Privacy Policy
Last updated: 25 September 2026
Maison M'authentique takes the protection of your personal data very seriously. This policy explains what data we collect, why and on what legal basis, how long we keep it, who we share it with and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Who is responsible for your data?
The data controller is SYHEA Group, a SAS with share capital of 5 000 €, whose registered office is at 8 Rue des Epinettes, 78630 Morainvilliers, France, registered with the Trade and Companies Register of Versailles under number 108 063 801, which operates the Maison M'authentique brand.
For any question about your personal data, write to us at contact@mauthentique.com or by post to the address above. Given its size and activity, the company has not appointed a data protection officer.
2. What data, for what purpose and for how long?
We only collect the data needed for each purpose. Mandatory fields are indicated in the forms: without them, we cannot process your request.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Processing, delivering and invoicing your orders; after-sales service, returns and guarantees | First and last name, email, phone, delivery address, order contents and amount, payment status | Performance of the contract | 10 years from the order (accounting and tax obligations), then deletion |
| Secure payment and fraud prevention | Payment data, entered directly with our provider Stripe (we never see or store your card number), IP address | Performance of the contract; legitimate interest (fraud prevention) | Payment attempts: 30 days. Data kept by Stripe according to its own legal obligations |
| Managing your customer account | Email, password (encrypted, never readable), first and last name, phone, saved addresses, favourites | Performance of the contract | Until you delete your account, which you can do at any time from your customer area. Accounts with no sign-in or order for 3 years: automatic deletion |
| Newsletter and offers | Email, language | Consent, confirmed by email (double opt-in) | Until you unsubscribe: your address is then deleted immediately. Unconfirmed request: no data kept |
| Replying to your messages (contact form, emails) | Name, email, subject and content of the message | Legitimate interest (answering your requests) or pre-contractual measures | As long as needed to handle your request, then 3 years maximum in our mailbox |
| Single-use promotional codes | Email, code used, related order | Legitimate interest (preventing repeated use of the same code) | 3 years |
| Protecting forms against automated submissions (reCAPTCHA) | IP address, technical browser data, interactions with the page when submitting | Legitimate interest (site security) | Processed by Google under its own rules; the service is only loaded when you submit a protected form |
| Audience measurement (Google Analytics) | Pages viewed, visit duration, source, technical identifier (cookie) | Consent (cookie banner) | Cookies: 13 months. Statistics: 14 months maximum |
| Address suggestions while typing | Characters typed in the address field | Legitimate interest (making entry easier) | Not stored by us (French public Base Adresse Nationale service) |
| Site security and proper operation | IP address, technical logs | Legitimate interest (security) | Logs kept by our hosting providers for a limited period (a few days to a few weeks) |
| Handling disputes and complying with our legal obligations | Data needed to defend our rights or requested by the authorities | Legal obligation; legitimate interest | Duration of the proceedings and limitation periods |
These periods are applied automatically: a daily process deletes payment attempts older than 30 days, promotional code history older than 3 years and accounts inactive for 3 years.
3. Who has access to your data?
Your data is intended for SYHEA Group and only for the people who need it to process your order. We never sell or rent your data. It is shared, strictly as needed, with the following providers, bound by contract and acting on our instructions:
| Provider | Role | Data location |
|---|---|---|
| Supabase | Database hosting and customer account management | European Union (Frankfurt, Germany); company based in the United States |
| Vercel | Website hosting and server-side processing | European Union (Frankfurt, Germany) and global delivery network; company based in the United States |
| Stripe | Online payment and fraud prevention | European Union (Stripe Payments Europe, Ireland); transfers to the United States possible |
| Resend | Sending emails (order confirmation and tracking, newsletter) | European Union (Ireland); company based in the United States |
| Form protection (reCAPTCHA) and, if you accept it, audience measurement (Google Analytics) | European Union and United States | |
| Base Adresse Nationale (French State) | Address suggestions while typing | France |
| Carriers | Delivering your orders (name, address, phone) | Depending on the carrier handling your shipment |
Your data may also be shared with the consumer mediator (CM2C) if you refer a matter to them, with our advisers (accountant, lawyer), who are bound by professional secrecy, and with authorities making a lawful request.
4. Transfers outside the European Union
Our data is hosted in the European Union. Some providers (Supabase, Vercel, Stripe, Resend, Google) are US companies or belong to US groups: access from the United States therefore cannot be ruled out. These transfers are governed by the standard contractual clauses adopted by the European Commission and, for certified companies, by the EU–US Data Privacy Framework. You can obtain a copy of these safeguards by writing to us.
5. Security
We implement appropriate technical and organisational measures: encrypted connection (HTTPS), passwords never stored in plain text, strict access separation (each customer can only access their own information), limited administrative access, and payment handled by a PCI DSS certified provider. In the event of a data breach posing a risk to you, we would notify the CNIL and, where necessary, the people concerned, as required by the GDPR.
6. Cookies
The cookies and trackers used on the site, and how to accept or refuse them, are described in our cookie policy.
You can change your choices at any time using the “Manage cookies” link at the bottom of every page.
7. Your rights
You have the following rights over your data:
- Right of access and rectification: view and correct your data, in particular from your customer area.
- Right to erasure: ask for your data to be deleted. You can delete your account yourself from your customer area (“My information”).
- Right to data portability: receive your data in a reusable format. You can download it from your customer area (“My information”).
- Right to object: object to processing based on our legitimate interest, and at any time to direct marketing (unsubscribe link in every email).
- Right to restriction: ask for the use of your data to be temporarily frozen.
- Withdrawal of consent: at any time (newsletter: unsubscribe link; cookies: “Manage cookies”), without affecting processing already carried out.
- Post-mortem instructions: decide what happens to your data after your death.
To exercise these rights, write to us at contact@mauthentique.com or by post to 8 Rue des Epinettes, 78630 Morainvilliers, France. We reply within one month, which may be extended by two months for complex requests. If we have reasonable doubts about your identity, we may ask you for proof of identity.
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
8. Minors
The site is intended for adults. We do not knowingly collect data about children under 15.
9. Changes to this policy
This policy may change, in particular to reflect a new service or a change in the law. The date of the last update is shown at the top of this page; we will inform you of any significant change.