Privacy Policy

Maison Haute Joie GmbH – Updated 1 October 2026

The controller is Maison Haute Joie GmbH, Wickenburggasse 13/5, 1080 Vienna, Austria. You can reach us by telephone on +43 660 5539660. For privacy enquiries and to exercise your rights, please contact privacy@maisonhautejoie.com.

1 Data collection when you visit our website

When you access our website, technical data needed to transmit and display the content and operate the website securely is processed. This includes, in particular, the page or resource accessed, the date and time, the amount of data transferred, the previously visited page where your browser transmits it, the browser type and version, the operating system and the IP address.

We need this data for a functioning, stable and secure website, to analyse errors and prevent attacks. These are our legitimate interests (Article 6(1)(f) GDPR).

The full IP address is needed for the technical connection. Subsequent truncation in logs does not make the connection anonymous. The service providers involved and retention rules are described in chapter 2.

Cookies and analytics and marketing services may also process data without registration. The separate requirements in chapters 3 and 7 apply to these activities.

2 Hosting and technical services

2.1 Cloud-based systems for the shop and business processes

For the shop, customer, order and invoice management, communication and reporting, we use cloud-based systems supplied by an enterprise software provider based in Belgium. The provider processes data on our behalf under a data processing agreement (Article 28 GDPR) and uses service providers for hosting, backups and support.

Depending on the function used, this includes technical operational data, customer and order data, support cases and newsletter data. The legal bases and retention rules depend on the respective purpose described in this policy. Chapter 1 applies to technical provision and security.

The database is operated in the European hosting region. A European storage location does not exclude access from other countries, for example for support. Contractual data protection safeguards, in particular the EU standard contractual clauses, apply to such transfers. Chapter 9 also applies.

Technical logs are retained insofar as necessary for operations, troubleshooting, security and statutory evidence. For the category “Browser Data” described in its privacy notices, the software provider specifies a maximum of twelve months; exceptions are possible in the event of specific security or performance issues and legal requirements. This period does not apply generally to shop data and backups.

Further information about the recipients involved and the safeguards applicable to specific transfers is available from privacy@maisonhautejoie.com.

2.2 Bunny.net for content delivery

We use Bunny.net, the content delivery network of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia, to deliver media and other static content. In particular, the IP address, requested resource, time of access and technical connection information are processed. Bunny.net acts as our processor for this purpose. The legal basis is Article 6(1)(f) GDPR; our interest is in providing content quickly and reliably.

The EU routing filter is enabled for media delivery. Other processing activities, such as DNS or support, may also take place outside the EU.

CDN access logs are stored in the EU for three days with a truncated IP address. Permanent storage and additional forwarding are disabled. The full IP address continues to be processed for the technical connection.

Email images may also be retrieved through the CDN. This generates technical connection data, potentially from your email provider’s image proxy. Personalised newsletter performance measurement is described in chapter 7.

Further information: Bunny.net privacy notice.

2.3 Cloudflare Turnstile

To protect forms secured by this service against automated and abusive submissions, we use Turnstile from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Technical signals such as the IP address, TLS connection characteristics, browser identification and association with the calling website are evaluated. The resulting verification outcome is also validated between our server and Cloudflare.

Cloudflare processes data on our behalf to protect our website. Our legal basis is Article 6(1)(f) GDPR; our legitimate interest is in preventing bots and abuse. According to Cloudflare, it also processes signals as an independent controller for the further development of bot detection, on the basis of its own legitimate interests.

For data processed on our behalf, retention ends when the purpose or contract ends, subject to statutory exceptions. For its own purposes, Cloudflare determines the retention period according to the security purpose, data type, abuse risk and legal requirements. The short validity of the verification token is not a general deletion period.

Processing in the USA is possible. The corresponding adequacy decision applies to transfers to Cloudflare covered by the EU-U.S. Data Privacy Framework; otherwise, the contractually agreed transfer safeguards apply.

Further information: Turnstile privacy notice, Cloudflare general privacy policy.

3 Cookies and similar technologies

3.1 Technical storage and consent

Our website uses cookies and similar storage technologies such as Local Storage and IndexedDB. Depending on the function, these store session data, preferences, security information, translation and version data or marketing information subject to consent.

Without your consent, we may store or read information on your device only where this is strictly necessary for transmitting a communication or providing a service you have expressly requested (section 165(3) TKG 2021). This concerns, for example, the cart, session and necessary security functions. Whether language and country preferences are necessary depends on their function and storage duration.

Subsequent processing of personal data additionally requires a legal basis: performance of a contract for contractual functions, legal obligations for necessary consent records, and legitimate interests for necessary security and operational functions (Article 6(1)(b), (c) or (f) GDPR respectively). Legitimate interests do not replace any consent required for storage on your device.

Non-essential analytics and marketing processing takes place on the basis of your consent under Article 6(1)(a) GDPR and, where applicable, section 165(3) TKG 2021. You can decline these activities and select categories separately. Consent controls cover both browser functions and the server-side processing described in chapter 7. Visitor analytics in our cloud-based systems is assigned to the statistics selection; Meta Pixel and Conversions API are assigned to the marketing selection.

3.2 Cookiebot and consent records

We use Cookiebot from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to manage and document your choices. A data processing agreement covers processing on our behalf. Technical data such as the website URL, browser language, browser identification and IP address is processed to provide the banner. Your choice is documented with a consent identifier and information about when consent was given.

The “CookieConsent” cookie normally stores your choice for twelve months from the time it is made or saved again. You or your browser may delete it earlier. Server-side consent records must be distinguished from this: according to Cookiebot’s privacy notices, end-user data is deleted on a rolling basis twelve months after registration and on termination of our Cookiebot contract. This does not automatically cover separate records retained by us, to which chapter 9 applies.

We document your consent so that we can demonstrate that you agreed to the respective processing. This fulfils a statutory accountability obligation (Article 6(1)(c) in conjunction with Article 7(1) GDPR). The technical operation of consent management serves our legitimate interest in reliably implementing your choices (Article 6(1)(f) GDPR). Connection data and consent records are considered separately.

Further information: Cookiebot privacy policy.

3.3 Cookie policy and changing your choices

Details of technologies, providers, purposes and lifetimes are available in our Cookie Policy. You can change your choices or withdraw consent through Cookie Settings. Additional information, particularly about server-side transfers, is provided in the relevant chapters of this policy.

Withdrawal does not affect the lawfulness of processing before it takes effect. Nor does it automatically result in the immediate deletion of all necessary records. The separate withdrawal options in chapter 7 apply to newsletters and product notifications.

4 Contact customer support and AI assistance

4.1 Handling your enquiry

If you contact us, for example through a contact form, bonjour@maisonhautejoie.com or service@maisonhautejoie.com, we process the information you provide. This may include your name, email address, message content, attachments and, for order or complaint enquiries, in particular order numbers, product, delivery and payment details and previous correspondence.

We handle enquiries in our cloud-based systems and through our email infrastructure. Messages may be stored in the mailbox and support case. Contract-related enquiries are handled for the performance or preparation of a contract (Article 6(1)(b) GDPR); other enquiries are handled on the basis of our legitimate interest in appropriate communication and assistance (Article 6(1)(f) GDPR).

Enquiries are retained for as long as clarification, possible follow-up questions, legal obligations or necessary evidence for claims require. A closed support case is not automatically deleted; details are provided in chapter 9.

4.2 Email infrastructure

For business email communication we use Microsoft 365, in particular Exchange Online, supplied by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes, in particular, sender and recipient details, subjects, messages, attachments and technical delivery information for us. Processing on our behalf is governed by the Microsoft data protection agreement. For certain operational and business purposes of its own, Microsoft may act as a controller under its contractual terms.

Order confirmations and invoices are also sent through this email infrastructure. The legal basis depends on the purpose of the message. Contractual messages do not constitute consent to advertising performance measurement; chapter 7.1 applies to newsletters.

A European storage location does not mean exclusively European processing. Possible transfers to third countries are governed by the applicable adequacy decisions and contractual safeguards, in particular the standard contractual clauses. Further information: Microsoft privacy statement, Microsoft data protection agreement.

4.3 AI-assisted processing in cloud-based systems

We use AI functions in our cloud-based systems to support our staff and business processes.

Purposes. AI assists with searching, summarising and translating information, assigning and prioritising enquiries and preparing replies. It also supports quotations, orders, shipping, returns and complaints, document preparation and the creation of website, product and communication texts. Configured functions may supplement data fields and perform workflow steps, such as assigning enquiries or creating internal tasks.

Data. Depending on the task, inputs, instructions, relevant conversation histories, documents and business data are processed. This may include names, contact details, customer and order numbers and contract, delivery, invoice and complaint information. Information from configured search functions may also be included. The purpose and access permissions limit the scope; the entire customer database is not automatically transmitted.

Providers. Depending on the function and configuration, the systems described in chapter 2.1 integrate services from OpenAI and Google Gemini. Relevant content is transmitted to the respective AI service. According to the software provider, its AI agents use business or API services; information transmitted for these services is not used for model training. This does not apply generally to document digitisation and other additional services.

Further information: OpenAI data processing terms, Gemini API terms and Google data processing terms. Information about the integration of AI services and the recipients involved is available through our privacy contact.

International processing. AI services may process data outside the European Economic Area (EEA), particularly in the USA. OpenAI’s and Google’s business contractual terms provide for standard contractual clauses or applicable adequacy decisions for this purpose. Further information and access to safeguards are described in chapter 9.

Legal bases. Necessary AI processing for your enquiry or a contract takes place to prepare or perform a contract (Article 6(1)(b) GDPR). Supporting search and structuring serve our legitimate interest in prompt, consistent handling and fewer errors, provided your interests and fundamental rights do not prevail (Article 6(1)(f) GDPR). Any additional AI processing must be justified separately.

Your consent remains necessary for analytics and advertising that require consent. AI does not expand its scope or the permitted purposes; chapter 7 applies.

Retention. Source data, conversation histories and AI results adopted in our systems are subject to the retention rules for the respective process (chapter 9).

At the AI service, retention depends on request handling, technical caching and security and abuse checks. Security incidents or legal obligations may require longer retention. A single period does not apply to all AI data. Details are set out in the respective service terms, the OpenAI retention rules and the Gemini API abuse monitoring information.

The rights in chapter 8 also apply to AI processing, in particular the right to object where legitimate interests are relied upon. Decisions based solely on automated processing with legal or similarly significant effects are not envisaged.

5 Customer account Google sign-in and address suggestions

5.1 Customer account

A customer account facilitates orders and allows you to manage your data and access associated order information and documents. We process your name, email address, login details, addresses and order information to provide the account you requested (Article 6(1)(b) GDPR).

You may also order as a guest without a customer account. The necessary contact and order data is nevertheless stored. Required information is marked in the forms; the respective function cannot be provided without it.

You can delete your customer account yourself online under “My Account → Connection & Security → Delete Account”. You do not need to contact our privacy contact to do so. Documents that we still need to process contracts, meet legal obligations or provide necessary evidence for claims remain stored under the rules in chapters 6 and 9. You can continue to contact us to exercise other privacy rights.

5.2 Sign in with Google

Alternatively, you can sign in using your Google account. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as an independent controller for Google account management and authentication in the European Economic Area. We are responsible for incorporating the login data into our customer account. We do not receive your Google password.

When you sign in with Google, we receive your name, email address and unique Google account ID and store the login provider and technical access token. Google may additionally transmit your first and last names, email verification status, language and a profile picture link; these additional details are not adopted as separate account fields, and the profile picture is not imported. Google learns that you have signed in to our shop.

We process the necessary login data to provide your chosen sign-in method and account (Article 6(1)(b) GDPR). Google uses its own legal bases. Regular sign-in remains available. Disconnecting the Google connection does not delete your customer account with us or stored order data.

5.3 Address suggestions with Google Places

Google Places, part of Google Maps Platform, assists address entry with suggestions. As you type, address fragments are transmitted to Google server-side; depending on the query, the language, country restriction and a technical identifier to group related requests are also transmitted. Suggestions do not constitute a binding verification of deliverability or your residence.

The suggestions make address entry easier and help avoid delivery errors. This is our legitimate interest (Article 6(1)(f) GDPR). Data may be transmitted as you type, even if you do not select a suggestion. Manual entry remains possible. This server-side function is not controlled by the statistics or marketing selection.

For European user data, Google Ireland Limited acts as an independent controller under the Google Controller-Controller Data Protection Terms. We and Google are each responsible for our own processing. The commercial contracting party, Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, must be distinguished from this.

For Google sign-in and Google Places, processing outside the EEA is possible, particularly by Google LLC in the USA. The corresponding adequacy decision applies to transfers covered by the EU-U.S. Data Privacy Framework; Google’s other stated safeguards, in particular standard contractual clauses, apply to other transfers. Retention by Google depends on the respective processing purpose and its privacy notices; data incorporated into the customer account is subject to our retention rules.

Further information: Google privacy policy, Google Controller-Controller Data Protection Terms, Google data transfer frameworks.

6 Contract processing shipping and payment

6.1 Orders and gift cards

To process an order, we process, in particular, your name, contact details, billing and delivery addresses, products, quantities, prices, payment and delivery status and order and transaction references. This serves contract performance, including invoicing, payment allocation, delivery, refunds and complaints handling. The legal basis is Article 6(1)(b) GDPR; Article 6(1)(c) GDPR applies to statutory documentation and retention obligations. We use cloud-based systems for central administration; chapter 2.1 applies.

For personalised gift cards, the recipient’s name and email address, the giver’s name, the personal message and the selected language are also processed insofar as provided for the gift card. These details are used to create and deliver the gift card. Recipient data may originate from the giver. Processing this data to carry out the requested gift is based on Article 6(1)(f) GDPR; our legitimate interest and that of the giver is in delivering the requested gift card and enabling its use. The information is not used for advertising to the recipient solely for this reason.

We retain validity, remaining balance and redemption information for as long as the gift card, accounting or specific claims require. For recipient addresses and greeting messages, delivery, enquiries and specific evidence are the relevant criteria instead. Purchase records are subject to the statutory periods in chapter 9.

6.2 Shipping and Sendcloud

To arrange shipping, we transmit necessary order and shipping data from our cloud-based systems to Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands. Sendcloud provides the shipping platform and processes this data on our behalf under a data processing agreement. The data required in each case is forwarded to the commissioned carrier, in particular Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria, or DPD Direct Parcel Distribution Austria GmbH, Arbeitergasse 46, 2333 Leopoldsdorf, Austria. The service used for your shipment is indicated during the order or shipping process. Carriers generally process data as independent controllers for their own transport activities.

In particular, the recipient’s name, delivery address and shipping references are transmitted, along with an email address or telephone number as required by the delivery and notification function. Tracking numbers and shipping and delivery status are returned to process deliveries and handle delivery enquiries. Shipping-related messages serve delivery processing and not additional advertising.

We process shipping data to fulfil your order (Article 6(1)(b) GDPR). Chapter 9 applies to our retention; carriers retain data according to their activities and legal obligations. Further information: privacy notices for the Sendcloud platform, Österreichische Post and DPD Austria.

6.3 Payments through Stripe

For the electronic payment methods offered at checkout, we use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The information processed depends on the payment method selected. Card payments involve, in particular, card and authentication data; EPS involves bank-related payment information. Where wallet payments through Apple Pay or Google Pay are offered, the respective wallet service also participates, and payment or card tokens in particular are used to carry out the payment.

Confidential payment details are processed directly through the payment services. Our order management receives, in particular, the amount, currency, payment status, transaction references and, where applicable, truncated details to identify the payment method. Complete card verification codes are not stored in our order management.

Processing serves payment, payment reconciliation, refunds and payment dispute handling on the basis of Article 6(1)(b) GDPR. Insofar as we process data to prevent and investigate fraud or defend against claims, this is based on Article 6(1)(f) GDPR; our interest is in protection against abusive payments and financial loss. Statutory record obligations are based on Article 6(1)(c) GDPR.

Depending on the processing, Stripe acts as a processor or an independent controller, in particular for its own legal obligations and certain fraud prevention measures. Stripe determines the legal bases and retention for these purposes of its own. Processing outside the EEA is possible; Stripe’s stated transfer safeguards apply, in particular applicable adequacy decisions or standard contractual clauses.

Further information: Stripe privacy policy, Apple Pay and privacy, Google Payments privacy notice.

6.4 Online withdrawal function

If you use our online withdrawal function, we process the contact and order details you enter, the content and scope of your declaration, the goods concerned, the time of receipt, the association with an order and information about confirmation and processing. Required information is marked as such in the form.

The data is processed to unwind your contract and meet statutory confirmation and documentation obligations (Article 6(1)(b) and (c) GDPR in conjunction with the applicable provisions of the Austrian Distance and Off-Premises Contracts Act, FAGG). Consent is not required. Confirmations are sent through the email infrastructure described in chapter 4. Retention depends on completion, necessary evidence, outstanding claims and legal obligations (chapter 9).

7 Marketing newsletters and web analytics

7.1 Newsletter

Registration and personalisation. We send newsletters after you have given consent under Article 6(1)(a) GDPR and section 174(3) TKG 2021. Registration is secured by a confirmation email: the subscription is activated only after confirmation through the double opt-in process.

Registration includes your email address, title or “not specified”, first name, last name, country, language and customer type. Information required in the form is marked accordingly. Optional information, particularly birthday, postcode and interests, is used for appropriate communication and content selection. Details of registration, confirmation, the consent text and its version and technical evidence are retained for documentation. Selecting content according to your interests based on your details and, where applicable, separately authorised interaction data may constitute profiling for advertising purposes.

Our cloud-based systems manage newsletter contacts, profiles, mailing lists and consent records and create messages (chapter 2.1). Mailjet SAS, 43, rue de Dunkerque, 75010 Paris, France, within the Sinch group, handles sending. The Sinch data protection agreement governs processing on our behalf. For email communication and related operational, security, spam and fraud prevention and compliance functions, Sinch also processes data as an independent controller under its contractual terms.

Mailjet receives recipient and sender details, the subject, message content, individual links, any attachments and technical message identifiers through an encrypted connection. Mailjet receives other personal data only insofar as it is included in the message. Profiles and consent logs are not synchronised in full. Sending generates delivery and error information.

Mailjet identifies Frankfurt am Main and Saint-Ghislain in Belgium as storage locations; Sinch lists Google Cloud France SARL as a sub-processor for this purpose. Support and group services may nevertheless take place outside the EEA. The contractual terms provide for standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework.

Further information: Mailjet privacy policy, Mailjet terms of use, Sinch data protection agreement, Sinch sub-processors.

You may separately consent to personalised analysis of opens and clicks. This choice is optional, is not preselected and is activated only after your registration has been confirmed. The newsletter is also available without performance measurement.

With this consent, our cloud-based systems record opens and clicks using tracking pixels and individual links and associate them with your newsletter contact. This helps us improve newsletters and select appropriate content. The basis is your consent (Article 6(1)(a) GDPR and, for access to your device, section 165(3) TKG 2021). Without consent, personalised performance measurement does not take place. Additional Mailjet open and click tracking is disabled for these messages; technical delivery information remains available.

In your Newsletter Settings, you can withdraw consent to performance measurement independently of your subscription. The unsubscribe link ends both the newsletter and tracking consent. Alternatively, write to privacy@maisonhautejoie.com. We document consents and withdrawals. Your cookie choice does not replace these decisions.

The newsletter profile is used only for the necessary purposes during the subscription. Unconfirmed registrations are limited to 60 days. After unsubscription, necessary records and suppression information remain stored separately from advertising (chapter 9). After consent is withdrawn, analytics data may not be used for new personalised analysis solely on the basis of the earlier consent.

7.2 One-off product notifications

For sold-out or announced products, you may request a one-off email as soon as the specific product selected is available. By entering your email address and pressing the appropriately labelled button, you request this notification. You then receive a confirmation email; the notification request is activated only after you press the confirmation button on the linked page. The legal basis is your consent under Article 6(1)(a) GDPR and, where applicable, section 174(3) TKG 2021. This does not create a newsletter subscription or a general advertising profile.

We store the email address, product variant, language, request and confirmation times, status, validity and consent text version. Availability is checked hourly. Notifications are sent only for confirmed, valid requests that have not been withdrawn; announced products must additionally be released for sale and available to order.

You can withdraw the request with future effect through the withdrawal link in the confirmation email or through privacy@maisonhautejoie.com. The active request and any related pending messages are then removed.

Unconfirmed requests expire after seven days. Confirmed requests end on successful sending, withdrawal or no later than 365 days after confirmation. The active request and pending messages are then removed; expired records are deleted during hourly cleanup.

To demonstrate the request, confirmation and termination, we separately retain a pseudonymised email association value, product reference, event time and consent text version for 1,095 days from the event. This serves the statutory obligation to demonstrate consent and necessary legal defence (Article 6(1)(c) in conjunction with Article 7(1), and Article 6(1)(f) GDPR). The data is not anonymous and is not used for advertising.

Confirmation and product notification messages contain no opening pixels or click-tracking redirects. Technical sending and error information must be distinguished from this.

7.3 Google Analytics 4

With your statistics consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse use of our shop and improve our offering. In particular, page and usage events, technical device and browser information, approximate geographical information and pseudonymous identifiers are processed. Processing, including the cookies used for this purpose, is based on Article 6(1)(a) GDPR and section 165(3) TKG 2021. The appropriate data processing contractual terms with Google cover processing on our behalf.

Google states that GA4 does not log or store IP addresses. However, they may first be processed to derive geographical information. The remaining Analytics data is therefore not automatically anonymous.

In our Analytics property, retention is set to two months for event data and 14 months for user data. Resetting the user-related retention period on new user activity is enabled. Renewed activity may therefore extend the period. These settings do not apply equally to aggregated standard reports; cookie lifetimes must also be distinguished.

A transfer to Google LLC in the USA is possible. The Google transfer safeguards described in chapter 5 apply. You may withdraw consent through Cookie Settings. Further information: Google privacy policy, Google Analytics data retention.

7.4 Meta Pixel and Conversions API

With your marketing consent, we use Meta Pixel and the Meta Conversions API from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel transmits data from your browser; our server transmits event data to Meta through the Conversions API. The Cookiebot marketing selection is checked before server-side forwarding. Without the corresponding consent, no data is forwarded through this interface.

In particular, visit and purchase events, content or products concerned, order values, times, technical identifiers such as “fbp” and “fbc”, the IP address and browser identification and, where available, email addresses, telephone numbers or a contact identifier converted into hash values are processed. Hash values do not constitute anonymisation; they may enable Meta to associate data with users.

Processing serves to measure the effectiveness of our advertising, attribute purchases to advertising activities and display or optimise interest-based advertising. Meta may link the data with its own user data and process it for the advertising purposes described. Our processing is based on Article 6(1)(a) GDPR and, for applicable access to devices, section 165(3) TKG 2021. Placing an order does not constitute marketing consent.

Under the Meta Controller Addendum, joint controllership applies to the collection and transmission of event data to the extent specified there. Subsequent processing by Meta generally takes place under its own responsibility. The addendum regulates, in particular, responsibility for information, security and data subject rights; you may also exercise your rights against us.

Processing by Meta Platforms, Inc. in the USA is possible. Insofar as covered by the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision; otherwise, the applicable contractual safeguards apply. The duration of Meta’s independent retention depends, in particular, on the type and purpose of processing, use of Meta services and legal requirements. You may withdraw consent to our transfers through Cookie Settings.

Further information: Meta privacy policy, Meta Controller Addendum, Meta Business Tools Terms.

7.5 Visitor analytics in cloud-based systems

Following your express statistics consent, a separate function in our cloud-based systems records visits to selected public pages. Permission is additionally checked server-side. A random session identifier enables pseudonymous association of the recorded visits. These records are not linked to contacts, customer accounts or personal marketing profiles. Product detail pages, customer account areas and checkout areas are excluded from this function.

We analyse this data to improve our public website. The basis is your consent (Article 6(1)(a) GDPR and, for access to your device, section 165(3) TKG 2021). Processing takes place in the cloud-based systems described in chapter 2.1.

Visitor records are deleted 60 days after creation during daily cleanup. Withdrawal through Cookie Settings removes the current session and its page views. Other data sets, particularly necessary operational logs, are not covered by this.

8 Your rights

You may exercise your rights through privacy@maisonhautejoie.com or our postal address. You can also delete your customer account yourself online (chapter 5.1). Subject to the statutory requirements, you have the following rights:

• Access and a copy under Article 15 GDPR concerning your personal data and the associated processing information.

• Rectification of inaccurate data and completion of incomplete data under Article 16 GDPR.

• Erasure under Article 17 GDPR where no statutory exceptions apply, in particular necessary statutory retention or the establishment, exercise or defence of legal claims.

• Restriction of processing under Article 18 GDPR subject to the conditions specified there.

• Information about recipients under Article 19 GDPR: we notify recipients of rectification, erasure or restriction unless this is impossible or disproportionate. On request, we inform you about those recipients.

• Data portability under Article 20 GDPR for data you have provided, insofar as processing is based on consent or a contract and is carried out by automated means. Where technically feasible, you may request direct transmission to another controller.

• Withdrawal of consent under Article 7(3) GDPR at any time with future effect. The lawfulness of processing before withdrawal is unaffected. The respective withdrawal methods are described in chapters 3 and 7; you may also contact our privacy contact.

Objection to processing

Insofar as we process your data on the basis of Article 6(1)(f) GDPR, you may object under Article 21(1) GDPR on grounds relating to your particular situation. This also applies to profiling based on that provision. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or need the data for legal claims.

Where your data is processed for direct marketing, you may object to this processing at any time without giving reasons. This also applies to profiling insofar as it is related to such direct marketing. After your objection, the data will no longer be processed for these purposes.

Handling your requests and automated decisions

We generally respond to your requests free of charge and no later than one month after receipt. If a legally permitted extension of up to two further months applies, we inform you within the first month about the extension and its reasons. Where we have reasonable doubts about your identity, we may request further information necessary to confirm it. Statutory exceptions, particularly for manifestly unfounded or excessive requests, remain unaffected.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. The described advertising and analysis procedures subject to consent must be distinguished from this.

Right to lodge a complaint

If you consider that the processing of your personal data infringes the GDPR, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority. In particular, you may contact an authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

For our registered office in Austria, the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, can be reached at dsb@dsb.gv.at; further information is available at dsb.gv.at. You are not required to lodge your complaint in Austria. An overview, including Germany and France, is available from the European Data Protection Board.

9 Retention recipients and data transfers

9.1 Purpose-related retention

The retention period depends on the specific processing purpose. Special periods and criteria for technical services, Cookiebot, newsletters, product notifications and analytics procedures are provided in the respective chapters. Closing an account, unsubscribing or archiving does not mean that all data stored about a person is deleted.

For contract and support data, the relevant factors are, in particular, completion of performance and billing, handling withdrawals or complaints, outstanding questions and the need for evidence for specific potential claims. Data based solely on withdrawn consent may no longer be processed for that purpose afterwards. Insofar as another legal basis requires further limited retention, this is restricted to the information and purposes needed for it.

9.2 Statutory retention and evidence

We generally retain business documents, books and records for seven years to fulfil legal obligations (section 132 BAO, section 212 UGB; Article 6(1)(c) GDPR). The period generally begins at the end of the relevant calendar year. Special rules for different financial years and necessary extensions, for example during pending proceedings, remain applicable.

Where sales are declared through the EU One Stop Shop, the records necessary for this purpose must be retained for ten years from the end of the year of the relevant sales. This special period applies to the relevant OSS records and not generally to all customer or profile data.

We retain consent and withdrawal records insofar as necessary to meet the statutory accountability obligation (Article 6(1)(c) in conjunction with Article 7(1) GDPR). Additional necessary evidence serves our legitimate interest in legal defence (Article 6(1)(f) GDPR). The duration depends on the process, processing period, limitation periods and pending proceedings. Suppression information prevents renewed advertising for as long as the address remains in relevant mailing records. Special periods are set out in chapter 7.

9.3 Deletion and backups

When the purpose and retention grounds cease to apply, we delete or anonymise personal data through configured cleanup functions or reviews of data sets. Not all data is deleted automatically.

Backups enable recovery following data loss. Their retention depends on the backup cycle and necessity. Deletion in the live system does not simultaneously remove data from all backups. Backups may not be used for new advertising or other incompatible purposes.

9.4 Recipients and transfer safeguards

In addition to the recipients named for individual services, necessary data may be transmitted to payment and transport companies and, where required for the respective task, to tax and legal advisers and to authorities under statutory obligations. The legal basis depends on contract performance, legal obligations or our legitimate interest in proper advice and legal defence. Processors act within agreed instructions; independent controllers determine their own purposes and retention obligations for their activities.

When personal data is transferred from the EEA to a third country, the requirements of Articles 44 et seq. GDPR also apply. Where an adequacy decision under Article 45 GDPR covers the recipient and the relevant processing, the transfer is based on it. For US recipients, this applies only to the extent of relevant participation in the EU-U.S. Data Privacy Framework. Other transfers rely, in particular, on the contractually agreed EU standard contractual clauses under Article 46 GDPR and necessary supplementary measures. A registered office or data centre in the EU does not exclude access from third countries.

Information about the safeguards used for a specific transfer and a copy of the applicable safeguards can be requested through our privacy contact. Further information is also available in the directly linked notices of the respective providers.