Privacy Policy

Last updated: [to be completed]

MAISON 1822 attaches particular importance to protecting the data of its customers and visitors. This policy explains what data we collect, why, how long we keep it, and what rights you can exercise.

WHO IS RESPONSIBLE FOR YOUR DATA

Depending on your country of residence, the data controller differs:

The two entities act as joint controllers where processing operations are shared (catalogue, customer accounts, international customer service).

DATA PROTECTION OFFICER

The Data Protection Officer (DPO) for the GDPR and the encarregado de dados for the LGPD may be contacted at the following address:

The LGPD requires the identity and contact details of the encarregado to be published clearly and in an easily accessible manner on the site.

WHAT DATA WE COLLECT

• Identity and contact details — surname, first name, email address, telephone, delivery and billing addresses.
• Date of birth or confirmation of legal age — mandatory for the sale of alcohol.
• Order data — purchase history, amounts, payment methods (we do not store any bank card number, as this is processed directly by our payment providers).
• Business data — for B2B partners: company name, identification number, business sector, volumes.
• Browsing data — IP address, device type, pages viewed, via cookies and trackers.
• Correspondence — the content of messages sent through our forms.

WHY AND ON WHAT BASIS

• Performance of the contract — order processing, delivery, invoicing, after-sales service.
• Legal obligation — retention of invoices, verification of legal age, tax and customs obligations relating to alcohol.
• Consent — newsletter, non-essential cookies, commercial communications.
• Legitimate interest — site security, fraud prevention, improvement of our services.

The LGPD provides for equivalent legal bases in its article 7: performance of the contract, compliance with a legal obligation, consent and legitimate interest.

FOR HOW LONG

• Customer account — for the entire duration of the relationship, then [to be completed] years after the last activity.
• Accounting documents and invoices — 10 years in France, 5 years in Brazil.
• Proof of age verification — [to be completed].
• Prospects and newsletter — 3 years from the last contact.
• Cookies — 13 months maximum.

WHO WE SHARE WITH

Your data is never sold. It is shared only with the providers necessary to our business, bound by contractual confidentiality commitments:

• Shopify, for hosting the store and processing orders.
• Payment providers.
• Carriers and freight forwarders, for delivery and customs clearance.
• Tax and customs authorities, where the law requires it.
• [to be completed: other tools used — emailing, analytics, customer service]

INTERNATIONAL TRANSFERS

As our business is transatlantic, your data may be transferred between the European Union and Brazil, as well as to other countries where our providers are established.

These transfers are governed by the European Commission's standard contractual clauses for transfers outside the EU, and by the mechanisms provided for in chapter V of the LGPD for international transfers from Brazil.

YOUR RIGHTS

Depending on your place of residence, you have the following rights:

• Access — to know what data we hold about you and to obtain a copy of it.
• Rectification — to correct inaccurate or incomplete data.
• Erasure — to request the deletion of your data, subject to our legal retention obligations.
• Restriction — to request that a processing operation be frozen.
• Objection — to object to processing based on legitimate interest, and at any time to commercial prospecting.
• Portability — to receive your data in a structured and readable format.
• Withdrawal of consent — at any time, without retroactive effect.
• Anonymisation or blocking — a specific right provided for by the LGPD for data processed in a non-compliant manner.
• Information on sharing — to know the public and private entities with which your data has been shared, an express right under the LGPD.

To exercise these rights, write to [to be completed: DPO email address]. We respond within one month for the GDPR, and as promptly as possible for the LGPD.

COMPLAINT

If you consider that your rights are not being respected, you may refer the matter to the competent supervisory authority:

• France — Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
• Brazil — Autoridade Nacional de Proteção de Dados (ANPD).

SECURITY

We implement appropriate technical and organisational measures: encryption of communications, access control, hosting with a provider compliant with industry standards, staff awareness training.

In the event of a data breach likely to result in a high risk, we inform the competent authorities and the data subjects concerned within the legal time limits.

MINORS

This site is intended exclusively for persons of legal age. We do not knowingly collect data concerning minors. If you notice that a minor has sent us data, please report it to us: it will be deleted without delay. See our policy on the protection of minors.

CHANGES

This policy may change. Any substantial modification will be flagged on the site and, where applicable, notified by email.

Please drink responsibly. Sale prohibited to persons under 18.