Privacy Policy

The controller responsible for your personal data is:

• Legal entity: Maison Rocheval Pte. Ltd.
• Brand: Maison Rocheval

You can contact us, including our Data Protection Officer, about any privacy matter through the contact form on our website: maison-rocheval.com/contact.

Information you give us

• Identity and contact details: name, billing and shipping address, email, phone number.
• Order and transaction data: products purchased, order history, delivery preferences.
• Payment information: processed by our payment providers; we do not store full card numbers.
• Account credentials, if you create an account.
• Communications: messages you send us via the contact form, email, or customer service.
• Marketing preferences and any information you provide when subscribing.

Information collected automatically

• Device and usage data: IP address, browser type, operating system, referring pages, pages viewed, timestamps.
• Cookies and similar technologies (see Section 7).

Information from third parties

• Payment processors, fraud-prevention services, shipping and logistics partners, and analytics providers.

We do not intentionally collect special categories of data (e.g., health, religion, biometrics). Please do not submit such data to us.

We use your personal data to:

• Process and fulfil orders, arrange shipping, and handle returns.
• Take payment and prevent fraud.
• Provide customer support and respond to enquiries.
• Manage your account.
• Send transactional communications (order confirmations, delivery updates).
• Send marketing communications where you have consented or where otherwise permitted.
• Operate, secure, and improve the Site.
• Comply with legal, tax, accounting, and regulatory obligations.

We rely on the following legal bases under the GDPR:

Where we rely on legitimate interests, we have balanced those interests against your rights. You may object at any time (see Section 9).

We share personal data with:

• Service providers / processors: payment processors, shipping and cold-chain logistics partners, website hosting and infrastructure (Vercel Inc.), analytics providers (Google LLC for Google Analytics; Vercel Inc. for Vercel Analytics), email, and customer-service tools.
• Professional advisers: lawyers, accountants, auditors.
• Authorities: where required by law, regulation, or legal process.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We require processors to protect your data and to use it only on our instructions. We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising.

We operate across Singapore, the EU/France, the United States (including California), and Hong Kong, so your data may be transferred and stored outside your home country.

For transfers of EU/EEA or UK data to countries without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) and, where relevant, the UK Addendum. For transfers of Singapore data, we take reasonable steps to ensure a comparable standard of protection as required under the PDPA. A copy of the relevant safeguards is available on request via our contact form.

We use cookies and similar technologies to operate the Site, remember your preferences, and analyse traffic.

• Strictly necessary cookies — required for the Site to function.
• Analytics cookies — help us understand how visitors use the Site. We use:
  • Google Analytics (provided by Google LLC / Google Ireland Limited), which uses cookies and similar identifiers to measure traffic and usage. Google processes this data on our behalf; data may be transferred to the United States. See Google's Privacy Policy and how Google uses information from sites that use its services. You can opt out via the Google Analytics Opt-out Browser Add-on.
  • Vercel Analytics / Vercel Speed Insights (provided by Vercel Inc.), which measure Site traffic and performance. Vercel's Web Analytics is designed to operate without cookies and without tracking individuals across sites. See Vercel's Privacy Policy.

Where required (EU/EEA/UK), non-essential cookies — including Google Analytics — are set only after you consent via our cookie banner. You can also control cookies through your browser settings and by enabling Global Privacy Control (GPC) signals in your browser.

We keep personal data only as long as necessary for the purposes described, including to satisfy legal, tax, and reporting requirements. As a general rule:

• Order and transaction records: retained for 5 years to meet tax and accounting obligations.
• Account data: retained while your account is active, then deleted or anonymised.
• Marketing data: retained until you unsubscribe or withdraw consent.

When data is no longer needed, we securely delete or anonymise it.

If you are in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your local supervisory authority (in France, the CNIL; in the UK, the ICO).

To exercise any right, contact us via our contact form. We will respond within one month, as required by the GDPR.

This section applies to U.S. residents, including residents of California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws.

Categories of personal information we collect include identifiers (name, email, address), commercial information (purchase history), internet activity (browsing on the Site), approximate geolocation (from IP), and payment information. We collect these for the business purposes described in Section 3.

Depending on your state, you have the right to:

• Know / access the personal information we have collected about you.
• Delete personal information, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising.
• Limit the use of sensitive personal information, where applicable.
• Non-discrimination for exercising your rights.

We do not sell personal information for money and do not share it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals. To exercise any of these rights, contact us via our contact form. We will verify your identity before responding, and you may use an authorized agent.

Under the PDPA you may:

• Request access to your personal data and information about how it has been used or disclosed.
• Request correction of inaccurate or incomplete data.
• Withdraw consent to our collection, use, or disclosure of your personal data, on reasonable notice. Withdrawal may affect our ability to provide products or services to you.

We will respond to access and correction requests within the timeframes required under the PDPA. Our Data Protection Officer is responsible for ensuring our compliance and can be reached via our contact form.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration — including encryption in transit, access controls, and use of reputable processors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify you and the relevant authorities of a data breach where required by law.

The Site is not directed to children, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and we encourage you to review their policies.

We may update this Privacy Policy from time to time. We will post the updated version with a revised “Last updated” date and, where required, notify you of material changes.

For any questions, requests, or complaints regarding this policy or your personal data, please reach us through the contact form on our website: maison-rocheval.com/contact.