Privacy policy

1. Introduction

Maison Molier attaches great importance to the protection of your personal data. We make leather goods from full-grain leather, phone cases, phone accessories, passport holders, bags, laptop sleeves and related articles, and we recognise that the trust you place in us extends to the careful handling of your personal data, with the same diligence we apply to our work.

This privacy policy (the "Privacy Policy") sets out which personal data we collect, for what purposes, on which legal basis, with whom we share it, how long we retain it and what rights you have. We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Dutch GDPR Implementation Act (UAVG), the Dutch Telecommunications Act and any other applicable laws and regulations.

In processing personal data we observe the following core principles:

• Lawfulness, fairness and transparency: we process your data solely on a valid legal basis and inform you clearly about the processing.
• Purpose limitation: we collect data for explicit, specified and legitimate purposes.
• Data minimisation: we limit ourselves to what is necessary for the purpose.
• Accuracy: we take reasonable steps to keep data accurate and up to date.
• Storage limitation: we retain data no longer than necessary.
• Integrity and confidentiality: we secure your data with appropriate technical and organisational measures.
• Accountability: we are answerable for, and can demonstrate, compliance with the above principles.

2. Data Controller

The data controller within the meaning of Article 4(7) GDPR is:

Maison Molier B.V.

De Trompet 1217

1967 DA Heemskerk

The Netherlands

Chamber of Commerce: 93689470

VAT identification number: NL866494480B01

Email: info@maisonmolier.com

Maison Molier B.V. is a private limited liability company incorporated under the laws of the Netherlands. For questions, requests to exercise your rights or complaints, please contact us using the details above or through the chat widget on our website. We aim to respond substantively within one (1) month, with the option to extend by two (2) further months pursuant to Article 12(3) GDPR where the complexity or volume of requests so requires.

Maison Molier is not required to appoint a data protection officer (DPO) under Article 37 GDPR. Privacy-related queries can be addressed to the contact details above.

3. Scope of this Privacy Policy

This Privacy Policy applies to all personal data processed by Maison Molier in the context of its business activities, including:

• Visiting and using our website and any subdomains;
• Creating and maintaining a customer account;
• Placing, processing and fulfilling orders for our leather goods;
• Subscribing to our newsletter and other marketing communications;
• Participating in promotions, prize draws or customer surveys;
• Submitting questions, complaints or warranty and return requests;
• Job applications and business relationships with suppliers, partners and service providers.

Our website may contain references or hyperlinks to third-party websites. Maison Molier is not responsible for the content, privacy practices or data processing of such third parties. We encourage you to review their privacy notices carefully.

4. Personal Data We Process

Below we set out, per situation, which categories of personal data we process, for what purpose, on what legal basis and for how long we retain them. We process only the data necessary for the relevant purpose.

4.1 When you visit our website

Data: your IP address, browser type and version, operating system, language preferences, referring URL, page interactions (pages visited, click behaviour, dwell time), device identifiers and approximate geolocation at city level.

Purpose: providing a functional and secure website, analysing and improving our website and services, preventing fraud and abuse, and complying with technical standards.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in a secure, well-functioning website. For analytical and marketing cookies we obtain your consent (Article 6(1)(a) GDPR in conjunction with Article 11.7a Dutch Telecommunications Act).

Retention period: log files for a maximum of twelve (12) months, unless longer retention is necessary for incident investigation or security purposes.

4.2 When you create a customer account

Data: first and last name, email address, password (stored in encrypted form), telephone number (optional), shipping address, billing address, language preference, communication preferences and purchase history. If you sign in via a social media service (e.g. Apple, Google), we receive your name and email address from that service.

Purpose: to create and maintain your account, store your data and purchase history, personalise your shopping experience and, only with your consent, send marketing communications.

Legal basis: performance of the contract (Article 6(1)(b) GDPR) for account management and your consent (Article 6(1)(a) GDPR) for marketing.

Retention period: for as long as your account is active. Upon account deletion, the data will be deleted or anonymised within thirty (30) days, except where longer statutory retention applies (see 4.3).

4.3 When you make a purchase in our webshop

Data: name, shipping address, billing address, email address, telephone number, order details (product selection, quantities), order and invoice number, payment method, transaction status and, where applicable, discount codes and gift card numbers.

Purpose: to process, confirm, ship and invoice your order, to handle returns and warranty procedures, to provide customer service and to comply with our tax and administrative obligations.

Legal basis: performance of the contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR, in particular Article 52 Dutch State Taxes Act) and our legitimate interest in fraud prevention and dispute resolution (Article 6(1)(f) GDPR).

Retention period: transaction and invoice data are retained for seven (7) years pursuant to the Dutch tax retention obligation. Other order data are retained for as long as reasonably necessary for warranty, returns and complaint handling, up to a maximum of five (5) years after the last interaction, unless longer statutory periods apply.

We do not receive full credit card or bank account details. Payments are handled by certified payment service providers (see chapter 7) compliant with the Payment Card Industry Data Security Standard (PCI-DSS).

4.4 When you subscribe to our newsletter

Data: your email address, optionally your name, and information about your interaction with our newsletter (open and click behaviour).

Purpose: to send you commercial and editorial communications about our collections, product launches and offers, and to measure and optimise the effectiveness of those communications.

Legal basis: your express consent (Article 6(1)(a) GDPR), which you may withdraw at any time via the unsubscribe link in every newsletter or through the chat widget on our website. For existing customers the soft opt-in under Article 11.7(3) Dutch Telecommunications Act applies for similar products.

Retention period: until you unsubscribe, after which your email address will be removed from our active mailing database within thirty (30) days.

4.5 When you contact customer service or social media

Data: your name, email address, telephone number (if provided), order number where relevant and the content of your message. When you contact us via social media, the relevant platform also processes personal data under its own privacy policy, over which we have no control.

Purpose: to respond to your enquiry, handle complaints or warranty requests and improve our services.

Legal basis: our legitimate interest in providing customer service (Article 6(1)(f) GDPR) and, for contact in connection with an existing contract, performance of that contract (Article 6(1)(b) GDPR).

Retention period: up to twenty-four (24) months after handling of your request, unless longer retention is necessary for legal proceedings or warranty claims.

4.6 Reviews and ratings

If you leave a product review or rating, we process your name (or chosen display name), your rating and the content of your review. These data may be displayed publicly on our website. We recommend that you do not include directly identifying personal data in your review. The legal basis is your consent (Article 6(1)(a) GDPR); you may request deletion through the chat widget on our website.

4.7 Job applications

Data: your contact details, curriculum vitae, cover letter, references, education and work experience, publicly available information from professional networks (such as LinkedIn) and notes from interviews and assessment rounds.

Purpose: to assess your suitability for the relevant role.

Legal basis: our legitimate interest in an effective recruitment and selection process (Article 6(1)(f) GDPR). Special categories of personal data (such as health or religion) are processed only with your express consent (Article 9(2)(a) GDPR).

Retention period: four (4) weeks after the procedure has ended, unless you give consent for longer retention (up to one (1) year) for future vacancies.

4.8 Business relationships (suppliers and partners)

We process contact details, job title, business email address and telephone number of contact persons at our suppliers, distributors and business partners, as well as correspondence and financial data necessary for the performance of the cooperation. Where appropriate, we verify identity and authority through Chamber of Commerce extracts or, where legally required, identity documents. When you provide an identity document, we ask you to redact the citizen service number (BSN) and the machine-readable zone (MRZ).

Legal basis: performance of the contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in effective cooperation (Article 6(1)(f) GDPR). Retention period: for as long as necessary for the cooperation, subject to the seven (7) year tax retention obligation for financial records.

5. Automated Decision-making and Profiling

Maison Molier does not engage in solely automated decision-making, including profiling, that produces legal effects concerning you or significantly affects you, within the meaning of Article 22 GDPR. We do use limited segmentation and personalisation for marketing purposes, based on purchase history and preferences, in order to show you more relevant product information. You may object to this at any time (see chapter 9).

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies (such as pixels and local storage). Cookies are small files placed on your device which can store and read information. We distinguish between:

• Functional cookies: necessary for the operation of the website (e.g. shopping basket, login session). These are placed without your consent pursuant to Article 11.7a(3) Dutch Telecommunications Act.
• Analytical cookies: to gain insight into the use of our website. Where configured in a privacy-friendly manner, these are placed without consent; otherwise on the basis of your consent.
• Marketing and tracking cookies: to display relevant advertising and measure campaign effectiveness, including by third parties. We place these only with your express consent.

On your first visit we obtain your consent via a cookie banner. You may withdraw or change your consent at any time via the cookie settings on our website. For a complete overview of the cookies used, their purpose, duration and the parties involved, please refer to our separate Cookie Statement.

7. Sharing of Personal Data with Third Parties

Maison Molier does not sell your personal data to third parties. We share personal data only where necessary for the purposes set out in this Privacy Policy, on a valid legal basis and with appropriate safeguards.

7.1 Processors

We engage carefully selected service providers who process personal data on our behalf. With these parties we conclude a data processing agreement pursuant to Article 28 GDPR, setting out arrangements regarding confidentiality, security, sub-processing, assistance with data subject rights and data breaches. These include:

• Hosting providers and cloud vendors (data hosting and infrastructure);
• E-commerce platform and webshop environment;
• Payment service providers (handling of payments);
• Logistics partners and carriers (shipping and delivery of orders);
• Email marketing and CRM platforms;
• Customer service platforms;
• Analytics and attribution providers;
• Accounting, invoicing and ERP systems;
• Review and rating platforms;
• External legal, tax and accounting advisers.

7.2 Independent controllers

In a number of cases we share personal data with parties acting as independent controllers:

• Payment service providers process your payment and are themselves responsible for that processing under their own privacy notices.
• Tax, customs and supervisory authorities receive data only to the extent we are legally obliged to provide them.
• Carriers receive the data necessary for delivery and may also process them for their own statutory purposes.
• External advisers (such as lawyers and accountants) are independently responsible by virtue of their statutory professional obligations.

7.3 Other situations

We may further disclose personal data where necessary to: (i) protect our rights or those of third parties; (ii) bring or defend legal proceedings; (iii) prevent fraud, abuse or unlawful conduct; or (iv) in the context of a (partial) transfer, merger, demerger or sale of our business, in which case we will inform you via our website or by email.

8. Transfers Outside the European Economic Area

A limited number of our service providers are established or process personal data outside the European Economic Area (EEA). We transfer personal data only where an adequate level of protection is ensured, namely:

• Adequacy decision: transfer to a country that the European Commission has determined provides an adequate level of protection (Article 45 GDPR); or
• Standard contractual clauses: execution of European Commission-approved model clauses (Article 46(2)(c) GDPR), supplemented where necessary by additional technical, organisational and contractual safeguards based on a transfer impact assessment; or
• Other safeguards such as approved codes of conduct or certification mechanisms, or, exceptionally, a specific derogation under Article 49 GDPR.

On written request through the chat widget on our website, we will provide further information about the safeguards applicable to a specific transfer.

9. Your Rights as a Data Subject

Under the GDPR you have the following rights regarding your personal data. These rights are not absolute; statutory exceptions or the rights of third parties may, in certain cases, prevent us from giving full effect to a request. In that case we will give reasoned notice.

• Right of access (Article 15 GDPR): you may request the personal data we process about you and obtain a copy.
• Right to rectification (Article 16 GDPR): you may have inaccurate or incomplete data corrected or completed.
• Right to erasure (Article 17 GDPR): in certain cases you may request deletion of your data ("right to be forgotten").
• Right to restriction of processing (Article 18 GDPR): you may request suspension of processing, e.g. pending correction.
• Right to data portability (Article 20 GDPR): you may receive your data in a structured, commonly used and machine-readable format and have them transferred to another controller.
• Right to object (Article 21 GDPR): you may object to processing based on a legitimate interest. You may object to direct marketing at any time without giving reasons.
• Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right not to be subject to solely automated decision-making (Article 22 GDPR).

You may exercise your rights by sending a written request through the chat widget on our website or to the contact details in chapter 16. We may ask you to identify yourself to confirm the request comes from you. We respond within one (1) month, with possible extension to a total of three (3) months for complex requests (Article 12(3) GDPR). Exercising your rights is in principle free of charge, unless requests are manifestly unfounded or excessive (Article 12(5) GDPR).

9.1 Right to lodge a complaint

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), whose contact details are available at www.autoriteitpersoonsgegevens.nl. We would appreciate the opportunity to address your concerns first, so we can seek to resolve the matter together.

10. Security of Personal Data

Maison Molier takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, undesired disclosure and unauthorised alteration. These measures include:

• Encryption of data in transit through TLS;
• Encrypted storage of sensitive data, including passwords using current hashing algorithms;
• Access control based on least-privilege and need-to-know principles;
• Logging and monitoring of access to systems containing personal data;
• Periodic security reviews, vulnerability scans and, where appropriate, penetration testing;
• Confidentiality obligations for staff and engaged third parties;
• Backup, recovery and business continuity procedures;
• Internal procedures for the detection, assessment and notification of data breaches.

If a data breach occurs that poses a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority without undue delay and in any event within seventy-two (72) hours of becoming aware (Article 33 GDPR). If the breach poses a high risk, we will also notify you directly (Article 34 GDPR).

11. Retention Periods

We do not retain personal data longer than necessary for the purposes for which they were collected, save for longer retention required by law or justified by a legitimate interest. Specific retention periods are set out in chapter 4. Where multiple periods apply to the same dataset, the longest period applies. After expiry, data are deleted or anonymised.

12. Minors

Our services are not directed at persons under the age of sixteen (16). We do not knowingly collect personal data from minors without the consent of a legal representative. If you believe we have inadvertently processed data of a minor, please contact us through the chat widget on our website and we will delete such data without delay.

13. Liability

Maison Molier endeavours to apply this Privacy Policy and the related processing operations carefully and in accordance with applicable law. To the extent permitted by law, Maison Molier excludes liability for damage resulting from (i) inaccurate or incomplete data provided by you; (ii) unauthorised access to your account due to your failure to adequately protect your login credentials; (iii) acts of third parties in breach of their obligations, in so far as those acts cannot be attributed to us; and (iv) force majeure. Nothing in this Privacy Policy is intended to limit or exclude your statutory rights under the GDPR or other mandatory law.

14. Amendments to this Privacy Policy

Maison Molier may amend this Privacy Policy from time to time, for instance as a result of changes to our services, technological developments or new legal requirements. The most recent version is always available on our website, with the date of last amendment indicated. For material changes that significantly affect you, we will inform you, to the extent we have your contact details, by email or by a prominent notice on our website.

15. Governing Law and Jurisdiction

This Privacy Policy and any disputes arising out of or relating to it are governed exclusively by Dutch law, without prejudice to mandatory consumer protection rules in your country of habitual residence. Disputes shall be submitted exclusively to the competent court in Amsterdam, the Netherlands, without prejudice to your statutory right as a consumer to bring proceedings in the court of your place of residence.

16. Contact

For questions, comments or requests in connection with this Privacy Policy or the processing of your personal data, please contact:

Maison Molier B.V.

Attn: Privacy

De Trompet 1217

1967 DA Heemskerk, The Netherlands

Email: info@maisonmolier.com

You can also reach us through the chat widget on our website.

CoC 93689470 | VAT NL866494480B01