Privacy policy
Last updated: September 5, 2026
This Privacy Policy describes how Madame & Son (“we”, “us”, or “our”) collects, uses, stores, and shares your personal information when you visit, use our services, make a purchase from our online store, or otherwise communicate with us.
Our online store is hosted by Shopify.
By using our website, you acknowledge that your personal information may be processed as described in this Privacy Policy.
1. Controller
The controller responsible for the processing of personal data in accordance with the General Data Protection Regulation (“GDPR”) is:
Madame & Son
Davina Schell
Lahngärten 6, 35576 Wetzlar
Germany
Email: madameandson@outlook.com
If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact us using the details above.
2. Personal Information We Collect
Depending on how you interact with our store, we may collect the following categories of personal information:
Contact Information
This may include:
- name
- billing address
- shipping address
- email address
- telephone number
Order and Transaction Information
When you make a purchase, we may process information including:
- products ordered
- order number
- purchase history
- payment status
- shipping information
- returns, refunds, or cancellations
Payment Information
Payments are processed through Shopify and/or the payment provider selected during checkout.
Depending on the payment method you choose, the relevant payment provider may process information such as payment card details, account information, transaction information, or billing information.
We generally do not receive or store your complete payment card details ourselves.
Account Information
If customer accounts are available and you create an account, we may process your login information, account preferences, order history, and other information associated with your account.
Communications
If you contact us by email, contact form, social media, or another communication channel, we may process the information you provide to us as part of that communication.
Device and Usage Information
When you visit our website, certain technical information may be processed automatically, including:
- IP address
- browser type
- device type
- operating system
- device identifiers
- pages viewed
- referring website
- interactions with our website
- date and time of access
- cookie and similar technology identifiers
3. How We Use Your Personal Information
We may process personal information for the following purposes:
Processing and Fulfilling Orders
We use personal information to:
- process your order
- receive and confirm payment
- produce and fulfil products
- arrange shipping and delivery
- send order confirmations and updates
- process returns, refunds, or complaints
The legal basis is generally Article 6(1)(b) GDPR, where processing is necessary to perform a contract with you or take steps at your request before entering into a contract.
Customer Service
We process information to respond to questions, provide customer support, resolve problems, and communicate with you regarding your order or our services.
Depending on the circumstances, the legal basis is Article 6(1)(b) GDPR or our legitimate interests pursuant to Article 6(1)(f) GDPR.
Legal and Accounting Obligations
Certain information relating to transactions may be retained where necessary to comply with tax, accounting, commercial, consumer protection, or other legal requirements.
The legal basis is Article 6(1)(c) GDPR.
Fraud Prevention and Security
We may process certain information where necessary to protect our store, customers, systems, and transactions from fraud, abuse, security incidents, and other unlawful activity.
The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Marketing
Where permitted by law, we may use your contact information to send you newsletters, product announcements, promotions, or other marketing communications.
Where consent is required, processing is based on Article 6(1)(a) GDPR.
You may withdraw your consent at any time, for example by using the unsubscribe link contained in our marketing emails.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
4. Shopify
Our store is hosted by Shopify, which provides the ecommerce platform that enables us to offer our products and services.
When you visit our store or make a purchase, personal information may therefore be processed by Shopify in connection with hosting, checkout, payments, fraud prevention, analytics, security, customer functionality, and other ecommerce services.
For customer data processed on our behalf, we generally determine the purposes of processing and Shopify acts as a service provider or processor. Certain Shopify services may involve Shopify processing information as an independent controller under its own terms and privacy documentation. Shopify expressly distinguishes between these different processing roles.
Shopify is a Canadian company and operates internationally. For users in the European Economic Area, the United Kingdom, and Switzerland, Shopify states that personal information may be received by Shopify International Ltd. in Ireland and subsequently processed by Shopify entities and service providers in other countries, including Canada and the United States, subject to applicable transfer safeguards.
More information about Shopify's processing of personal information can be found in Shopify's Privacy Policy.
5. Payment Providers
When you choose a payment method during checkout, personal information necessary to complete your payment may be transmitted to the relevant payment service provider.
The information processed depends on the payment method you select and may include:
- name
- billing address
- email address
- transaction amount
- currency
- payment information
- transaction identifiers
The payment provider may process certain information under its own responsibility and according to its own privacy policy.
We only process payment information to the extent necessary to complete and administer your transaction.
6. Shipping and Fulfilment
To fulfil and deliver your order, we may share information with shipping, production, fulfilment, logistics, and delivery service providers.
This information may include:
- your name
- shipping address
- email address
- telephone number where necessary
- order information
- products purchased
Information is shared only to the extent reasonably necessary to produce, fulfil, ship, or deliver your order.
The legal basis is Article 6(1)(b) GDPR.
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Cookies are small files stored on your device or information accessed from your device when you visit a website.
Some cookies are necessary for the website and online store to function properly. These may be used for purposes such as:
- shopping cart functionality
- checkout
- security
- fraud prevention
- customer login
- remembering privacy preferences
Other technologies may be used for analytics, advertising, marketing, personalization, or measurement.
Where required by applicable law, non-essential cookies and similar technologies are used only after you have provided consent.
For users in Germany, storing information on or accessing information from a user's device may additionally be subject to Section 25 TDDDG, unless the technology is strictly necessary to provide a service expressly requested by the user.
You may manage your choices using the cookie/privacy banner or privacy settings provided on our website.
You may also delete or block cookies through your browser settings, although disabling essential cookies may affect the operation of the website.
8. Analytics and Advertising
Depending on the technologies enabled in our store, we may use analytics or advertising tools to understand how visitors use our website, measure the effectiveness of advertising, improve our store, or display relevant advertising.
Where such processing requires consent, these services are activated only after consent has been obtained.
You may withdraw or modify your consent at any time through the privacy or cookie settings available on our website.
9. When We Share Personal Information
We may disclose personal information to third parties where necessary for the operation of our business, including:
- Shopify
- payment processors
- production and fulfilment providers
- shipping and logistics providers
- IT and hosting providers
- customer support providers
- email and marketing service providers
- analytics providers, where enabled
- professional advisers such as accountants, tax advisers, or lawyers
- public authorities where required by law
We do not disclose personal information to third parties without a legal basis.
We may also disclose information where necessary to comply with a legal obligation, enforce our rights, prevent fraud, protect our customers, or respond to lawful governmental requests.
10. International Data Transfers
Some of the service providers we use may process personal information outside Germany or the European Economic Area (“EEA”).
Where personal information is transferred to a country that has not been recognized by the European Commission as providing an adequate level of data protection, we take appropriate measures as required by applicable law.
These measures may include:
- European Commission Standard Contractual Clauses
- adequacy decisions
- other legally recognized transfer mechanisms
Shopify itself operates internationally and states that European customer information may be transferred to locations including Canada and the United States in accordance with applicable data-protection requirements.
11. Data Retention
We retain personal information only for as long as necessary for the purposes for which it was collected.
The retention period depends on factors including:
- whether we need the information to fulfil a contract
- statutory accounting and tax retention requirements
- legal limitation periods
- fraud and security requirements
- whether you have an active customer account
- whether you have consented to marketing communications
Where information is no longer required and no legal obligation requires us to retain it, it will be deleted or anonymized.
12. Your Rights Under the GDPR
If the GDPR applies to you, you may have the following rights regarding your personal information:
Right of Access
You may request information about whether and how we process your personal information and obtain a copy of that information.
Right to Rectification
You may request correction of inaccurate personal information or completion of incomplete information.
Right to Erasure
You may request deletion of your personal information where the legal requirements for deletion are met.
Right to Restriction of Processing
You may request that processing of your personal information be restricted in certain circumstances.
Right to Data Portability
Where applicable, you may request personal information that you have provided to us in a structured, commonly used, machine-readable format.
Right to Object
Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may have the right to object to that processing for reasons relating to your particular situation.
Where personal information is processed for direct marketing purposes, you may object to such processing at any time.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
Right to Lodge a Complaint
You also have the right to lodge a complaint with a competent data protection supervisory authority.
In Germany, you may contact the data protection authority responsible for the federal state in which our business is established.
13. Automated Decision-Making
Where automated systems are used for purposes such as fraud detection or payment risk assessment, such processing may be carried out by Shopify, payment providers, or other service providers.
Where legally required, you may have rights relating to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
14. Children's Privacy
Our products and services are not intended for children who are not legally able to enter into contracts independently.
We do not knowingly collect personal information from children in violation of applicable law.
If you believe that a child has provided us with personal information unlawfully, please contact us so that we can review and, where appropriate, delete the information.
15. Security
We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.
However, no transmission over the internet or electronic storage method can be guaranteed to be completely secure.
16. External Links
Our website may contain links to websites or services operated by third parties.
We are not responsible for the privacy practices of third-party websites. We recommend reviewing the applicable privacy policy before providing personal information to a third-party service.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect:
- changes to our business
- changes to services or technologies we use
- legal or regulatory developments
- changes to Shopify or other service providers
The current version will be published on this website together with the date of the latest update.
18. Contact
For questions regarding this Privacy Policy, requests relating to your personal information, or the exercise of your data protection rights, please contact:
Madame & Son
Davina Schell
Lahngärten 6, 35576 Wetzlar
Germany
Email: madameandson@outlook.com