Privacy policy

1. Controller

The controller within the meaning of the GDPR (Regulation (EU) 2016/679) is Julien Bataillet, [Adresse der Schmiede, PLZ, Ort], Frankreich, j.bataillet@mac.com.

2. What data is processed

• Order data: name, delivery address, email, telephone where given, items ordered, payment status.
• Contact form: name, email, subject, message text, optionally an uploaded image.
• Gift cards: name and email of giver and recipient, message, requested date.
• Newsletter: email, time of consent and of confirmation (double opt-in).
• Audience data via Google Analytics, only after consent in the cookie banner.
• Basket and settings (currency, cookie decision) are stored only locally in your browser and are not transmitted to us.

3. Purposes and legal bases

• Contract and order processing: Art. 6(1)(b) GDPR.
• Answering enquiries: Art. 6(1)(b) and (f) GDPR.
• Newsletter: consent, Art. 6(1)(a) GDPR, revocable at any time via the link in every email.
• Audience measurement: consent via the cookie banner, Art. 6(1)(a) GDPR.
• Statutory retention obligations (accounting, invoices): Art. 6(1)(c) GDPR.

4. Recipients of the data

• Stripe (payment processing), Stripe Payments Europe Ltd., Dublin, Ireland.
• Brevo (order confirmations, newsletter), Sendinblue SAS, Paris, France.
• Netlify (hosting, contact form), Netlify Inc., San Francisco, USA.
• Google Analytics (only with consent), Google Ireland Ltd., Dublin, Ireland.

Some of these providers also process data outside the EU, in particular in the USA. Transfers are based on the European Commission’s standard contractual clauses or, where applicable, the EU-U.S. Data Privacy Framework.

5. Retention period

Order and invoice data are kept for ten years in line with statutory retention obligations (Art. L123-22 Code de commerce). Contact enquiries are deleted once dealt with, at the latest after twelve months. Newsletter data until consent is withdrawn.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Requests to j.bataillet@mac.com. Reply within one month. Complaints may be lodged with the CNIL (Commission Nationale de l’Informatique et des Libertés, www.cnil.fr).

7. Cookies and analytics

A cookie banner appears on your first visit. Technically necessary storage (basket, currency, your decision) takes place without consent. Google Analytics is loaded only after express consent, with a truncated IP address. You can change your decision here at any time: open cookie settings.