Privacy Policy

This page explains what personal data we collect, why, who it is shared with, and how you stay in control of it. It also covers the advertising tools we may use (see §7). It is drawn up in accordance with the Data Protection Act 2017 of the Republic of Mauritius.

1. Who is responsible for your data

Our role is selecting the products, advising you and following up. The products are prepared, delivered and invoiced by our supplier partner, who collects payment directly from the customer.

2. What data we collect

• When you message us on WhatsApp — first name, surname, phone number, region, and the content of your enquiry.
• When our CRM receives WhatsApp Business events directly through Meta’s Cloud API — the profile or contact name, WhatsApp number, text content of individual conversations, date, direction (received or sent), delivery status and, where applicable, the technical reference of an advert or media item. Media files are not archived in our CRM at this stage. If history sharing was authorised when “Coexistence” was connected, Meta may make up to 180 days of earlier individual chats available. This import remains conditional on that choice and technical availability: it is neither automatic nor guaranteed. Groups are not synchronised.
• When you place an order — delivery address, the products you want, your order history, your preferences (cut, marinade, time slot).
• If you accept advertising measurement in the website banner and then choose to contact us — the site associates that choice with the random Réf. BM-XXXXXXXXXXXX code added to the WhatsApp draft. Our CRM links the agreement to your record only if that exact reference returns in the message you send. A Lead event may then be sent for that enquiry and, for each future order delivered after the agreement, a Purchase event limited to the data described in §7.
• When you visit the site and accept audience measurement — pages viewed, device, clicks, scrolling and, depending on Clarity’s configuration, a session recording with sensitive content masked (see §6).
• When you build a selection — products, quantities, any marinade and selected region are kept locally in your browser so your basket can be restored. The visible random reference is created only when you ask to open WhatsApp and is not stored with the basket.
• If your link contains a referral code or campaign reference — this limited technical tag may be kept in your browser for no more than 30 days and sent separately to our CRM in the minimised event described below. It is not your name, number or message text. The visible Réf. BM-XXXXXXXXXXXX code added to the WhatsApp draft is a separate random identifier used to match that exact site passage with the message you choose to send.
• When you ask to open WhatsApp from a product or selection — our CRM receives only a minimised technical event: random identifier, status (“open requested” or “send declared”), general context, item count, interface language, landing path, referring domain and limited campaign tags (src, medium/utm_medium, UTM campaign and content). Through this channel it does not receive the draft text, your name, number, region, address, amount, detailed products, advertising click identifier or full URL.

Your first name and WhatsApp number are necessary for us to reply. Your address is necessary only if you order. Everything else is optional.

The pre-filled draft is placed in the wa.me link when you choose to open WhatsApp. WhatsApp may then process it under its own rules; Bon Manzé Maurice receives it as a customer message only if you press Send in WhatsApp.

Any history import authorised during the technical connection to Meta is not your consent to receive marketing messages. Opening WhatsApp, messaging us or placing an order does not amount to marketing consent either.

3. Why we use it

• To answer your enquiry and advise you;
• To arrange the preparation and delivery of your order;
• To centralise WhatsApp exchanges needed for the service, match a conversation to an existing customer record and retain the follow-up for an order;
• To follow up with you and let you know about a new arrival, if you want us to;
• To understand how our site is used, so we can improve it.
• To attribute an enquiry or order to its advertising source using the available technical references. Attribution may use the native referral supplied by Meta or extract only the visible, strictly formatted Réf. BM-XXXXXXXXXXXX code added to your message by our site. We do not use approximate matching on the rest of your text to invent an advertising origin;
• To improve our service by classifying, into limited categories, the questions received (for example price, availability or delivery), the types of replies and follow-ups, and then measuring their statistical associations with qualification or an order. Analytics dashboards are aggregated or pseudonymised, show sample size and evidence level, and are not used to make a legal or similarly significant decision about you;
• To measure and optimise our Meta campaigns where a consented enquiry or future order can be matched to an advert, only if you gave the explicit website agreement described in §7.

We do not sell your data to anyone, and we do not use it for automated prospecting.

What are the lawful grounds?

• Your request and the service expected, to answer you, pass your order to the supplier, centralise the necessary exchanges and provide the agreed follow-up;
• Our legitimate interest in maintaining the continuity and security of the service, importing strictly necessary recent exchanges where history sharing is enabled, and retaining minimised technical events, without overriding your rights;
• Your explicit consent in the website banner for Clarity, the Meta pixel and, where the exact BM reference links your site passage to the message sent, measurement of enquiries and orders through the Meta Conversions API; an independent, withdrawable choice is still required for WhatsApp marketing messages you expressly request;
• A legal obligation where certain information must be kept or disclosed.

4. Who it is shared with

• Our supplier partner, in Mauritius — they receive your first name, your number and your address, solely to prepare and deliver your order and to issue your invoice.
• WhatsApp and the Meta Platforms Cloud API — our customer service runs on WhatsApp. The content of your messages, your number and the associated technical information are therefore processed by Meta under its own rules. Meta sends our CRM the WhatsApp events to which our application is subscribed, including incoming messages, their statuses and replies sent from the WhatsApp Business app. In “Coexistence” mode, earlier history may also be transmitted if sharing was authorised and it is technically available.
• Meta Platforms, for advertising measurement — only after the explicit agreement described in §7, Meta may receive the strictly limited pseudonymised technical identifiers and Lead/Purchase events listed there.
• Our internal CRM — before any WhatsApp message is sent, it receives only the minimised technical event described in §2. A software safeguard strips the draft, region, amount, detailed selection, click identifiers and full URLs; only the limited campaign tags required for attribution are retained.
• Cloudflare D1 — our CRM keeps the WhatsApp contacts, conversations and statuses needed for the service and order follow-up there. This database is our operational source of truth: Meta sends signed events directly to our CRM, while customer follow-up, matching and retention decisions are managed from D1. Access is restricted to authorised people.
• Our technical providers — website hosting and audience measurement (see §6).
• The authorities, where the law requires it.

Nobody else. No resale, no file swapping.

5. How long we keep it

• Customers — 3 years after your last order or your last exchange with us.
• Enquiries that go no further — 12 months.
• Synchronised WhatsApp contacts, conversations and related analytics labels — they follow the same periods: up to 3 years after the last exchange or order for a customer, and 12 months for an enquiry that goes no further, unless the person requests a shorter period or retention is necessary to meet a legal duty or defend a right. The 180-day limit mentioned in §2 is a maximum history-import window, not an additional retention period. Truly anonymised statistics that can no longer identify a person or conversation may be retained to monitor overall trends.
• Technical events for opening WhatsApp — no more than 12 months.
• WhatsApp synchronisation technical logs — no more than 30 days to diagnose a failure or prevent a duplicate. The raw webhook body is not retained permanently.
• Meta Conversions API technical queue — no more than 30 days to allow delivery or retry, without keeping the plain-text phone number or email address in that queue.
• Evidence of your Meta Conversions API choice — no more than 3 years after each choice is recorded, unless a legal duty or dispute requires otherwise. Once that period ends, an agreement returns to “unknown” and must be requested again before any further transmission. After the evidence is deleted, a minimal refusal or withdrawal marker may remain linked to your customer record solely to prevent a transmission, until you make a new choice or the record is deleted.
• Selection kept in your browser — until you clear the selection, erase the site data or your browser removes it.
• Any referral code or campaign tag — no more than 30 days in the browser, so an enquiry can be linked to its origin without retaining the message content.
• Accounting records — for the period Mauritian law requires.

These periods describe retention in our Cloudflare D1 CRM, which is the operational source of truth under our control. Deleting our copies does not automatically erase a message that remains in WhatsApp, on another participant’s device, or in systems that Meta processes under its own responsibility.

6. Audience measurement and transfers outside Mauritius

Our site and the Cloudflare D1 database used by our CRM run on Cloudflare infrastructure. D1 remains the operational source of truth in our CRM for synchronised data. Microsoft Clarity is loaded only after you agree, so that we can understand how visitors navigate (pages viewed, clicks, scrolling).

To draft our follow-up messages we also use a writing assistant (Anthropic, United States). We send it only your first name, your region and your order history — never your surname, never your number, never your address. The suggested message is always reviewed by us before it is sent to you.

Cloudflare, Meta, Microsoft, Anthropic and the other providers named here may process data outside the Republic of Mauritius, where rules, avenues of redress and possible access by public authorities may differ. We limit transmitted data to what is needed for the purposes described on this page and apply the available settings, access restrictions and contractual safeguards.

Microsoft Clarity and the Meta measurement pixel remain disabled until you give your explicit consent through the dedicated banner. Declining does not disable any site function.

7. Advertising and measurement tools

We promote Bon Manzé Maurice on Facebook, Instagram and WhatsApp (Meta Platforms Ireland Ltd and Meta Platforms Inc.).

For that purpose, we use the following tools:

• The Meta measurement pixel — a small script which, when active, tells Meta that you have viewed certain pages, in order to measure how well an advert performs and, where relevant, to show you more relevant adverts.
• Cookies and similar technologies placed on your device by those tools.
• Custom audiences — we may ask Meta to show our adverts to people who have already visited our site, or to people likely to be interested in our offers, where the settings and your choice allow it.
• The Meta Conversions API — after your explicit agreement in the banner and the return of the exact BM reference in the WhatsApp message you choose to send, it may send a Lead event for that enquiry and a Purchase event for a future delivered order. If your conversation came from a Click-to-WhatsApp advert, the event uses the ctwa_clid click reference supplied by Meta and our WhatsApp Business Account ID. Otherwise, your normalised phone number and, if provided, your normalised email address may be used after SHA-256 hashing. Purchase also contains the date and time, amount, MUR currency and order identifier. These identifiers are pseudonymised, not anonymous.

Agreeing to the Conversions API causes no historical backfill: the Lead corresponds to the WhatsApp enquiry made after your choice and only purchases delivered after that agreement may produce Purchase. Through this API we do not send your name, address, region or location, products ordered, preferences, notes, VIP status, referral details or WhatsApp message content.

You may withdraw this agreement at any time via WhatsApp or at contact@bonmanzemaurice.com. Withdrawal stops future transmissions and cancels events that are still pending; it does not affect processing carried out before withdrawal. The button below removes browser-side tools and also transmits withdrawal for BM references still stored in this browser; contact us for a journey started on another device.

This data is processed by Meta outside the Republic of Mauritius, under Meta's privacy policy. You can manage your advertising preferences directly in your Meta account ad settings.

This site is not owned by Meta and is not affiliated with, administered by, sponsored or endorsed by Meta. Facebook, Instagram and WhatsApp are trademarks of Meta Platforms, Inc. If you arrived here from an advert, that advert was paid for and published by us, Accompagnement Transition Ltd — and by nobody else.

8. Your rights

At any time, free of charge, you may:

• Access the data we hold about you;
• Correct it if it is inaccurate;
• Have it erased;
• Restrict its use;
• Object to its processing;
• Withdraw your consent at any time — without calling into question what was done before.

We do not make any decision that has a legal or similarly significant effect on you solely through automated processing. The writing assistant mentioned in §6 only proposes a draft, which is always reviewed by a person.

Request deletion of your Meta, WhatsApp and CRM data

9. If you are not satisfied

You may refer the matter to the Data Protection Office of the Republic of Mauritius, the supervisory authority for personal data.

10. Minors

Our products and our service are intended for people aged 16 and over. We do not knowingly collect the data of a child under 16 without the consent of their parent or guardian. If you become aware of such a situation, write to us: we will delete the data.

11. Security

Your data is kept in an internal, restricted-access tool protected by a password. The main changes are logged. Only the people handling your order can see it. Our CRM accepts a WhatsApp webhook only when Meta’s cryptographic signature is valid and the WhatsApp Business account and phone-number identifier match the values we expressly authorised.

12. Company information

Our role. We select the products, we advise you and we handle customer follow-up. We are not the seller: the products are prepared, delivered and invoiced by our supplier partner, who collects payment directly from the customer and issues the invoice.

Our prices. The prices shown on the site are indicative, per kilo, VAT included. Because meat and fish are sold by actual weight, the final amount is confirmed with you at weighing, before delivery. Charges may apply depending on the delivery area; they are given to you before anything is confirmed.

13. Changes

We may update this page. The "last updated" date at the top tells you which version is in force.