Privacy Policy

MAÏON STUDIO

PRIVACY POLICY

In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act

Effective May 28, 2026

Preamble

MAÏON STUDIO, a simplified sole proprietorship with a capital of 1,000 euros, registered with the Paris Trade and Companies Register under number 101 881 738, with its registered office at 6 rue d'Armaillé, 75017 Paris (hereinafter "MAÏON STUDIO" or "the Data Controller"), attaches the utmost importance to the protection of its customers', prospects', and visitors' personal data.

The purpose of this privacy policy (hereinafter "the Policy") is to inform any natural person (hereinafter "the Data Subject") about the nature of personal data collected via the maion-studio.com website (hereinafter "the Site"), the purposes and legal bases of their processing, the recipients to whom they are communicated, the applicable retention periods, as well as the rights available to the Data Subject and the procedures for exercising them.

This Policy applies to all personal data processing implemented by MAÏON STUDIO as part of its online commercial activity and its customer relations. It is drafted in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter "GDPR") and amended Law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms (hereinafter "French Data Protection Act").

Article 1 — Identity and contact details of the data controller

Company name: MAÏON STUDIO

Legal form: Simplified sole proprietorship (SASU)

Share capital: 1,000.00 euros

Registered office: 6 rue d'Armaillé, 75017 Paris, France

SIREN: 101 881 738

RCS: 101 881 738 R.C.S. Paris

Intra-community VAT: FR69101881738

Personal data contact: contact@maion-studio.com

For any questions regarding the processing of your personal data or the exercise of your rights, you can contact MAÏON STUDIO at the aforementioned email address or by postal mail at the registered office address.

Article 2 — Data collected and purposes of processing

MAÏON STUDIO collects and processes personal data in the context of the activities and purposes described below. For each processing operation, the applicable legal basis is specified in accordance with Article 6 of the GDPR.

2.1 Order management and contractual relations

When placing an order on the Site, MAÏON STUDIO collects the following data: last name, first name, delivery postal address and, where applicable, billing address, email address, telephone number, as well as payment method information (processed directly by payment service providers, see Article 5).

This processing is necessary for the performance of the sales contract concluded between MAÏON STUDIO and the Customer, for the management of deliveries, the processing of returns and refunds, as well as for the management of complaints and the legal warranty. The legal basis for this processing is the performance of the contract within the meaning of Article 6(1)(b) of the GDPR.

2.2 Commercial communication and newsletter

With the express consent of the Data Subject, MAÏON STUDIO collects the email address for the purpose of sending commercial communications relating to its products, collections, promotional offers and brand news. This processing is carried out via Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France), an email routing service provider. The legal basis is the Data Subject's consent within the meaning of Article 6(1)(a) of the GDPR.

Consent may be withdrawn at any time, free of charge and without justification, by clicking on the unsubscribe link in each commercial email or by contacting MAÏON STUDIO at contact@maion-studio.com. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

2.3 Audience measurement and statistical analysis

MAÏON STUDIO uses Google Analytics 4 (service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure the Site's audience, analyze visitor behavior, and improve Site performance. The data collected includes, in particular, browsing data, pseudonymized IP address, browser type, pages visited, and session duration.

This processing is based on the Data Subject's consent within the meaning of Article 6(1)(a) of the GDPR and is only activated after consent is collected via the cookie management banner.

2.4 Targeted advertising and advertising performance measurement

Subject to the Data Subject's prior consent, MAÏON STUDIO deploys the following tracking technologies on the Site:

• Meta Pixel (service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), enabling the measurement of the effectiveness of advertising campaigns broadcast on Facebook and Instagram, the creation of customized audiences, and the delivery of targeted advertising;
• TikTok Pixel (service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland), enabling the measurement of conversions from TikTok advertising campaigns and the delivery of advertising tailored to users' interests.

This processing is based on the Data Subject's consent within the meaning of Article 6(1)(a) of the GDPR. The Data Subject can adjust their preferences via the Site's cookie manager or withdraw their consent at any time.

2.5 Customer reviews

MAÏON STUDIO uses Trustpilot (Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark) to collect and display customer reviews. When the Data Subject is invited to leave a review, Trustpilot collects their email address and name. This processing is based on consent or MAÏON STUDIO's legitimate interest in collecting feedback on the quality of its products and services, within the meaning of Article 6(1)(a) or (f) of the GDPR, as appropriate. The Data Subject is invited to consult Trustpilot's privacy policy available at trustpilot.com.

2.6 Legal and accounting obligations

MAÏON STUDIO processes certain personal data (in particular identification data and transaction-related data) in order to comply with its legal and regulatory obligations, especially those arising from tax law, commercial law, and consumer law. The legal basis is compliance with a legal obligation within the meaning of Article 6(1)(c) of the GDPR.

2.7 Fraud prevention and security

MAÏON STUDIO may process certain browsing and transaction data for the purposes of detecting and preventing fraudulent activities, particularly through the security mechanisms of the Shopify Payments platform, which comply with PCI DSS standards. The legal basis is MAÏON STUDIO's legitimate interest in protecting its business and its customers against fraud, within the meaning of Article 6(1)(f) of the GDPR.

Article 3 — Retention periods

Personal data is retained only for the time strictly necessary for the purposes for which it was collected, in compliance with applicable legal and regulatory obligations. The following retention periods apply:

• Data relating to orders and contract execution: retained for ten (10) years from the end of the relevant financial year, in application of legal accounting and tax retention obligations;
• Customer account data (in the absence of a purchase in the three years preceding the request): retained for three (3) years from the last contact with the Data Subject;
• Data relating to commercial communications (newsletter): retained until consent is withdrawn or for three (3) years from the last active contact with the Data Subject;
• Browsing and audience measurement data (Google Analytics): retained for a maximum duration of twenty-five (25) months from their collection, in accordance with CNIL recommendations;
• Data collected via advertising pixels (Meta Pixel, TikTok Pixel): retained according to the respective policies of the service providers concerned, generally for a maximum duration of twenty-five (25) months from their collection;
• Billing data and accounting records: retained for ten (10) years from the end of the financial year in application of Article L. 123-22 of the French Commercial Code;
• Customer review data (Trustpilot): retained according to Trustpilot's policy, generally for five (5) years.

At the end of these periods, the data is deleted or irreversibly anonymized, unless its retention is required by a legal obligation or ongoing legal proceedings.

Article 4 — Recipients of the data

Personal data collected by MAÏON STUDIO is processed by its internal teams within the limits of their responsibilities. It may also be communicated to the following recipients and subcontractors, to the extent strictly necessary for the performance of their missions:

4.1 Technical and hosting providers

• Shopify Inc. (151 O'Connor Street, Ottawa, Ontario, K2P 2L8, Canada): Site hosting, online store management, payment processing via Shopify Payments. Shopify is certified compliant with PCI DSS standards. Data may be hosted in data centers located outside the European Union. Appropriate safeguards are in place in accordance with Chapter V of the GDPR (standard contractual clauses of the European Commission).

4.2 Payment providers

• Shopify Payments (Stripe): credit card payment processing;
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg): PayPal payment processing;
• Klarna, Alma or Scalapay (depending on availability): 3-installment payment without fees.

MAÏON STUDIO does not collect or retain any banking data, which is processed directly and exclusively by the aforementioned payment service providers.

4.3 Carriers

• DPD France SAS: deliveries in mainland France and internationally (Europe);
• La Poste: tracked letter delivery for charms purchased alone (weight less than 100 grams).

The data transmitted to carriers is limited to the information necessary for package delivery (last name, first name, delivery address, telephone number if required).

4.4 Marketing and analytics providers

• Google Ireland Limited: provision of Google Analytics 4 service and Google Ads platform. Data may be transferred to the United States under the EU-U.S. Data Privacy Framework;
• Meta Platforms Ireland Limited: deployment of Meta Pixel and management of Meta Ads campaigns. Data may be transferred to the United States under the EU-U.S. Data Privacy Framework;
• TikTok Technology Limited: deployment of TikTok Pixel and management of TikTok advertising campaigns;
• Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France): routing and sending of commercial email communications (newsletter). Brevo is established in France, within the European Union.

4.5 Customer reviews

• Trustpilot A/S: collection and publication of customer reviews. Trustpilot is established in Denmark, a member state of the European Union.

4.6 Other recipients

MAÏON STUDIO may also be required to communicate personal data to competent public authorities (tax authorities, customs, courts, law enforcement) when such communication is required by law or necessary for the defense of its rights.

Article 5 — Data transfers outside the European Union

Some service providers used by MAÏON STUDIO are established or host data outside the European Union, particularly in the United States. MAÏON STUDIO ensures that any transfer of personal data to third countries is covered by appropriate safeguards, including:

• standard contractual clauses adopted by the European Commission, in accordance with Article 46(2)(c) of the GDPR;
• the EU-U.S. Data Privacy Framework, when the recipient is certified thereunder.

The Data Subject can obtain a copy of the safeguards put in place for these transfers by sending a request to contact@maion-studio.com.

Article 6 — Cookies and tracking technologies

The Site uses cookies and other tracking technologies (pixels, web beacons, tracking identifiers). A cookie is a small text file placed on the Data Subject's terminal when visiting the Site.

6.1 Strictly necessary cookies

These cookies are essential for the proper functioning of the Site, shopping cart management, authentication, and security. Their placement does not require prior consent. They are managed by Shopify.

6.2 Audience measurement cookies

Google Analytics 4 places cookies to measure the Site's audience and analyze browsing behavior. These cookies are only placed after the Data Subject's consent has been obtained.

6.3 Advertising and social media cookies

Meta Pixel and TikTok Pixel place cookies to measure advertising conversions, build custom audiences, and deliver targeted advertising. These cookies are only placed after the Data Subject's consent has been obtained.

6.4 Managing cookie preferences

The Site integrates a cookie consent manager via Shopify. The Data Subject can change their cookie preferences at any time by accessing the manager available on the Site.

It is also possible to configure the browser to refuse or limit cookies. Refusing cookies may degrade certain functionalities of the Site.

Article 7 — Rights of data subjects

In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act, any Data Subject whose data is processed by MAÏON STUDIO has the following rights:

• Right of access (Article 15 GDPR): to obtain confirmation that data concerning them is being processed and, if so, to obtain a copy;
• Right to rectification (Article 16 GDPR): to obtain the correction of inaccurate or incomplete data;
• Right to erasure (Article 17 GDPR): to obtain the deletion of data in cases provided for by the regulations, particularly when the data is no longer necessary for the purposes for which it was collected;
• Right to restriction of processing (Article 18 GDPR): to obtain the restriction of the processing of their data in the cases provided for by the GDPR;
• Right to data portability (Article 20 GDPR): to receive the data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller, when the processing is based on consent or the performance of a contract and carried out by automated means;
• Right to object (Article 21 GDPR): to object, on grounds relating to their particular situation, to processing based on MAÏON STUDIO's legitimate interest. In the context of commercial prospecting, the objection is unconditional;
• Right to withdraw consent (Article 7(3) GDPR): to withdraw consent previously given at any time, without this withdrawal affecting the lawfulness of prior processing;
• Right to define post-mortem directives (Article 85 of the French Data Protection Act): to define directives relating to the fate of personal data after the death of the Data Subject.

These rights can be exercised by sending a written request accompanied by proof of identity to: contact@maion-studio.com, or by postal mail to MAÏON STUDIO — 6 rue d'Armaillé, 75017 Paris.

MAÏON STUDIO undertakes to respond to any request to exercise rights within one (1) month from receipt of the request. This period may be extended by an additional two (2) months in the event of complexity or a large number of requests, with prior notification to the Data Subject.

Article 8 — Right to lodge a complaint with the supervisory authority

If the Data Subject considers that the processing of their personal data by MAÏON STUDIO infringes applicable provisions, they have the right to lodge a complaint with the French National Commission for Information Technology and Freedoms (CNIL):

CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

Website: www.cnil.fr

Telephone: 01 53 73 22 22

However, MAÏON STUDIO invites the Data Subject to contact it first in order to attempt to amicably resolve any dispute relating to the processing of their personal data.

Article 9 — Data security

MAÏON STUDIO implements appropriate technical and organizational measures to ensure a level of security adapted to the risk presented by the processing operations, in accordance with Article 32 of the GDPR. These measures include, in particular:

• encryption of data in transit (HTTPS/TLS protocol);
• encryption of data at rest for sensitive data;
• payment platform compliance with PCI DSS standards;
• restriction of access to data to authorized personnel only;
• regular updates of systems and software used.

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of the Data Subjects, MAÏON STUDIO undertakes to notify the Data Subjects as soon as possible, in accordance with Article 34 of the GDPR.

Article 10 — Subcontracting

In the course of its activity, MAÏON STUDIO uses subprocessors within the meaning of Article 28 of the GDPR. These subprocessors process personal data only on documented instruction from MAÏON STUDIO and provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures. Data processing agreements in accordance with the requirements of Article 28 of the GDPR are concluded with each of the subprocessors concerned.

Article 11 — Hypertext links and third-party services

The Site may contain links to third-party sites or integrate services provided by third parties (social networks, payment services, etc.). MAÏON STUDIO is not responsible for the personal data protection practices of these third parties. The Data Subject is invited to consult the privacy policies applicable to the third-party services they use.

Article 12 — Update of the privacy policy

This Policy may be amended at any time by MAÏON STUDIO, notably to take into account changes in applicable regulations, decisions of supervisory authorities or competent courts, or changes made to the processing implemented.

The current version is the one accessible on the Site on the date of consultation. In the event of a substantial modification, MAÏON STUDIO undertakes to inform the Data Subjects by any appropriate means, notably by email for Persons who have created an account or subscribed to the newsletter.

MAÏON STUDIO — SASU with a capital of €1,000 — RCS Paris 101 881 738

6 rue d'Armaillé, 75017 Paris — contact@maion-studio.com — maion-studio.com