Privacy Policy

Last updated: June 16, 2026

The website maisonbrassel.com and the Maison Brassel brand are operated by Creato, a sole proprietorship with its registered office at 16 Rue de la Montagne, 44100 Nantes, France (SIRET: 98204874600019, registration: 982 048 746 RCS Nantes, EU VAT number: FR73982048746).

Creato (hereinafter "we," "our," or "Maison Brassel") is deeply committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you browse our website or place an order, in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), French Law No. 78-17 of January 6, 1978, as amended (the "Informatique et Libertes" Act), and Directive 2002/58/EC (the ePrivacy Directive).

1. Identity and Contact Details of the Data Controller

The data controller responsible for your personal data is Creato.

Registered office: 16 Rue de la Montagne, 44100 Nantes, France
SIRET: 98204874600019
RCS: 982 048 746 RCS Nantes
EU VAT number: FR73982048746
Email: contact@maisonbrassel.com
Phone: +33 7 80 93 63 60
Website: https://maisonbrassel.com

The publication director is the legal representative of Creato.

2. Personal Data We Collect

When you browse our website and place orders, we may collect the following categories of personal data:

2.1 Identity and Contact Data

First and last name
Mailing address (shipping address and, where applicable, billing address)
Email address
Phone number

2.2 Order Data

Order details (products ordered, quantities, amounts)
Order and return history
Shipping address
Customer service correspondence

2.3 Payment Data

Payment data (credit card number, authentication credentials) is collected and processed directly by our secure payment providers (Shopify Payments, PayPal, Klarna, Apple Pay, Bancontact). We do not store your full banking information on our servers. We only receive a payment confirmation and, where applicable, the last four digits of your credit card for order tracking purposes.

2.4 Browsing and Technical Data

IP address
Browser type and version
Operating system
Pages visited, visit duration, browsing path
Data collected through cookies and trackers (see Section 10, "Cookies," below)

2.5 Marketing Communication Data

Email address (newsletter subscription)
Communication preferences
Email open and click history (via our email marketing tool)

3. Purposes and Legal Bases for Processing

In accordance with Article 6 of the GDPR, each data processing activity relies on a specific legal basis. The table below outlines the purposes of our processing activities and their respective legal bases:

3.1 Performance of the Contract (Article 6(1)(b) of the GDPR)

Processing and tracking your orders (watch straps and accessories)
Delivering the products you ordered
Managing payments (by credit card, Apple Pay, PayPal, Klarna, Bancontact, or interest-free installment payments)
Handling after-sales service, returns, and refunds
Managing the customer relationship and responding to your inquiries
Creating and managing your customer account, where applicable

3.2 Legal Obligation (Article 6(1)(c) of the GDPR)

Retaining invoices and accounting records (in compliance with tax and accounting obligations)
Responding to requests from administrative or judicial authorities
Managing the exercise of the right of withdrawal (Articles L221-18 et seq. of the French Consumer Code)
Enforcing the legal guarantee of conformity (Articles L217-3 et seq. of the French Consumer Code) and the warranty against hidden defects (Articles 1641 et seq. of the French Civil Code)

3.3 Legitimate Interest (Article 6(1)(f) of the GDPR)

Improving our website, products, and services
Preventing fraud and securing transactions
Statistical analysis of website traffic (audience measurement)
Managing potential disputes

3.4 Consent (Article 6(1)(a) of the GDPR)

Sending newsletters and commercial communications by email
Placing non-essential cookies (marketing cookies, social media cookies, optional functional cookies)
Displaying personalized advertisements

You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal (see Section 8 below).

3.5 Mandatory vs. Optional Nature of Data Provided

Data marked with an asterisk in our forms is required to process your order or request. Providing this data is a contractual requirement: without it, we will be unable to process your order, arrange delivery, or respond to your request.

All other data is optional and helps us enhance your experience (for example, by personalizing our communications).

3.6 Automated Decision-Making and Profiling

We do not carry out any processing based solely on automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR.

Marketing and advertising cookies (see Section 10) may involve limited profiling (analysis of your browsing habits) solely for the purpose of displaying relevant advertisements, subject to your prior consent. This profiling does not produce any legal effects with respect to you and does not result in any automated decision-making.

4. Recipients and Processors

Your personal data may be shared with the following categories of recipients, strictly to the extent necessary for the purposes described above:

4.1 Hosting Provider and E-Commerce Platform

Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland) hosts our website and processes data as a processor within the meaning of Article 28 of the GDPR. Shopify may also act as a payment provider through Shopify Payments.

4.2 Payment Providers

The data required to process your payments is transmitted to our secure payment providers (Shopify Payments, PayPal, Klarna, Apple Pay, Bancontact), which act as processors or joint controllers depending on the circumstances. These providers are PCI-DSS certified and/or comply with applicable security standards.

4.3 Carriers

Your identity data and shipping address are shared with the carriers responsible for delivering your orders.

4.4 Email and Marketing Tools

Your email address and communication preferences may be shared with our email marketing service providers, which act as processors, for the purpose of sending our newsletters and commercial communications (subject to your consent).

4.5 Competent Authorities

Your data may be disclosed to administrative or judicial authorities when required by law.

We do not sell your personal data to third parties. All our processors are contractually required to handle your data in compliance with the GDPR and our instructions.

5. Data Transfers Outside the European Union

Some of our processors (including Shopify, PayPal, Klarna, and our email marketing tools) may transfer your personal data outside the European Union and the European Economic Area, particularly to Canada and the United States.

These transfers are governed by appropriate safeguards in accordance with Articles 44 to 49 of the GDPR, including:

Standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914 of June 4, 2021), ensuring an adequate level of protection for your data
Adequacy decisions issued by the European Commission, where applicable (including the adequacy decision for Canada for processing subject to PIPEDA)

You may obtain a copy of the safeguards in place by contacting us at contact@maisonbrassel.com.

6. Data Retention Periods

Your personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, then archived or deleted in accordance with applicable legal requirements:

Customer and order data: for the duration of the business relationship, then archived for 5 years from the date of the last order (standard civil statute of limitations, Article 2224 of the French Civil Code)
Accounting records and supporting documents: 10 years from the close of the fiscal year (Article L123-22 of the French Commercial Code)
Data related to the right of withdrawal and returns: for the time needed to process the return, then archived for 5 years
Data related to legal warranties: for the duration of the legal guarantee of conformity (2 years from delivery of the product, Articles L217-3 et seq. of the French Consumer Code) and, where applicable, for the duration of the warranty against hidden defects (2 years from discovery of the defect, Article 1648 of the French Civil Code)
Marketing data (newsletter): 3 years from the last active contact (email open, click, or purchase), or until withdrawal of your consent
Browsing data and cookies: see Section 10 below
Data related to rights exercise requests: for the time needed to process the request, then archived for 5 years for evidentiary purposes

At the end of these retention periods, your data is permanently deleted or irreversibly anonymized.

7. Data Security

We implement appropriate technical and organizational measures to ensure the security and confidentiality of your personal data, in accordance with Article 32 of the GDPR, including:

Encryption of all communications using the HTTPS/TLS protocol across the entire website
Secure hosting of your data by Shopify, which implements industry-standard security measures (SOC 2 certification, encryption of data at rest and in transit)
Secure payment processing by PCI-DSS-certified providers
Restricting access to personal data to authorized individuals only, based on their responsibilities
Implementing security incident management procedures

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Articles 33 and 34 of the GDPR.

8. Your Rights

Under the GDPR (Articles 15 to 22) and the Informatique et Libertes Act, you have the following rights regarding your personal data:

Right of access (Article 15 of the GDPR): you may obtain confirmation as to whether your data is being processed and, if so, access that data and receive a copy
Right to rectification (Article 16 of the GDPR): you may request the correction of inaccurate or incomplete data concerning you
Right to erasure (Article 17 of the GDPR): you may request the deletion of your data, subject to legal retention obligations
Right to restriction of processing (Article 18 of the GDPR): you may request the restriction of processing of your data in the circumstances provided for by the GDPR
Right to object (Article 21 of the GDPR): you may object to the processing of your data based on legitimate interest, including profiling. You also have an absolute right to object to the processing of your data for direct marketing purposes
Right to data portability (Article 20 of the GDPR): you may request to receive your data in a structured, commonly used, and machine-readable format, or request its transfer to another data controller
Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before such withdrawal. For the newsletter, you may unsubscribe by clicking the link provided in each email
Right to define instructions regarding the handling of your data after your death (Article 85 of the Informatique et Libertes Act): you may define general or specific instructions regarding the retention, deletion, and disclosure of your data after your death

How to Exercise Your Rights

You may exercise any of these rights by contacting us:

By email: contact@maisonbrassel.com
By mail: Creato, 16 Rue de la Montagne, 44100 Nantes, France

To process your request, we may ask you to verify your identity. We are committed to responding to your request within one month of receipt, in accordance with Article 12 of the GDPR. This period may be extended by up to two additional months in cases of complexity or a high volume of requests, in which case we will inform you accordingly.

9. Filing a Complaint with the CNIL

If you believe, after contacting us, that your data protection rights have not been upheld, you have the right to file a complaint with the Commission Nationale de l'Informatique et des Libertes (CNIL), the competent supervisory authority in France:

CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Website: www.cnil.fr
Phone: +33 1 53 73 22 22

10. Cookies and Trackers

When you browse the maisonbrassel.com website, cookies and other trackers may be placed on your device (computer, smartphone, tablet). This section explains how these cookies are used, in accordance with Article 82 of the Informatique et Libertes Act, the CNIL's guidelines and recommendations on cookies and other trackers, and the ePrivacy Directive (2002/58/EC).

10.1 What Is a Cookie?

A cookie is a small text file stored on your device when you visit a website. It allows the site to remember information about your browsing session (pages visited, preferences, session identifiers, etc.).

10.2 Categories of Cookies We Use

We use the following categories of cookies:

a) Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be disabled. They enable features such as shopping cart management, authentication, website security, and remembering your cookie consent choices. These cookies do not require your prior consent.

b) Audience Measurement Cookies (Analytics)

These cookies allow us to measure website traffic, analyze browsing patterns, and improve the performance and content of the site. The data collected is aggregated and anonymized to the extent possible. These cookies require your consent, except when they meet the exemption conditions set out in the CNIL's guidelines (purpose limited to audience measurement, no cross-referencing of data, prior information provided, and the ability to opt out).

c) Functional Cookies

These cookies enhance your browsing experience by remembering your preferences (language, region, display personalization). They require your prior consent.

d) Marketing and Advertising Cookies

These cookies are used to serve relevant, personalized advertisements, measure the effectiveness of our advertising campaigns, and limit the number of times a given ad is displayed. They require your prior consent.

e) Social Media Cookies

These cookies are placed by third-party social media platforms and enable content sharing on those platforms, display of embedded content, and tracking of your browsing for advertising purposes. They require your prior consent.

10.3 Cookie Consent

On your first visit to the website, a cookie consent banner is displayed. It allows you to accept or decline, either globally or by category, the placement of non-essential cookies.

You may change your cookie preferences at any time by accessing our cookie management module, available through the link at the bottom of every page on the site.

Declining non-essential cookies does not prevent you from browsing the site or placing an order.

10.4 Retention Periods

Cookie consent: your choice (acceptance or refusal) is stored for a period of 6 to 13 months. After this period, your consent will be requested again.
Trackers placed: the lifespan of cookies and trackers placed on your device does not exceed 13 months from the date they are set.
Audience measurement data: data collected through audience measurement cookies is retained for a maximum of 25 months.

10.5 Managing Cookies Through Your Browser

Independently of our cookie management module, you can configure your browser to accept or reject cookies. Each browser offers different settings. We encourage you to consult your browser's help section for more information:

Please note that deleting or blocking certain cookies may affect your browsing experience and limit access to some features of the website.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in legislation, regulations, or our practices. Any changes will be posted on this page with an updated date at the top of the document. In the event of a material change, we may notify you by email or through a notification on the website.

We encourage you to review this page regularly to stay informed of any updates.

12. Contact

For any questions about this Privacy Policy or the processing of your personal data, you may contact us:

By email: contact@maisonbrassel.com
By phone: +33 7 80 93 63 60
By mail: Creato, 16 Rue de la Montagne, 44100 Nantes, France