Last updated: 25 August 2026

Who is responsible for your data

MAISON MOUCHE, a société par actions simplifiée (French simplified joint-stock company) with share capital of EUR 30,000, registered with the Bobigny Trade and Companies Register under number 890 841 661, 13 avenue Francisco Ferrer, 93310 Le Pré Saint Gervais, France.

For any question, or to exercise your rights: contact@maisonmouche.fr.

We do not sell or rent your data. It is used to prepare and deliver your orders, answer your enquiries and — if you have agreed to it — send you our news.

What we process, and why

Purpose	Data	Legal basis	Retention
Processing and delivering your orders	Identity, delivery and billing addresses, email, telephone (optional), order details, amount and payment method	Performance of the contract	5 years after your last order
Issuing and keeping invoices	Identity, billing address, order details and amount	Legal obligation	10 years after the close of the financial year
Managing your customer account	Email, encrypted password, order history, saved addresses	Performance of the contract	Until the account is deleted, or after 3 years of inactivity
Sending our newsletter	Email, first name	Consent	Until you unsubscribe, or 3 years without interaction
Measuring how our emails are received	Message opening, date, links clicked	Consent for commercial emails, legitimate interest for service emails	24 months
Preventing fraud and unpaid orders	Payment incident history, IP address, and in cases of serious doubt an identity document or proof of address	Legitimate interest	Documents deleted within 30 days, other data 24 months
Securing the website	IP address, connection date, pages viewed, browser	Legitimate interest	24 months
Answering your enquiries	Your message and contact details	Legitimate interest, or performance of the contract	24 months after closure

 

Three points worth spelling out

Our emails contain a measurement pixel. This invisible image tells us whether the message was opened and which links were clicked. For our commercial emails we ask your permission; for service emails (order confirmation, shipping, password), we only check that they reach you. You can object at any time HERE. You will continue to receive our emails as usual.

An IP address is personal data. We do not link it to your identity, but nor do we describe it as anonymous.

The decision to refuse an order is made by a person. Where there is serious doubt about a payment, a member of our team reviews the file and may ask you for supporting documents. Such requests are exceptional, never systematic, and the document is deleted as soon as the check is done. No automated process decides on its own.

Who has access to your data

Our providers act on our instructions and may not use your data for their own purposes.

Provider	Role	Data received
Shopify	Hosts the store and handles orders	Order and account data
Stripe and PayPal	Process payments	Payment and billing data
Alma	Instalment payments	Identity, amount, credit file data
Colissimo, Chronopost	Deliver your parcel	Name, delivery address, telephone
Omnisend	Sends our emails	Email, first name, opening statistics
Shopify, Omnisend	Measure website traffic	Browsing data, tracker identifier
Meta, Pinterest	Advertising and retargeting, subject to your consent	Browsing data, advertising identifier

 

We never keep your bank details: they are entered directly with the payment provider.

Alma is a special case: instalment payment involves granting credit, which Alma assesses against its own criteria. For that part, Alma is an independent data controller and its own policy applies.

Your data may also be disclosed to the authorities where the law requires it, and to our advisers in the event of a dispute. If our business were transferred, you would be informed before any transfer of data.

Transfers outside the European Union

Some of our providers are established outside the European Union, or host part of their processing there — in particular Shopify, Stripe, PayPal, Meta and Pinterest.

Such a transfer is only possible where it is properly framed: an adequacy decision of the European Commission, or standard contractual clauses together with any necessary additional measures. You can obtain a copy of the applicable safeguards by writing to contact@maisonmouche.fr.

Cookies and other trackers

The rules below apply to cookies as well as to pixels, tracked links and unique identifiers.

Without your consent, we only place strictly necessary trackers: basket, session, security, and remembering your cookie choices.

With your consent, we place non-exempt audience measurement trackers and advertising trackers: Omnisend, Shopify, Meta, Pinterest.

A banner is shown on your first visit: refusing takes the same effort as accepting. You can change your choice at any time by clicking « Gérer mes cookies » at the bottom of every page of the site. Refusing does not degrade your browsing in any way.

Trackers have a maximum lifetime of thirteen months, the data they collect is kept for twenty-five months, and your choice is stored for six months before we ask you again.

Your rights

At any time you may:

•    access your data and obtain a copy of it;

•    have it corrected if it is inaccurate or incomplete;

•    request its erasure , subject to what the law requires us to keep;

•    request restriction of a processing operation while a challenge is examined;

•    request portability of the data you have provided to us;

•    object to direct marketing , without having to give reasons;

•    object to processing based on our legitimate interest , on grounds relating to your particular situation;

•    withdraw your consent at any time, for the newsletter as well as for trackers;

•    give instructions on what happens to your data after your death.

 

Write to contact@maisonmouche.fr or to 13 avenue Francisco Ferrer, 93310 Le Pré Saint Gervais, France. We reply within one month, extendable by two months for complex requests. We may ask you for proof of identity where there is serious doubt, and we delete it immediately after checking.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the data protection authority of your country of residence in the European Union.

Security and changes

We protect your data through encryption of all exchanges across the site, access restricted to those who need it, and a hosting provider bound by contractual security obligations. No system being infallible, please choose a strong password and keep it to yourself. Should a breach be likely to result in a high risk to your rights, we would inform you.

This policy may change. The update date appears at the top. In the event of a substantial change, we will let you know before it takes effect.

Language

This English text is a translation provided for convenience. In the event of any discrepancy, the French version of this privacy policy prevails.