Privacy policy

Privacy Policy

Last updated: 21 January 2026

This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit or use our online shop, create an account, place an order, subscribe to our newsletter or otherwise interact with us.

Please read this Policy carefully. By using our website and services, you acknowledge that you have read and understood this Privacy Policy.

1. Controller and Contact Details

Controller

MaiTai Collection SARL
99 rue de l’Eglise
30260 Gailhan
France

Email: customerservice@maitaicollection.com
Website: https://www.maitaicollection.com

MaiTai Collection SARL is the controller of your personal data within the meaning of the EU General Data Protection Regulation (GDPR) and the French data protection law “Loi Informatique et Libertés” as amended.

If you have any questions about this Privacy Policy or about how we handle your personal data, you can contact us at the email address above.

2. Scope of this Privacy Policy

This Privacy Policy applies to:

  • visits to and use of our website and online shop at https://www.maitaicollection.com,
  • creation and use of customer accounts,
  • placing and processing orders,
  • communication with us via contact form or email,
  • newsletter subscription and related communications,
  • product reviews and affiliate/referral links,
  • our advertising and analytics activities connected to the shop.

It applies to visitors and customers in the European Economic Area (EEA), the United Kingdom (UK) and other countries. For users outside the EEA/UK, we will also handle requests about your personal data in line with applicable local laws to the extent required.

Some of the personal data we ask you to provide is necessary for us to perform a contract with you or to comply with legal obligations (for example, to process and deliver your orders or to issue invoices). Where data is required, this is usually indicated on our forms (such as by an asterisk). If you do not provide this mandatory data, we may not be able to create your account, process your order or provide certain services. Other data is optional; if you choose not to provide it, this may limit certain features but will not prevent you from using the core services of our shop.

3. Categories of Personal Data We Process

Depending on how you interact with us and which features you use, we may process the following categories of personal data:

  • Identity and contact data
    e.g. first and last name, title, billing and shipping address, country, email address, telephone number (if provided).
  • Account data
    e.g. login email, password hash (the actual password is not visible to us), account settings, saved addresses, order history.
  • Order and transaction data
    e.g. products ordered, quantities, prices, discounts, currency, order numbers, delivery method, payment status, returns and refunds, communication related to your orders.
  • Payment data
    e.g. payment method, masked card details (such as last 4 digits and card brand), payment token/transaction ID, payment status and fraud‑prevention indicators.
    We do not store full card numbers ourselves. Payment processing is carried out by our payment service providers (for example Shopify Payments and, if enabled in the future, additional payment providers such as PayPal) as independent controllers.
  • Communication data
    e.g. content and metadata of messages you send us via contact form or email, our internal notes and correspondence regarding your requests.
  • Newsletter and marketing preference data
    e.g. email address, date and time of subscription, subscription status, your preferences about receiving marketing communications, and technical information about opening and clicking our emails (if and when newsletters are sent).
  • Review and user‑generated content data
    e.g. product reviews (rating, review text, display name or initials), date of review and technical metadata processed by our reviews provider (Judge.me).
  • Affiliate and referral data
    e.g. use of an affiliate or referral link, discount code used, the order to which a referral relates, technical identifiers of the affiliate system.
  • Technical and usage data
    e.g. IP address, device identifiers, browser type and version, operating system, language settings, referrer URL, pages viewed, time and duration of visits, clicks and interactions, cookie preferences and consent choices.
    This data is collected via our shop platform (Shopify), cookies and similar technologies. Some of it is processed only if you have given consent (e.g. analytics cookies).

Sources of personal data
We receive personal data directly from you (for example when you place an order, create an account, subscribe to our newsletter or contact us), automatically via your devices and cookies and similar technologies when you use our website and shop, and, to a limited extent, from our service providers and partners (such as Shopify, payment providers, shipping and logistics companies, review and affiliate providers) to the extent necessary to perform contracts, provide our services or comply with legal obligations.

4. Purposes and Legal Bases of Processing

We process personal data only when we have a valid legal basis under Art. 6 GDPR. Depending on the context, this may be:

4.1 Website Operation and Security

Purposes

  • provide the website and online shop,
  • ensure the stability and security of our systems,
  • prevent misuse, fraud and attacks (e.g. DDoS),
  • troubleshoot technical issues.

Data

  • server log data (IP address, date and time of access, URLs, HTTP status code, amount of data transferred, referrer URL, browser and operating system),
  • basic technical identifiers and security‑related information from Shopify and our hosting and email providers.

Legal basis

  • Art. 6(1)(f) GDPR – our legitimate interests in the secure and reliable operation of our website, prevention of abuse and defence against attacks.

4.2 Creating and Managing Customer Accounts

Purposes

  • allow you to create and manage a customer account,
  • provide you with access to your order history and saved addresses,
  • simplify future orders and communication.

Data

  • identity and contact data,
  • account data (login credentials, settings, saved data),
  • order and transaction data.

Legal basis

  • Art. 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract (your account is directly connected to your purchases);
  • Art. 6(1)(f) GDPR – our legitimate interest in providing a convenient and secure account function.

You can delete your account at any time via your account settings or by contacting us. We may retain certain data to the extent required by law (see section 11).

4.3 Ordering, Payment and Fulfilment

Purposes

  • accept and process orders,
  • handle payments and refunds,
  • arrange and manage shipping and delivery,
  • provide customer service related to orders (e.g. questions, complaints, returns),
  • meet legal and tax obligations (e.g. bookkeeping, retention periods).

Data

  • identity and contact data,
  • order and transaction data,
  • payment data (as processed by payment service providers),
  • communication data relevant to your orders.

Legal bases

  • Art. 6(1)(b) GDPR – performance of a contract (purchase and related services);
  • Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. tax and commercial law retention duties, consumer protection);
  • Art. 6(1)(f) GDPR – our legitimate interests in fraud prevention, enforcing legal claims and defending against legal disputes.

Payment is processed by our payment service providers. They receive and process your payment data as independent controllers in accordance with their own privacy policies.

4.4 Customer Support and Communication

Purposes

  • respond to enquiries sent via contact form or email,
  • handle complaints and service requests,
  • general customer communication not directly related to a specific order.

Data

  • identity and contact data,
  • communication data,
  • where relevant, order and transaction data.

Legal bases

  • Art. 6(1)(b) GDPR – performance of a contract or pre‑contractual measures, when the enquiry relates to an existing or potential order;
  • Art. 6(1)(f) GDPR – our legitimate interest in providing efficient and high‑quality customer service.

4.5 Newsletter and Direct Marketing by Email

You can subscribe to our newsletter (if available) to receive information about products, offers and news.

Purposes

  • manage newsletter subscriptions,
  • send news and promotional content,
  • analyse opening rates and interactions to improve our emails (if and when newsletters are sent).

Data

  • email address,
  • subscription data (time of subscription, consent record),
  • technical data about opening and clicks (if measured),
  • preferred language or region (if applicable).

Legal basis

  • Art. 6(1)(a) GDPR – your consent.

You can withdraw your consent at any time with effect for the future, for example by clicking the unsubscribe link in our emails or by contacting us.

Currently, we are mainly collecting email addresses via Shopify Email and may start sending newsletters in the future. We will respect your choices and comply with applicable anti‑spam and e‑privacy rules.

4.6 Product Reviews (Judge.me)

We use the Judge.me app to collect and display product reviews.

Purposes

  • invite customers to leave reviews,
  • publish and manage reviews on our website,
  • verify that reviews come from genuine purchasers (where technically possible),
  • optionally, share review data with Google Merchant Center when using Google Shopping features.

Data

  • identity or display name (depending on what you provide),
  • review content (rating, text, photos, etc.),
  • basic technical metadata processed by Judge.me,
  • information about the related order.

Legal bases

  • Art. 6(1)(a) GDPR – your consent when you decide to submit a review or when we send review invitations, where required;
  • Art. 6(1)(f) GDPR – our legitimate interest in presenting authentic customer feedback and improving our products and services.

You can request that we remove your review at any time.

4.7 Affiliate and Referral Links

We sometimes provide affiliate or referral links that allow customers to receive a discount while affiliate partners receive a commission.

Purposes

  • track the use of affiliate/referral links and codes,
  • attribute orders and commissions to the correct affiliate partner,
  • operate our affiliate and referral program.

Data

  • technical identifiers associated with the affiliate link or code,
  • order and transaction data relating to purchases made via affiliate links or codes,
  • minimal data about affiliate partners as necessary for tracking and settlement (handled via our affiliate apps such as GOAFFPRO and AfterShip Referral & Affiliate).

Legal bases

  • Art. 6(1)(b) GDPR – performance of a contract with customers (discounts and referral benefits) and with affiliates where applicable;
  • Art. 6(1)(f) GDPR – our legitimate interest in running and optimising our affiliate and referral programme.

4.8 Analytics and Statistics (Google Analytics 4)

We use Google Analytics 4 (GA4) to analyse how visitors use our website and to improve our content and offers. GA4 is operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and may involve transfers to Google LLC, USA.

We implement GA4 via the Google tag (and, where applicable, Google Tag Manager). GA4 and related tags are integrated with Shopify’s Consent Mode and are only activated if you have given your consent via our cookie banner.

Purposes

  • measure and analyse visits and usage patterns,
  • improve the user experience and website performance,
  • evaluate the success of our marketing,
  • build pseudonymous visitor statistics and audiences (for example, to understand which pages or products are of particular interest).

Data

  • technical and usage data (e.g. pages visited, events, clicks, time spent, approximate location, device and browser information),
  • in a privacy‑enhanced manner, IP addresses (shortened/processed so that direct identification is limited),
  • cookie IDs or similar identifiers and associated pseudonymous identifiers used to create aggregated reports and audiences.

Legal basis

  • Art. 6(1)(a) GDPR – your consent. Without your consent, GA4 is not activated.

You can withdraw your consent at any time via our cookie/banner settings. You can also use browser add‑ons to opt out from Google Analytics (for example, the Google Analytics Opt‑out Browser Add‑on available at https://tools.google.com/dlpage/gaoptout). For more information, please see Google’s own privacy information at https://www.google.com/intl/en/policies/privacy/.

We also use Microsoft Clarity to better understand how visitors interact with our website (e.g. via aggregated usage statistics, heatmaps and session recordings) and to improve usability and performance. Microsoft Clarity is provided by Microsoft and may involve processing of usage and device information (and, depending on your settings, cookies and similar identifiers). Microsoft Clarity is only activated if you have given your consent via our cookie banner.

Purposes (Microsoft Clarity)
- analyse user interactions and navigation patterns (e.g. clicks, scroll behaviour),
- improve the user experience and website performance,
- detect and fix technical issues.

Data (Microsoft Clarity)
- technical and usage data (e.g. pages visited, clicks, scroll behaviour, session duration, device and browser information),
- pseudonymous identifiers such as cookie IDs or similar identifiers,
- IP address (processed in a way that limits direct identification).

Legal basis (Microsoft Clarity)
- Art. 6(1)(a) GDPR – your consent. Without your consent, Microsoft Clarity is not activated.

For more information, please see Microsoft’s privacy information and Microsoft Clarity terms: https://privacy.microsoft.com/ and https://clarity.microsoft.com/terms.

 

 

4.9 Online Advertising (Google Ads and Related Tools)

We use Google Ads (including search and Performance Max campaigns) to advertise our products. In doing so, we may use Google’s tools and tags (implemented via the Google tag and, where applicable, Google Tag Manager) to measure conversions and improve campaigns. These tools are usually linked with Google Analytics and are used only after you have consented to the relevant cookies or tracking technologies via our cookie banner.

Purposes

  • display relevant advertisements for our products (including by assigning users to pseudonymous target groups or “audiences”),
  • measure conversions (e.g. when an ad leads to a purchase),
  • optimise our advertising campaigns.

Data

  • technical and usage data collected by Google (e.g. ad clicks, page views, conversion events),
  • cookie IDs and advertising identifiers used to build pseudonymous profiles and audiences for advertising and measurement.

Legal basis

  • Art. 6(1)(a) GDPR – your consent via our cookie/banner settings.

Data may be transferred to Google LLC in the USA under the EU‑US Data Privacy Framework and/or Standard Contractual Clauses, as described in section 8. You can manage certain Google advertising settings at https://www.google.com/settings/ads/anonymous.

4.10 Social Media Integrations (Facebook & Instagram, YouTube, Instagram Gallery)

We use various social media integrations to showcase our products and content:

  • Facebook & Instagram app / social shopping
    We use the official Facebook & Instagram app to synchronise our product catalogue and enable shopping via Meta platforms. As of the date of this Policy, we do not use the Meta Pixel on our website for tracking users.
    If you interact with our Instagram Shop or Facebook Page, Meta Platforms may process your personal data as an independent controller under its own privacy policies.
  • Embedded YouTube videos
    We embed YouTube videos (e.g. product reviews). When you view a page with an embedded YouTube video, YouTube (Google) may receive technical and usage data such as your IP address, device and browser information and which video you watch. This is usually processed on the basis of our legitimate interest in presenting rich media content and, where cookies are involved, on your consent.
  • Embedded Instagram content / Instagram gallery
    We may embed Instagram posts or use an Instagram gallery feature to show social media content. When you view such content, Instagram (Meta) may receive technical and usage data related to your visit.

Legal bases

  • Art. 6(1)(f) GDPR – our legitimate interest in presenting our products and brand through social media and embedded content;
  • Art. 6(1)(a) GDPR – your consent for any non‑essential cookies or tracking associated with these integrations, as configured via our cookie settings.

For more detailed information about how these third‑party providers process data, please refer to their own privacy notices.

4.11 Google Fonts

We use Google Fonts provided by Google to display fonts on our website. When you visit a page that uses Google Fonts hosted by Google, your browser retrieves the font files directly from Google’s servers. This involves the transmission of your IP address and technical device and browser data to Google.

Purposes

  • display our website in a consistent and visually appealing way across different devices and browsers.

Data

  • IP address,
  • technical information about your browser and device.

Legal basis

  • Art. 6(1)(f) GDPR – our legitimate interest in providing a technically secure, efficient and attractive presentation of our website.

Where technically and legally appropriate, we may in the future switch to self‑hosting fonts to further minimise data transfers.

4.12 Automated decision‑making and fraud prevention

If you are in the EEA or UK, you have certain rights in relation to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

We do not make such fully automated decisions about you that have legal or similarly significant effects. However, our processor Shopify uses limited automated systems to help prevent fraud and abuse in connection with orders and payments. This may include, for example:

  • temporary blacklisting of IP addresses associated with repeated failed transactions (for a limited number of hours),
  • temporary blacklisting of credit cards associated with blacklisted IP addresses (for a limited number of days).

These measures are implemented to protect us and our customers against fraudulent transactions and do not, by themselves, produce legal effects for you or similarly significantly affect you. If you believe that an order was incorrectly blocked or flagged, you can contact us and we will review the situation.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device when you visit our website. Similar technologies include local storage, pixels and tags.

We use:

  • Essential (necessary) cookies
    These cookies are required for the basic operation of the website and the shop, for example to:
    • remember your language and region settings,
    • maintain your shopping cart and enable checkout,
    • allow you to log in to your customer account,
    • ensure security and prevent fraud. These cookies are processed on the basis of Art. 6(1)(b) GDPR (necessary for the performance of a contract) and Art. 6(1)(f) GDPR (our legitimate interest in operating a secure and functional website).
  • Analytics and performance cookies
    Used to understand how visitors use our site (e.g. Google Analytics 4). These cookies are set only with your consent (Art. 6(1)(a) GDPR).
  • Advertising and marketing cookies
    Used to measure and improve our Google Ads campaigns and similar marketing tools. These cookies are also set only with your consent (Art. 6(1)(a) GDPR).

Below is a non‑exhaustive list of cookies used by Shopify in our shop to provide core store functionality and reporting:

Cookies Necessary for the Functioning of the Store

Name Function Duration
_ab Used in connection with access to admin. 2y
_secure_session_id Used in connection with navigation through a storefront. 24h
_shopify_country Used in connection with checkout. session
_shopify_m Used for managing customer privacy settings. 1y
_shopify_tm Used for managing customer privacy settings. 30min
_shopify_tw Used for managing customer privacy settings. 2w
_storefront_u Used to facilitate updating customer account information. 1min
_tracking_consent Tracking preferences. 1y
c Used in connection with checkout. 1y
cart Used in connection with shopping cart. 2w
cart_currency Used in connection with shopping cart. 2w
cart_sig Used in connection with checkout. 2w
cart_ts Used in connection with checkout. 2w
cart_ver Used in connection with shopping cart. 2w
checkout Used in connection with checkout. 4w
checkout_token Used in connection with checkout. 1y
dynamic_checkout_shown_on_cart Used in connection with checkout. 30min
hide_shopify_pay_for_checkout Used in connection with checkout. session
keep_alive Used in connection with buyer localization. 2w
master_device_id Used in connection with merchant login. 2y
previous_step Used in connection with checkout. 1y
remember_me Used in connection with checkout. 1y
secure_customer_sig Used in connection with customer login. 20y
shopify_pay Used in connection with checkout. 1y
shopify_pay_redirect Used in connection with checkout. 30 minutes, 3w or 1y depending on value
storefront_digest Used in connection with customer login. 2y
tracked_start_checkout Used in connection with checkout. 1y
checkout_one_experiment Used in connection with checkout. session
checkout_session_lookup Used in connection with checkout. 3w
checkout_session_token_<token> Used in connection with checkout. 3w
identity-state Used in connection with customer authentication. 24h
identity-state-<token> Used in connection with customer authentication. 24h
identity_customer_account_number Used in connection with customer authentication. 12w

Reporting and Analytics

Name Function Duration
_landing_page Track landing pages. 2w
_orig_referrer Track landing pages. 2w
_s Shopify analytics. 30min
_shopify_d Shopify analytics. session
_shopify_s Shopify analytics. 30min
_shopify_sa_p Shopify analytics relating to marketing & referrals. 30min
_shopify_sa_t Shopify analytics relating to marketing & referrals. 30min
_shopify_y Shopify analytics. 1y
_y Shopify analytics. 1y
_shopify_ga Shopify and Google Analytics. session
customer_auth_provider Shopify analytics. session
customer_auth_session_created_at Shopify analytics.

session
_clck Stores a pseudonymous user ID and browser preferences for Microsoft Clarity.

Up to 1 year
_clsk Connects multiple page views by a user into a single Microsoft Clarity session recording.

Up to 1 year

 

We use Shopify’s consent tools (including Consent Mode v2) to manage cookies and similar technologies. When you visit our website, a banner will ask you to give or refuse consent for non‑essential cookies. You can change or withdraw your consent at any time via the cookie settings link or banner (if provided on the site).

You can also configure your browser to block or delete cookies. However, if you block essential cookies, some functions of the shop (such as the cart or checkout) may no longer work properly.

6. Shopify as Platform and Processor

Our online shop is built and hosted on the Shopify platform.

Provider
Shopify International Ltd.
Victoria Buildings, 1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify acts as our service provider and, in many respects, as a processor within the meaning of Art. 28 GDPR. Shopify provides the technical infrastructure, database and hosting for our shop. All or most of the data collected through our online shop is stored on Shopify’s servers and processed according to our instructions.

Shopify may transfer data to other companies in the Shopify group, including Shopify Inc. in Canada and Shopify entities in the USA and other countries. Canada is subject to an adequacy decision from the European Commission, and Shopify uses Standard Contractual Clauses and other safeguards for transfers to countries without adequacy decisions.

In addition, Shopify may process certain personal data as an independent controller for its own legitimate business purposes (for example to provide and improve the Shopify platform, to maintain the security of its services and to comply with its own legal obligations). For information about these processing activities and about how you can exercise your data protection rights directly with Shopify, please refer to the Shopify Consumer Privacy Policy and the Shopify Privacy Portal (https://privacy.shopify.com/).

For more information on how Shopify handles personal data in general, please see Shopify’s own privacy documentation, in particular the Shopify Privacy Policy at https://www.shopify.com/legal/privacy and the GDPR resources at https://help.shopify.com/en/manual/your-account/privacy/GDPR.

7. Other Recipients and Categories of Recipients

In addition to Shopify, we share personal data with the following categories of recipients, where necessary and lawful:

  • Payment service providers
    e.g. Shopify Payments and, if enabled in the future, other payment providers such as PayPal. These providers process payment data as independent controllers for the purpose of executing payments and complying with financial regulations.
  • Shipping and logistics partners
    e.g. DHL Express, Royal Mail, Canada Post, USPS, Colissimo/Lettre Verte and standard postal services in various countries (for example in the EU and other regions), as well as logistics apps such as the DHL eCommerce App and AfterShip Tracking. They receive the data necessary for delivery (name, address, country, possibly email and telephone number for notifications).
  • Reviews and feedback provider
    Judge.me, which processes review data and related technical information as our processor.
  • Affiliate and tracking tools
    e.g. GOAFFPRO and AfterShip Referral & Affiliate, which process technical and transactional data to operate our affiliate and referral programmes.
  • Social and content integration apps
    e.g. the Facebook & Instagram App and the Google & YouTube App used to connect our shop with social media and video platforms in the ways described in this Privacy Policy.
  • Analytics and advertising services
    Google (Google Analytics 4, Google Ads, YouTube) and related tools, to the extent you have given consent to analytics/advertising cookies.
  • Email and communication service providers
    e.g. Shopify Email and our email hosting provider (ALL‑INKL.COM) for sending transactional or service emails.
  • IT and infrastructure providers
    including ALL‑INKL.COM for domain and email hosting.
  • Professional advisers and authorities
    e.g. tax advisers, accountants, auditors, lawyers, courts and public authorities, where required by law or to protect our rights.

We only share the data that is necessary for the respective purposes. If we engage processors, we conclude data processing agreements in accordance with Art. 28 GDPR.

8. International Data Transfers

Some of the recipients mentioned in this Privacy Policy are located outside the European Economic Area (EEA) and the United Kingdom, or process data in countries where the level of data protection may not be the same as in the EU/UK.

Where this is the case and where there is no adequacy decision by the European Commission or the UK government for the respective country, we implement appropriate safeguards, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission or the UK authorities,
  • participation of the recipient in the EU‑US Data Privacy Framework (for eligible US organisations),
  • other supplementary measures as necessary to protect your data.

Examples of such transfers include:

  • use of Google services (Google Analytics, Google Ads, YouTube), where data may be processed by Google LLC in the USA,
  • use of Shopify services where data may be processed by Shopify entities outside the EEA,
  • communication with you via email services and infrastructure providers that may route data through servers outside the EEA/UK.

You can contact us if you would like more information about the specific safeguards we apply.

9. Retention Periods

We store personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.

In particular:

  • Order and invoice data
    Stored for the periods required by tax and commercial law. In many cases this is at least 6–10 years after the end of the financial year in which the transaction took place.
  • Customer account data
    Stored for as long as your account is active. If you request deletion of your account, we will delete or anonymise your data unless legal retention obligations require further storage.
  • Communication data
    Stored as long as necessary to handle your request and for a reasonable subsequent period to document our correspondence, or longer where required by law or to assert or defend legal claims.
  • Newsletter and marketing data
    Stored until you unsubscribe or withdraw your consent, and for a short period thereafter to document your withdrawal and compliance with your preferences.
  • Review data
    Stored for as long as the review is published and until you ask us to delete it, unless legal retention periods apply.
  • Analytics and advertising data
    Stored in line with the retention periods configured in the respective tools (e.g. in GA4) and only while you have consented to analytics/advertising cookies.

When data is no longer required for the purposes described, we will delete or anonymise it, subject to any legal retention obligations.

10. Your Rights under GDPR and UK GDPR

If you are in the EEA or the UK, you have the following rights in relation to your personal data, subject to the conditions and limitations set out in the GDPR and local law:

  • Right of access
    You have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data and certain information about the processing.
  • Right to rectification
    You have the right to request the correction of inaccurate or incomplete personal data concerning you.
  • Right to erasure (“right to be forgotten”)
    You have the right to request the deletion of your personal data in certain circumstances, for example when the data is no longer needed for the purposes for which it was collected or when you withdraw your consent and there is no other legal basis for processing.
  • Right to restriction of processing
    You have the right to request that we restrict processing of your personal data in certain circumstances, for example while we verify the accuracy of the data or consider an objection.
  • Right to data portability
    You have the right to receive personal data you have provided to us in a structured, commonly used and machine‑readable format and to transmit that data to another controller where technically feasible and where processing is based on consent or on a contract.
  • Right to object
    You have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless processing serves to assert, exercise or defend legal claims.
    You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
  • Right to withdraw consent
    Where processing is based on your consent (Art. 6(1)(a) GDPR), you may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, please contact us at customerservice@maitaicollection.com. We may need to verify your identity before fulfilling your request.

You also have the right to lodge a complaint with a supervisory authority, in particular:

  • France: Commission Nationale de l’Informatique et des Libertés (CNIL), www.cnil.fr
  • or the supervisory authority in your place of residence or work, or the place of the alleged infringement.

You can also find our legal notice (“Mentions légal”) at https://maitaicollection.com/pages/legal.

11. Data Security

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include, for example:

  • use of TLS/HTTPS encryption for data transmission between your browser and our shop,
  • access controls and authentication for our internal systems and accounts,
  • limiting access to personal data to those employees and service providers who need it to perform their tasks,
  • regular review of our security arrangements in cooperation with our service providers (such as Shopify and our hosting/email providers).

However, no method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

12. Children

Our website and services are intended for adults. We do not knowingly target or collect personal data from children under the age required by applicable law for valid online consent.

If you believe that a child has provided us with personal data without appropriate parental consent, please contact us so that we can delete the data and take any necessary steps.

13. Do Not Track and Non‑EU/Non‑UK Users

Some browsers offer a “Do Not Track” (DNT) signal. There is currently no uniform standard for how to respond to such signals. Our website does not change its behaviour solely in response to DNT signals. Instead, we rely on our cookie/banner settings and your expressed consent choices.

If you are located outside the EEA or UK, local data protection laws may grant you additional rights. We will handle requests regarding your personal data in line with the applicable law and this Privacy Policy. You can contact us at any time using the details in section 1.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our services, legal requirements or technical developments.

The current version of the Privacy Policy is always available on our website and is identified by the “Last updated” date at the top. In the case of significant changes, we may additionally inform you by email (where appropriate) or by displaying a notice on our website.

If you continue to use our website after changes to this Privacy Policy take effect, you will be deemed to have accepted the updated Policy.

If you have any questions about this Privacy Policy, please contact us at customerservice@maitaicollection.com.