Privacy policy

Last updated: October 13, 2026

At MAISON MOONSIEUR, we process your personal data transparently and in compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD). This policy explains who processes your data, for what purpose, on what legal basis, for how long, to whom it is disclosed, and how you can exercise your rights.

1. Data Controller

Data Controller: MM FASHION COLLECTIVE, S.L. (trade name MAISON MOONSIEUR)
Tax Identification Number (NIF): B93889806
Registered address: Carrer d’Aragó, 217, 08007 Barcelona (Spain)
Privacy email: info@maisonmoonsieur.com
Phone: 640 35 94 30

2. Data We Process

Identification and contact data: full name, shipping and billing address, phone number, and email address.
Customer account: email, password (encrypted), saved addresses, and preferences.
Orders: purchased products, sizes, amounts, returns, exchanges, and incidents.
Payment: payment method and transaction confirmation. MAISON MOONSIEUR does not access your full card number: it is handled directly by the payment gateways.
Communications: the content of any inquiries or communications sent to us.
Browsing data: IP address, device, browser, and interaction with the website, obtained through cookies in accordance with the Cookie Policy.
Marketing: email opens, clicks, and shopping preferences, if you have subscribed to our communications.

Fields marked as mandatory in forms are necessary to fulfill your request or order. If not provided, we will be unable to process it.

3. Purposes, Legal Basis, and Retention Period

Purpose	Legal basis (Art. 6.1 GDPR)	Retention
Manage orders, payments, shipments, exchanges, returns, and warranties	Performance of a contract (point b) and legal obligation (point c)	For the duration of the relationship and thereafter until the expiration of statutory limitation periods for legal actions derived from the contract
Create and manage your customer account	Performance of a contract (point b)	While the account is active or until you request its erasure
Issue invoices and comply with accounting and tax obligations	Legal obligation (point c)	6 years (Art. 30 Commercial Code)
Handle customer service inquiries and requests	Performance of a contract or pre-contractual measures (point b) and legitimate interest (point f)	The time necessary to respond and thereafter until statutory limitation periods expire
Send the email newsletter	Consent (point a) and Art. 21 LSSI	Until unsubscribed
Send existing customers offers for products similar to those purchased	Legitimate interest (point f) and Art. 21.2 LSSI	Until you object
Measure website usage and display personalized advertising via cookies	Consent (point a)	According to the Cookie Policy
Prevent fraud and protect website security	Legitimate interest (point f)	The time necessary for that purpose

We may group subscribers based on their purchases or interests to send them more relevant communications. We do not make decisions based solely on automated processing that produce legal effects concerning you.

When data is no longer necessary, it will be retained in a blocked state solely for the applicable statutory limitation periods and subsequently deleted (Art. 32 LOPDGDD).

4. Commercial Communications

We will only send you the newsletter if you have given us your consent by ticking the corresponding box, which will never be pre-ticked. If you are already a customer, we may send you offers for products similar to those you purchased, unless you object.

You can unsubscribe at any time, free of charge, via the link included in each email or by writing to info@maisonmoonsieur.com. You will continue to receive necessary operational messages to manage your orders or account.

5. Recipients

We do not sell your data. We only disclose it to:

Suppliers who process data on our behalf (Data Processors), under a contract in accordance with Art. 28 GDPR:

Shopify International Limited (Ireland): online store platform and hosting.
Klaviyo, Inc. (USA): email communication delivery.
Transport and courier companies: delivery and collection of orders.
Accounting and tax advisors, and IT service providers.

Payment entities processing the payment method selected for the purchase. Some, such as PayPal, process data as independent data controllers under their own privacy policies.
Social networks and advertising providers listed in the Cookie Policy, only if you accept advertising cookies. In the case of Meta Platforms Ireland Limited (Instagram and Facebook), MAISON MOONSIEUR and Meta act as joint controllers for the collection and transmission of such data; Meta is solely responsible for subsequent processing.
Public administrations, courts, and tribunals, when a legal obligation exists.

6. International Transfers

Some suppliers may process data outside the European Economic Area. In such cases, transfers are based on an adequacy decision of the European Commission (for example, for Canada or for US entities adhering to the EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the Commission (Art. 46 GDPR). You can request information regarding these safeguards at info@maisonmoonsieur.com.

7. Your Rights

You may exercise the following rights at any time:

Access: know what personal data we process about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request the deletion of your data.
Objection: object to data processing, particularly for direct marketing.
Restriction of processing: request that we restrict processing of your data under certain circumstances.
Data Portability: receive your data in a structured format or request its transmission to another controller.
Withdrawal of consent: without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, write to info@maisonmoonsieur.com stating the right you wish to exercise. If we have reasonable doubts regarding your identity, we may request additional information to confirm it. We will respond within one month, which may be extended by two further months in complex cases (Art. 12.3 GDPR).

If you consider that we have not properly addressed your request, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Minors

The store is intended for individuals over 18 years of age. We do not process data of minors under 14 years old without the consent of their parents or legal guardians (Art. 7 LOPDGDD). If we detect that such processing has occurred, we will delete the data.

9. Security

We implement technical and organizational measures appropriate to the level of risk to protect your data, such as encrypted connections (HTTPS) and access controls. We recommend using a secure password and keeping it confidential.

10. Changes to This Policy

We may update this policy to adapt it to legal changes or modifications to our services. We will publish the new version with its date and, if the change is material, notify you by email.