1. Who this notice is for
This notice explains what personal data Boomerang, a division of Eastern Air Couriers (“Boomerang”, “we”) collects, why, where it is kept and who can see it. It covers people who visit the website, request a drawback assessment, subscribe to the blog, sign up as a supplier or are invited to a supplier account, and the U.S. customers whose returns pass through the warehouse.
For suppliers’ customers, the supplier decides why the return is collected and is the controller of that data; we process it on the supplier’s instructions under the Terms of service. For everyone else named above, we are the controller.
2. What we collect
Website visitors. We use Cloudflare Web Analytics, which does not set cookies or fingerprint devices and gives us page-level counts only. If you arrive from a campaign link, the UTM parameters, the landing page and the referrer are kept in a first-party cookie (bm_utm) for the visit so that a later sign-up can record how you found us. The site also sets the cookies needed to keep you signed in.
Drawback assessment requests. Company name, your name, email, phone, country, website, U.S. importer of record number, annual U.S. import value band, customs broker, U.S. sales channels, your notes, the documents you upload (entry summaries, invoices), the campaign data above, and a hashed form of your IP address for abuse prevention.
Blog subscribers. Your email address and the campaign data above.
Supplier users. Name, email, phone, role, the time you accepted the terms, sign-in events, and everything you do in the portal (the audit log records who changed what and when, which customs rules require). Company details are business data but may include the names of directors or signatories.
Suppliers’ customers. Name, shipping address, email and phone as supplied on the return order, the original order number and price, the return reason, carrier tracking, and the photographs taken at inspection. Photographs show the goods and packaging; staff are trained not to capture documents or labels with other personal details, and anything that slips through can be reported to us and removed.
Buyers of resold goods. Name, address, email and phone on the sales order, for the shipping label and packing slip only.
3. Why we use it and on what basis
- To provide the services under our contract with the supplier: receiving, inspection, storage, fulfilment, export and drawback preparation.
- To reply to an assessment request or a contact message you sent us (your request, and our legitimate interest in responding).
- To send the blog or product news you subscribed to; every message has an unsubscribe link.
- To keep the records that U.S. customs, export and tax law require, including the audit trail of every record that feeds a drawback claim (legal obligation).
- To secure the service, prevent abuse and investigate incidents (legitimate interest).
- To understand which campaigns bring sellers to us, using the campaign data described above (legitimate interest; no profiling of individuals).
We do not sell personal data, do not use it for advertising to third parties, and do not make automated decisions with legal effect about people.
5. Where it is kept and for how long
The database and uploaded files are hosted by Supabase in the United States, and the application runs on Cloudflare’s network. Suppliers outside the United States, including in India and the European Union, therefore send data to the United States when they use the service. Where a transfer mechanism is required we rely on our providers’ standard contractual terms; contact us for details.
Retention follows the record, not the person:
- Return, inspection, inventory, shipment and drawback records, including photographs and uploaded documents: at least five years from the related import entry or export, because a drawback claim may be filed up to five years after import and CBP may ask for records for three years after a claim is paid. [CONFIRM WITH BROKER]
- Invoices, wallet ledger and tax records: seven years.
- Supplier user accounts and the audit log: for the life of the supplier account and the record retention periods above; the audit log cannot be edited, by design.
- Assessment requests from companies that do not sign up: 24 months, then deleted.
- Blog subscriptions: until you unsubscribe.
- Campaign cookie: 30 days. Sign-in session: until you sign out or it expires.
6. How we protect it
Data is encrypted in transit and at rest. Access to the database is through per-role policies so a supplier user can only read rows that belong to their supplier, and uploaded files are in private storage buckets whose paths are bound to the supplier. Staff access is by named account and role, and every change to a record is written to an audit log with the user and time. Service keys are held in the hosting platform’s secret store, not in code. We review access when staff change role or leave.
No system is perfectly secure. If a breach affects you we will tell you and any regulator without undue delay, as the law requires.
7. Your choices and rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority (for example your state attorney general in the United States, the Data Protection Board under India’s Digital Personal Data Protection Act, or your national authority in the EU or UK). You can exercise these rights by emailing hello@boomerang.rmsolutions-group.com. We answer within 30 days and may ask you to confirm your identity.
If you are a supplier’s customer, please contact the seller you bought from first; we will help them respond. Some records cannot be deleted while a customs retention period runs, and we will say so.
Supplier admins can edit company and user details, remove users, and export inventory, catalog and return data as CSV from the portal at any time.
8. Children
The service is for businesses. We do not knowingly collect data from anyone under 18, and a supplier’s customer data is used only to process the return.
9. Changes and contact
We will post changes to this notice here with a new date and tell supplier admins of material changes by email or in the portal before they take effect.
Privacy questions and requests: hello@boomerang.rmsolutions-group.com. Post: Boomerang, a division of Eastern Air Couriers, 28 West 36th Street, Room 601, New York, NY 10018. [DPO OR PRIVACY CONTACT, if appointed].