Privacy Policy

Who we are

Madeleine Clavel is the data controller responsible for your personal information. Our details are at the end of this policy.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using our store and website (the "Services"), or otherwise communicate with us. Our store is powered by Shopify, which hosts the Services on our behalf.

This policy applies to customers in Spain, the United Kingdom, the United States, Australia, and Canada, as well as other individuals who interact with our Services where applicable.

Please read this policy carefully. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to your personal information.

Personal information we collect

Depending on how you interact with the Services, we may collect:

• Contact details — your name, billing address, delivery address, phone number, and email address.
• Payment information — transaction details, payment method, and payment confirmation. We do not store full card numbers; these are handled directly by our payment processors.
• Account information — your username, password, preferences and settings, where you create an account.
• Transaction information — items you view, add to your cart, purchase, return, exchange or cancel, and your order history.
• Communications with us — the content of emails and messages you send us, including customer support enquiries.
• Device information — your IP address, browser type, device type, and other identifiers.
• Usage information — how you navigate and interact with the Services.

Where we get it from

• Directly from you, when you order, create an account, or contact us.
• Automatically, through cookies and similar technologies when you use the Services.
• From our service providers, where they process information on our behalf.

How we use your information, and our legal basis

Under the General Data Protection Regulation (GDPR) and the UK GDPR, where applicable, we must have a lawful basis for each purpose. Ours are as follows:

To fulfil your order — processing payment, arranging delivery, handling returns, and communicating with you about your order.
Legal basis: performance of a contract with you.

To manage your account — creating and maintaining your account, saving your preferences.
Legal basis: performance of a contract with you.

To provide customer support — responding to your questions and resolving issues.
Legal basis: performance of a contract, and our legitimate interest in supporting our customers.

To send marketing emails — newsletters, product announcements and offers.
Legal basis: your consent where required by applicable law. You can withdraw it at any time using the unsubscribe link in any email, or by contacting us.

To show you advertising — including personalised advertising on third-party platforms, and to measure how our advertising performs.
Legal basis: your consent where required by applicable law, including through our cookie banner. You can change your choices at any time. Where applicable law provides an opt-out right for targeted advertising or sharing personal information, you may exercise that right.

To analyse and improve the Services — understanding how the Services are used so we can improve them.
Legal basis: your consent for analytics cookies where required; our legitimate interest in improving our business for non-cookie-based analysis where permitted by law.

To prevent fraud and secure the Services — verifying orders, detecting fraudulent transactions, and protecting our systems.
Legal basis: our legitimate interest in preventing fraud, and compliance with our legal obligations.

To comply with the law — keeping tax and transaction records, responding to lawful requests, and establishing or defending legal claims.
Legal basis: compliance with a legal obligation, and our legitimate interest in defending legal claims.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object to this processing where applicable (see "Your rights" below).

For customers in the United States, Australia, and Canada, we also collect, use, and disclose personal information in accordance with applicable federal, state, provincial, and territorial privacy laws. Where consent is required, we obtain it in accordance with those laws. Where applicable law permits processing without consent for specified purposes, we process information only as permitted by that law.

Who we share it with

• Shopify, which hosts our store and processes information on our behalf.
• Payment processors, to take payment and prevent fraud.
• Delivery and fulfilment providers, to get your order to you.
• Email and marketing platforms, where you have consented to marketing or where otherwise permitted by applicable law.
• Analytics and advertising providers, where you have consented to those cookies or where processing is otherwise permitted by applicable law.
• Professional advisers, such as accountants and lawyers, where necessary.
• Authorities and third parties, where required by law, to enforce our terms, or in connection with a sale or restructuring of our business.

We do not sell your personal information for monetary consideration. Certain disclosures of personal information for personalised advertising may be classified as a "sale" or "sharing" under applicable United States privacy laws, even where no money is exchanged. Where such laws apply, we will provide the required notices and mechanisms to exercise applicable opt-out rights.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your use of the Services in order to provide and improve them. Information you submit will be transmitted to and shared with Shopify and third parties that may be located in countries other than where you live.

We also use certain Shopify enhanced features which incorporate data from your interactions with our store, other merchants, and Shopify. For these purposes Shopify is responsible for the processing of your personal information, including responding to requests to exercise your rights. You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal at privacy.shopify.com.

Cookies and similar technologies

We use cookies and similar technologies to operate the Services, remember your preferences, analyse usage, and deliver advertising.

Strictly necessary cookies are used without consent where permitted by applicable law, as they are required for the site to function. All other cookies — including analytics and advertising cookies — are only set where you have given consent through our cookie banner in jurisdictions where prior consent is required.

In other jurisdictions, cookies and similar technologies are managed in accordance with applicable privacy laws, including any required notices, consent mechanisms, and rights to opt out of targeted advertising or the sale or sharing of personal information.

You can change or withdraw your choices at any time through the cookie settings link on our website, where available, or by contacting us using the details below.

International transfers

We are based in Australia, and your personal information may be transferred outside your country of residence, including outside the European Economic Area, the United Kingdom, the United States, Australia, and Canada, to countries where Shopify and our other service providers operate.

Australia is not currently the subject of a European Commission adequacy decision. Where we transfer your personal information from the EEA to Australia or to any other country without an adequacy decision, we rely on appropriate transfer safeguards, including the European Commission's Standard Contractual Clauses where applicable, together with additional safeguards where appropriate, to ensure your information receives an adequate level of protection.

For transfers of personal information from the United Kingdom to countries without an applicable adequacy regulation, we use appropriate safeguards where required, including the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, as applicable.

For customers in Australia and Canada, international disclosures and transfers of personal information are handled in accordance with applicable privacy laws, including relevant requirements concerning transparency, accountability, and the protection of personal information transferred overseas.

You may request information about the safeguards we have in place by contacting us.

How long we keep it

• Order and transaction records — retained for as long as required by applicable tax and accounting law, currently up to seven years from the date of the transaction, or longer where legally required.
• Account information — for as long as your account remains active, and for two years after your last interaction with us, after which it is deleted or anonymised, unless a longer period is legally required.
• Customer support correspondence — three years from the date of the last message, unless a longer period is required for legal or dispute resolution purposes.
• Marketing contact details — until you withdraw consent or unsubscribe, and for a short period afterwards to record that you have opted out.
• Cookie and analytics data — in line with the retention periods set out in our cookie settings, typically no longer than 24 months.

Where we no longer need your information, we delete it or anonymise it so it can no longer be linked to you, subject to any applicable legal retention obligations.

Your rights

Your privacy rights depend on your country of residence and the laws that apply to the processing of your personal information.

Spain and the European Economic Area

If you are in Spain or another country within the European Economic Area, you have the following rights under the GDPR, subject to applicable conditions and exceptions:

• Access — to obtain a copy of the personal information we hold about you.
• Rectification — to have inaccurate or incomplete information corrected.
• Erasure — to have your personal information deleted in certain circumstances.
• Restriction — to ask us to limit how we use your information in certain circumstances.
• Portability — to receive certain information in a machine-readable format and to have it transmitted to another controller.
• Objection — to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
• Withdrawal of consent — where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
• Automated decision-making — we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

United Kingdom

If you are in the United Kingdom, you have rights under the UK GDPR and the Data Protection Act 2018, as amended, including the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where applicable. You also have rights relating to certain automated decisions that produce legal or similarly significant effects.

These rights are subject to applicable legal conditions and exceptions.

United States

If you are in the United States, your privacy rights depend on the state in which you reside and whether the relevant privacy law applies to our business.

Where applicable, these rights may include:

• Access and knowledge — to request information about the personal information we collect, use, and disclose.
• Correction — to request correction of inaccurate personal information.
• Deletion — to request deletion of personal information, subject to legal exceptions.
• Portability — to receive a copy of certain personal information in a portable format.
• Opt-out — to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling activities where these rights apply.
• Non-discrimination — to be free from unlawful discrimination or retaliation for exercising applicable privacy rights.

Residents of California may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to limit certain uses or disclosures of sensitive personal information where applicable.

We will respond to eligible requests in accordance with the requirements and timelines established by applicable state privacy laws.

Australia

If you are in Australia, you may have rights under the Privacy Act 1988 and the Australian Privacy Principles, where applicable.

These include the right to request access to personal information we hold about you and to request correction of information that is inaccurate, outdated, incomplete, irrelevant, or misleading.

You may also make a complaint about how your personal information has been handled. We will investigate and respond in accordance with applicable Australian privacy requirements.

Canada

If you are in Canada, you may have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable, and relevant provincial privacy legislation.

Depending on the law that applies, these rights may include:

• Access — to request access to personal information we hold about you.
• Correction — to request correction of inaccurate or incomplete information.
• Withdrawal of consent — to withdraw consent to certain processing, subject to legal or contractual restrictions.
• Complaints — to raise concerns about our handling of your personal information.

Additional rights may apply under provincial legislation, including privacy laws in Quebec and other provinces.

How to exercise your rights

To exercise any applicable privacy rights, contact us at help@madeleineclavel.com.

For requests governed by the GDPR or UK GDPR, we will generally respond within one month, which may be extended by two further months for complex requests where permitted by law, in which case we will tell you.

For requests from the United States, Australia, or Canada, we will respond within the timeframe required by the applicable privacy law.

We may need to verify your identity before acting on your request. Exercising your rights is generally free of charge, although fees may be permitted in limited circumstances under applicable law.

Complaints

If you have a concern about how we handle your personal information, please contact us first at help@madeleineclavel.com and we will do our best to resolve it.

You may also have the right to lodge a complaint with the relevant privacy or data protection authority:

• Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid. Website: www.aepd.es.
• United Kingdom: Information Commissioner's Office (ICO). Website: ico.org.uk.
• United States: The relevant state privacy regulator or Attorney General's office, depending on your state of residence and the law applicable to your complaint.
• Australia: Office of the Australian Information Commissioner (OAIC). Website: www.oaic.gov.au.
• Canada: Office of the Privacy Commissioner of Canada (OPC), or the relevant provincial privacy authority. Website: www.priv.gc.ca.

If you live in another EEA country, you may complain to your local data protection authority.

Children

The Services are not intended for children, and we do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it, subject to any legal obligations requiring retention.

Security

We take appropriate technical and organisational measures to protect your personal information, including encryption in transit and restricted access to systems holding personal data. No system is perfectly secure, however, and we recommend you do not send sensitive information to us through insecure channels.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or operational reasons. We will post the revised policy on this page and update the "Last updated" date. Where changes are material, we will notify you as required by law.

Contact us

Store name: Madeleine Clavel

Registered address: Melbourne, Victoria, Australia

Warehouse Address: Carrer de Pau VI, 88, 08173 Sant Cugat del Vallès, Barcelona, Spain

Email: help@madeleineclavel.com

Phone Number: (+34) 632994022

Monday to Friday | 09:00 – 17:00 CET
We aim to respond within one business day.