Privacy Policy

Last updated: 3 August 2026

Who we are

Highland Commerce Pty Ltd, trading as Madeleine Clavel, is the data controller responsible for your personal information. Our details are at the end of this policy.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using our store and website (the "Services"), or otherwise communicate with us. Our store is powered by Shopify, which hosts the Services on our behalf.

Please read this policy carefully. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to your personal information.

Personal information we collect

Depending on how you interact with the Services, we may collect:

Contact details — your name, billing address, delivery address, phone number, and email address.
Payment information — transaction details, payment method, and payment confirmation. We do not store full card numbers; these are handled directly by our payment processors.
Account information — your username, password, preferences and settings, where you create an account.
Transaction information — items you view, add to your cart, purchase, return, exchange or cancel, and your order history.
Communications with us — the content of emails and messages you send us, including customer support enquiries.
Device information — your IP address, browser type, device type, and other identifiers.
Usage information — how you navigate and interact with the Services.

Where we get it from

Directly from you, when you order, create an account, or contact us.
Automatically, through cookies and similar technologies when you use the Services.
From our service providers, where they process information on our behalf.

How we use your information, and our legal basis

Under the General Data Protection Regulation we must have a lawful basis for each purpose. Ours are as follows:

To fulfil your order — processing payment, arranging delivery, handling returns, and communicating with you about your order.
Legal basis: performance of a contract with you.

To manage your account — creating and maintaining your account, saving your preferences.
Legal basis: performance of a contract with you.

To provide customer support — responding to your questions and resolving issues.
Legal basis: performance of a contract, and our legitimate interest in supporting our customers.

To send marketing emails — newsletters, product announcements and offers.
Legal basis: your consent. You can withdraw it at any time using the unsubscribe link in any email, or by contacting us.

To show you advertising — including personalised advertising on third-party platforms, and to measure how our advertising performs.
Legal basis: your consent, given through our cookie banner. You can change your choices at any time.

To analyse and improve the Services — understanding how the Services are used so we can improve them.
Legal basis: your consent for analytics cookies; our legitimate interest in improving our business for non-cookie-based analysis.

To prevent fraud and secure the Services — verifying orders, detecting fraudulent transactions, and protecting our systems.
Legal basis: our legitimate interest in preventing fraud, and compliance with our legal obligations.

To comply with the law — keeping tax and transaction records, responding to lawful requests, and establishing or defending legal claims.
Legal basis: compliance with a legal obligation, and our legitimate interest in defending legal claims.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object to this processing at any time (see "Your rights" below).

Who we share it with

Shopify, which hosts our store and processes information on our behalf.
Payment processors, to take payment and prevent fraud.
Delivery and fulfilment providers, to get your order to you.
Email and marketing platforms, where you have consented to marketing.
Analytics and advertising providers, where you have consented to those cookies.
Professional advisers, such as accountants and lawyers, where necessary.
Authorities and third parties, where required by law, to enforce our terms, or in connection with a sale or restructuring of our business.

We do not sell your personal information.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your use of the Services in order to provide and improve them. Information you submit will be transmitted to and shared with Shopify and third parties that may be located in countries other than where you live.

We also use certain Shopify enhanced features which incorporate data from your interactions with our store, other merchants, and Shopify. For these purposes Shopify is responsible for the processing of your personal information, including responding to requests to exercise your rights. You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal at privacy.shopify.com.

Cookies and similar technologies

We use cookies and similar technologies to operate the Services, remember your preferences, analyse usage, and deliver advertising.

Strictly necessary cookies are used without consent, as they are required for the site to function. All other cookies — including analytics and advertising cookies — are only set where you have given consent through our cookie banner. You can change or withdraw your choices at any time through the cookie settings link on our website.

International transfers

We are based in Australia, and your personal information will be transferred outside the European Economic Area, including to Australia and to other countries where our service providers operate.

Australia is not currently the subject of a European Commission adequacy decision. Where we transfer your personal information from the EEA to Australia or to any other country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate, to ensure your information receives an equivalent level of protection.

You may request a copy of the safeguards we have in place by contacting us.

How long we keep it

Order and transaction records — retained for as long as required by tax and accounting law, currently up to seven years from the date of the transaction.
Account information — for as long as your account remains active, and for two years after your last interaction with us, after which it is deleted or anonymised.
Customer support correspondence — three years from the date of the last message.
Marketing contact details — until you withdraw consent or unsubscribe, and for a short period afterwards to record that you have opted out.
Cookie and analytics data — in line with the retention periods set out in our cookie settings, typically no longer than 24 months.

Where we no longer need your information, we delete it or anonymise it so it can no longer be linked to you.

Your rights

If you are in the European Economic Area, you have the following rights in relation to your personal information:

Access — to obtain a copy of the personal information we hold about you.
Rectification — to have inaccurate or incomplete information corrected.
Erasure — to have your personal information deleted in certain circumstances.
Restriction — to ask us to limit how we use your information in certain circumstances.
Portability — to receive certain information in a machine-readable format and to have it transmitted to another controller.
Objection — to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
Withdrawal of consent — where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
Automated decision-making — we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact us at help@madeleineclavel.com. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you. We may need to verify your identity before acting on your request. Exercising these rights is free of charge unless a request is manifestly unfounded or excessive.

Complaints

If you have a concern about how we handle your personal information, please contact us first at help@madeleineclavel.com and we will do our best to resolve it.

You also have the right to lodge a complaint with a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. If you live in another EEA country, you may complain to your local data protection authority.

Children

The Services are not intended for children, and we do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it.

Security

We take appropriate technical and organisational measures to protect your personal information, including encryption in transit and restricted access to systems holding personal data. No system is perfectly secure, however, and we recommend you do not send sensitive information to us through insecure channels.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or operational reasons. We will post the revised policy on this page and update the "Last updated" date. Where changes are material, we will notify you as required by law.

Contact us

Store name: Madeleine Clavel

Company name: Highland Commerce Pty Ltd

Registered address: 5 Fairway Drive, Kew East VIC 3102, Australia

Warehouse Address: Carrer de Pau VI, 88, 08173 Sant Cugat del Vallès, Barcelona, Spain

ABN: 97 695 098 116

ACN: 695 098 116

Email: help@madeleineclavel.com

Phone Number: (+34) 632994022

Monday to Friday | 09:00 – 17:00 CET
We aim to respond within one business day.

Last updated: 3 August 2026