Privacy policy

Protecting your privacy matters greatly to us. This document explains how we collect, use and secure your personal data.

Last updated: 11 September 2026

This English version is provided for your convenience. Only the French version is legally binding; in the event of any difference, it prevails.

1. Data controller

Business nameMai-anh Guillou

Address1 rue Marguerin, 75014 Paris

Legal representativeMai-anh Guillou

GDPR contact emailcontact@maisonpetiteromance.comThis email is dedicated to requests about the protection of personal data.

2. Data collection

We collect different types of data to provide our services and improve your experience:

Data you provide directly

Identity information (surname, first name)
Contact details (email address, phone number)
Delivery and billing addresses, and the contents of your order
Your subscription to the house letter, and the language of your request
Content of your messages (email)

Data collected automatically

IP address and connection data
Browser type and operating system
Pages visited and browsing time
Language preferences

3. Use of data

The personal data we collect is processed on the legal bases provided for by the GDPR. We use it mainly for:

Purpose of processing	Legal basis
Answering your requests (email, form) and managing the resulting customer relationship.	Pre-contractual measures / Performance of a contract
Handling assistance requests, customer support and complaints	Performance of a contract / Legitimate interest
Improving services, usage analysis and optimising the user experience, with respect for users' rights and freedoms.	Legitimate interest
Site security, fraud and abuse prevention	Legitimate interest / Legal obligation
Meeting accounting and tax obligations	Legal obligation
Sending commercial and marketing communications	Consent

Legal basis of processing

Personal data is processed on one of the following legal bases, in accordance with article 6 of the GDPR:

Performance of a contract: when processing is necessary to provide the services requested or to manage the customer relationship.
Legal obligation: when processing is required by law, in particular for accounting or tax purposes.
Legitimate interest: when processing is necessary for the proper functioning of the site, security or improving services, with respect for users' rights and freedoms.
Consent: when the user has given explicit agreement, in particular for marketing communications or the use of non-essential cookies.

4. Online purchases & payment

When you place an order on this site, the following processing is added to that described above:

Purpose of processing	Legal basis	Retention
Managing orders, their fulfilment and delivery	Performance of a contract	Duration of the contractual relationship, then legal archiving
Invoicing and accounting and tax obligations	Legal obligation	10 years (accounting records)
Securing payments and preventing fraud	Legitimate interest / Legal obligation	Strictly necessary period

Secure payment

Online payment is processed by Stripe, PayPal, Apple Pay, Google Pay: your bank details are entered directly with this provider, in a secure environment, and are neither collected nor stored by us.

5. Data retention period

Personal data is kept only for as long as necessary to achieve the purposes for which it was collected, in accordance with the requirements of the General Data Protection Regulation (GDPR) and the applicable legal obligations.

Type of data	Retention period
Data relating to the contractual relationship (customers)	For the duration of the contractual relationship, then archived in accordance with legal obligations
Prospect data (contact forms, information requests)	3 years from the last contact initiated by the prospect
Invoicing and accounting data	Legal period in force (generally 10 years)
Customer support data	As long as needed to handle the request, then archived for a limited period
Technical data and security logs	Limited period, strictly necessary for security and abuse prevention
Data used for marketing purposes	Until the user withdraws consent

Archiving and deletion

At the end of the defined retention periods, personal data is deleted, anonymised or archived in accordance with the legal obligations in force.

6. Data sharing

We never sell your personal data. We may share or process it in the following cases:

Service providers

Hosting, email sending tools and technical providers needed for the site to work.

Legal obligations

Where required by law or on formal request from a judicial or administrative authority.

Transfers outside the European Union

Some technical providers or third-party services used for hosting, payment management, email sending or audience measurement may be located outside the European Union.

In that case, data transfers are covered by appropriate safeguards in accordance with the GDPR, in particular standard contractual clauses approved by the European Commission or equivalent mechanisms ensuring an adequate level of protection.

Authorised persons

Personal data collected is accessible only to duly authorised persons within the organisation, within the limits of their duties and solely for the purposes described in this privacy policy.

These persons are bound by a duty of confidentiality and only access data when necessary to carry out their tasks.

Third-party partners and platforms

Some features of the site may rely on third-party services or platforms (in particular communication tools, audience measurement or social networks).

Using these services may lead to personal data being collected by these third parties, subject to their own privacy policies.

This processing only takes place where necessary or where the user has consented, as applicable.

Business operations

In the event of a merger, acquisition or sale of assets, your data could be transferred.

7. Your rights as a user

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

7.1. Right of access and rectification

You can ask for access to the personal data we hold about you, obtain a copy of it, and ask for inaccurate or incomplete information to be corrected.

7.2. Right to erasure

You can ask for your personal data to be deleted, except where keeping it is required to comply with a legal obligation.

7.3. Right to object

You can object at any time to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.

7.4. Right to restriction of processing

You can ask for the processing of your personal data to be restricted in the cases provided for by the regulations, in particular when you contest the accuracy or lawfulness of the processing.

7.5. Right to data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to ask for it to be sent to another controller where technically possible.

7.6. Right to lodge a complaint

If you consider that your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority, in particular the French data protection authority (CNIL).

7.7. Withdrawal of consent

Where the processing of your personal data is based on your consent, you can withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Withdrawal of consent may concern, in particular, marketing communications or the use of non-essential cookies.

7.8. Post-mortem instructions

In accordance with the applicable regulations, you can set instructions for the retention, erasure and communication of your personal data after your death.

These instructions may be general or specific and may be changed or revoked at any time.

Exercising your rights — Write to contact@maisonpetiteromance.com, setting out your request. We reply within one month, which may be extended by two months for complex requests. Proof of identity may be requested in case of reasonable doubt.

8. Data security

Security measures in place

We implement appropriate technical and organisational measures.

Encrypted exchanges (HTTPS/TLS)

Access limited to authorised persons

Security and monitoring measures (depending on providers)

Protection and recovery procedures (depending on providers)

9. Cookie policy

When you browse the site, cookies may be placed on your device. These files ensure the site works properly, measure audience and improve the user experience, subject to your consent where required.

Type of cookies	Legal basis & Purpose	Duration
Essential (Wix session, Wix Analytics)	Legitimate interest — Technical operation of the site, including the host's operating cookies (Wix session) and its audience measurement (Wix Analytics, aggregated visit statistics), set before any choice because they are strictly necessary or exempt from consent	Session

Managing cookies

On your first visit to the site, a consent banner lets you accept or refuse all or some of the non-essential cookies.

Your choice (acceptance or refusal, category by category) is itself stored on your device (local storage “cc_consent”), with its date, for up to 13 months; after that, the banner asks you again.

You can change your cookie preferences at any time using the cookie manager, available at all times on the site.

Refusing non-essential cookies does not affect access to the main features of the site.

10. GDPR contact

For any question about the protection of personal data:

Data protection – GDPR contactcontact@maisonpetiteromance.com

By post1 rue Marguerin, 75014 Paris, France