Maison Orvéa – United Kingdom and United States

Last updated: 29 July 2026

1. Controller

 

2. Information we collect

·   Identity and contact details, such as name, billing and delivery address, email and telephone number;

·   Order and transaction details, including products, order number, currency, discounts, returns, refunds and customer-service communications;

·   Payment-related information. Full card data is generally handled by payment providers; we normally receive payment status, limited identifiers and fraud signals;

·   Account and preference data, if customer accounts, wish lists or saved preferences are available;

·   Device, usage and security data, including IP address, browser, device, logs, cookie IDs, session activity and fraud-prevention signals;

·   Marketing, consent and privacy-choice records, including newsletter status, cookie choices and advertising opt-outs;

·   Content you provide, such as support messages, reviews, photographs and other feedback.

3. Purposes and legal grounds

·   To take, process, deliver, return and refund orders: performance of a contract and steps requested before a contract;

·   To meet accounting, tax, customs, recordkeeping, product-safety and legal obligations;

·   To provide customer service and resolve disputes: contract performance and legitimate interests;

·   To prevent fraud, secure the store, diagnose faults and improve services: legitimate interests, balanced against individual rights;

·   To send email or SMS marketing and use personalised advertising: consent where required, with the right to withdraw or opt out;

·   To analyse site use: consent or legitimate interests depending on the tool, purpose and applicable law.

4. Required and optional information

Information needed for checkout, payment, delivery or legal records is required to complete a purchase. Optional information is identified where practical. If required information is not provided, we may be unable to accept or fulfil an order.

5. Service providers and recipients

·   Shopify group companies, including Shopify International Limited and Shopify Inc., depending on location and service;

·   Payment processors, banks and fraud-prevention providers;

·   Warehouses, carriers, customs brokers and delivery partners;

·   Email, customer-service, analytics and advertising providers, where enabled and legally permitted;

·   IT, professional, legal, tax and audit advisers;

·   Authorities, courts, regulators or prospective business transferees where legally permitted and necessary.

6. International transfers

Information may be processed in France, Ireland, Canada, the United States and other countries used by service providers. Where required, transfers rely on adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, contractual safeguards or a lawful exception. Shopify states that data from the EEA, UK and Switzerland is initially processed by Shopify International Limited in Ireland and may be transferred to affiliates and subprocessors.

7. Retention

·   Order, invoice and accounting records: for applicable statutory periods, commonly up to ten years;

·   Customer accounts: while active and for a limited period afterwards to manage claims, security and legal duties;

·   Support messages: normally up to three years after closure, longer if a dispute or legal obligation requires it;

·   Marketing data: until consent is withdrawn or an objection is made, after which limited suppression data may be retained;

·   Cookie and analytics data: for the durations stated in the cookie settings or vendor information;

·   Security logs: only for the period reasonably necessary for security, fraud prevention and evidence.

8. Cookies and similar technologies

Strictly necessary technologies support the basket, checkout, security, language and sessions. In the UK, prior consent is generally required before non-exempt storage or access technologies are used. In the United States, state laws may provide opt-out rights for targeted advertising, sale or sharing. You can change choices through the cookie or privacy settings; recognised browser-based opt-out signals are honoured where required.

9. Marketing

You may unsubscribe from marketing emails using the message link or by contacting contact@maison-orvea.fr. Withdrawal does not affect processing already carried out. Transactional messages about orders, security, product safety or legal changes are not marketing.

10. UK and EU privacy rights

·   Access to personal data and information about its use;

·   Correction of inaccurate data;

·   Erasure in appropriate circumstances;

·   Restriction of processing;

·   Objection to legitimate-interest processing and direct marketing;

·   Data portability where the legal conditions are met;

·   Withdrawal of consent at any time for future processing;

·   Complaint to the French CNIL and, for people in the UK, the Information Commissioner's Office (ICO).

11. United States privacy rights

Depending on your state and whether the relevant law applies to Maison Orvéa, you may have rights to know, access, delete, correct or obtain a portable copy of personal information, and to opt out of targeted advertising, sale or sharing. You may also have a right not to be discriminated against for exercising privacy rights.

Maison Orvéa does not sell personal information for money. If advertising technologies disclose identifiers or online activity to partners for cross-context behavioural advertising, that activity may be treated as 'sharing' or a 'sale' under some state laws. Where applicable, you can opt out through the privacy settings or a recognised Global Privacy Control signal.

California rights apply only if Maison Orvéa meets the statutory business thresholds. If applicable, California residents may request categories and specific pieces of personal information, deletion, correction, opt-out of sale or sharing, limitation of certain sensitive-data uses and non-discrimination.

12. How to exercise your rights

Send a request to contact@maison-orvea.fr. An online-only business may use an email address as a request method where permitted. We may ask for information reasonably necessary to verify identity and authority. Authorised agents may submit requests where applicable. Response periods and appeal rights depend on the governing law.

13. Children

The store is intended for a general adult audience and is not directed to children under 13. We do not knowingly collect online personal information from children under 13 in circumstances covered by COPPA. UK services are not designed for children, and we do not knowingly use children's data for behavioural advertising.

14. Automated decisions

We do not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects. Automated fraud and security signals may be used, with human review where required.

15. Security

We and our service providers use reasonable technical and organisational safeguards, including access controls, encryption in transit, monitoring and incident procedures. No method of storage or transmission is completely secure.

16. Changes and contact

We may update this policy to reflect services, vendors or legal developments. The current version and date will be posted on the website. Questions and requests should be sent to contact@maison-orvea.fr.