Strictly Required Cookies | Shopify | 5 minutes |
| login_with_shop_finalize | It is used in connection with user identification. | Strictly Required Cookies | Shopify | 5 minutes |
| preview_theme | It is used in conjunction with the theme editor. | Strictly Required Cookies | Shopify | session |
| shopify-editor-unconfirmed-settings | It is used in conjunction with the theme editor. | Strictly Required Cookies | Shopify | 1 day |
| wpm-test-cookie | Use it to make sure our systems are working properly | Strictly Required Cookies | Shopify | session |
| identity-state-<token> | Used by Shopify in connection with secure customer-account authentication. The token portion of the cookie name may vary. | Strictly Required Cookies | Shopify | Short-lived |
| identity_customer_account_number | Used by Shopify to associate the browser with the appropriate customer-account environment. | Strictly Required Cookies | Shopify | Session or short-lived |
Reporting and Analytics Cookies
These cookies allow us to measure visitors traffic and see traffic sources by collecting information in data sets. They also help us understand which products and actions are more popular than others.
| Analytics and Statistics | ||||
| Name | Description | Category | Provider | Duration |
| _s | This cookie is associated with Shopify's analytics suite. | Analytics and Statistics | Shopify | 30 minutes |
| _shopify_fs | This cookie is associated with Shopify's analytics suite. | Analytics and Statistics | Shopify | 30 minutes |
| _shopify_s | This cookie is associated with Shopify's analytics suite. | Analytics and Statistics | Shopify | 30 minutes |
| _shopify_sa_t | This cookie is associated with Shopify's analytics suite concerning marketing and referrals. | Analytics and Statistics | Shopify | 30 minutes |
| _shopify_sa_p | This cookie is associated with Shopify's analytics suite concerning marketing and referrals. | Analytics and Statistics | Shopify | 30 minutes |
| _shopify_y | This cookie is associated with Shopify's analytics suite. | Analytics and Statistics | Shopify | 1 year |
| _y | This cookie is associated with Shopify's analytics suite. | Analytics and Statistics | Shopify | 1 year |
| _ga | Used by Google Analytics 4 to distinguish visitors and support measurement of website usage. | Analytics and Statistics | Google Analytics | Up to 2 years |
| _gat | Used by some Google Analytics configurations to limit the rate of requests. This cookie may not be set by all implementations. | Analytics and Statistics | Google Analytics | 1 minute |
| _ga_<container-id> | Used by Google Analytics 4 to maintain and count sessions for a particular analytics property. The suffix varies by property. | Analytics and Statistics | Google Analytics | Up to 2 years |
| _gid | Used by Google Analytics to distinguish visitors over a shorter period. | Analytics and Statistics | Google Analytics | 24 hours |
Marketing and Retargeting
| Marketing and Retargeting | ||||
| Name | Description | Category | Provider | Duration |
| IDE | Used by Google advertising services to measure advertising activity and support ad delivery and personalisation, where permitted. | Marketing and Retargeting | Google DoubleClick | Up to 13 months in the UK/EEA, depending on Google settings |
| GPS | This cookie is associated with YouTube which collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites. This cookie should be retained only where YouTube content is embedded and the cookie is observed. | Marketing and Retargeting | Youtube | session |
| PREF | This cookie, which may be set by Google or Doubleclick, may be used by advertising partners to build a profile of interests to show relevant ads on other sites. This cookie should be retained only where YouTube content is embedded and the cookie is observed. | Marketing and Retargeting | Youtube | 8 months |
| BizoID | Legacy LinkedIn advertising identifier. This cookie should be retained only if the LinkedIn Insight Tag or a LinkedIn integration is currently active. | Marketing and Retargeting | 1 month | |
| _fbp | Used by the Meta Pixel to identify browsers for advertising measurement, audience creation and retargeting, where consent has been provided. | Marketing and Retargeting | Meta Platforms, Inc. | 3 months |
| __adroll | Used by AdRoll for advertising and retargeting. This row should be retained only if AdRoll is currently active on the Site. | Marketing and Retargeting | Adroll Group | 1 year |
| __adroll_v4 | Used by AdRoll for advertising and retargeting. This row should be retained only if AdRoll is currently active on the Site. | Marketing and Retargeting | Adroll Group | 1 year |
| __adroll_fpc | Used by AdRoll for advertising and retargeting. This row should be retained only if AdRoll is currently active on the Site. | Marketing and Retargeting | Adroll Group | 1 year |
| __ar_v4 | Used by AdRoll for advertising and retargeting. This row should be retained only if AdRoll is currently active on the Site. | Marketing and Retargeting | Adroll Group | 1 year |
| _gcl_au | Used by Google Ads and the Conversion Linker to store and measure advertising conversions. | Marketing and Retargeting | Typically up to 90 days | |
| _gcl_aw | Stores information about a Google Ads click so that a later purchase or other action can be attributed to the advertisement. | Marketing and Retargeting | Google Ads | Typically up to 90 days |
| _gcl_gs | Stores Google advertising click information for conversion measurement. It is set only by certain Google tag configurations. | Marketing and Retargeting | Typically up to 90 days | |
| _gcl_dc | Stores advertising click information for Campaign Manager or DoubleClick conversion attribution where that service is used. | Marketing and Retargeting | Typically up to 90 days | |
| test_cookie | Tests whether the browser supports cookies when Google advertising services are used. | Marketing and Retargeting | Google DoubleClick | Approximately 15 minutes |
| _fbc | Stores the Meta click identifier when a visitor arrives through a link containing a Meta advertising click ID, enabling conversion attribution. | Marketing and Retargeting | Meta Platforms, Inc. | Approximately 3 months |
| __kla_id | Used by Klaviyo to identify and track website visitors and, when a visitor becomes identifiable, associate browsing activity with a Klaviyo profile. | Marketing and Retargeting | Klaviyo | Up to 2 years, or up to 1 year where extended-ID settings apply |
Functional Cookies
| Functional Cookies | ||||
| Name | Description | Category | Provider | Duration |
| __zlcmid | Used by certain Zendesk Chat implementations to preserve a visitor's chat identifier between visits. It is set only where the relevant Zendesk widget is used. | Functional Cookies | Zendesk | Up to 1 year |
| __zlcstore | Used by certain Zendesk Chat implementations to store chat or widget state. It is set only where the relevant Zendesk widget is used. | Functional Cookies | Zendesk | Variable |
| hcaptcha cookies and storage | Used on protected forms to prevent spam, fraud and automated abuse. Exact cookie and storage names can vary according to hCaptcha's current implementation. | Functional Cookies | hCaptcha | Session or variable |
| Recharge portal session cookies | Used when a customer accesses subscription-management features to maintain a secure portal session. Exact names vary by Recharge portal and authentication configuration. | Functional Cookies | Recharge | Session or short-lived |
Cookie inventories change when website applications, advertising tags or platform features are added or updated. We review this list periodically. Some providers also use local storage, session storage, pixels or server-side event data that do not appear as browser cookies.
MANAGING COOKIES AND SIMILAR TECHNOLOGIES You can use our cookie banner to accept, reject or change your choices for non-essential cookies. You can also delete or block cookies through your browser settings. Blocking essential cookies may prevent parts of the Site, checkout, customer accounts or subscription management from working correctly. Withdrawing consent does not affect processing that took place before consent was withdrawn.
SMS
We value your privacy and the information you consent to share in relation to our SMS marketing service. We use this information to send you text notifications including transactional texts for your order such including upcoming order notifications, abandoned checkout reminders, text marketing offers, and transactional texts.
Opt-in data and consent for text messaging will not be shared with any third parties except for messaging partners, for the purpose of enabling and operating our text messaging program.
Our website uses cookies to keep track of items you put into your shopping cart, including when you have abandoned your checkout. This information is used to determine when to send cart reminder messages via SMS.
You can opt out of SMS marketing by responding with STOP to any SMS text or using the unsubscribe link included in the message.
BROWSER PRIVACY SIGNALS We respond to consent choices made through our cookie banner. Browser-based signals, including Do Not Track or Global Privacy Control, may not operate consistently across all browsers and services. Where applicable law requires us to recognise a supported signal, we will treat it as a request to limit the relevant processing.
YOUR RIGHTS
If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below.
Additionally, if you are a European resident we note that we are processing your information in order to fulfill contracts we might have with you (for example if you make an order through the Site), or otherwise to pursue our legitimate business interests listed above. Additionally, please note that your information will be transferred outside of Europe, including to Canada and the United States.
DATA RETENTION
When you place an order through the Site, we will maintain your Order Information for our records unless and until you ask us to delete this information.
SHARING YOUR PERSONAL INFORMATION We share Personal Information with service providers that help us operate the Site, process orders and payments, manage subscriptions, provide customer support, send communications, prevent fraud, analyse website use and measure advertising. These providers may include Shopify, payment and delivery providers, Recharge, Zendesk, Klaviyo, Google and Meta, depending on the services and features used. We require service providers to process Personal Information only for authorised purposes and subject to appropriate contractual and security safeguards. We may also disclose Personal Information where required by law, to respond to lawful requests, or to protect our rights, customers and services.
Finally, we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.
Bumboo does not sell your information to 3rd Parties.
BEHAVIOURAL ADVERTISING
CHANGES
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.
CONTACT US
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e‑mail at wecare@bumboo.eco or by mail using the details provided below:
Bumboo Products Ltd, Unit 14, Bessemere Park, London, SE24 0HG, United Kingdom