Cookie Policy

1.1 Scope. This policy applies to cookies and comparable technologies used through maisonthefive.com and the connected EU retail checkout, including browsing, search, cart, sign-in, account, forms, newsletter, payment, order-tracking and customer-care journeys where a technology stores information on or accesses information from a visitor's device. If a Maison email uses an open pixel, tagged link or comparable device-access technology, that technology is also subject to the inventory and consent analysis in this policy.

1.2 Maison only. It does not govern a separate website, app or service reached through an ordinary external link. The operator of that destination is responsible for its own technologies and notice. If Maison embeds third-party content so that device data is transmitted before a visitor leaves the Maison page, the embedded technology remains within this policy and the Current Technology Inventory.

1.3 Privacy Policy. This Cookie Policy addresses device storage and access and the consent controls used for those technologies. The Privacy Policy explains the related processing of personal data, including purposes, GDPR legal bases, recipients, international transfers, retention and data-protection rights. The two notices must be read together.

1.4 Terms and checkout. Accepting the Terms & Conditions, placing an order, opening an account, subscribing to a newsletter or continuing to browse does not constitute consent to optional technologies. Consent choices remain separate from each of those actions.

1.5 Mandatory rights. This policy does not reduce a right under the GDPR, Section 25 of the German Telecommunications and Digital Services Data Protection Act, commonly referred to as the TDDDG, or another mandatory privacy, communications or consumer rule. Equivalent national rules implementing Article 5(3) of the ePrivacy Directive may apply in another EU or EEA market and are not displaced by the German formulation used here.

For the broader personal-data notice, read the Maison The Five Privacy Policy.

2.1 Responsibility. Maison determines which technologies are permitted on its customer journey, the purposes for which Maison uses them and the consent controls that apply. A technology provider may act on Maison's instructions, determine some processing jointly with Maison or act independently for a separate regulated function. The legal role follows the actual processing, not only a contract label.

CONTROLLER Soufiane Boudarraja, sole proprietor trading as Maison The Five
Privacy contact: Maison The Five Contact page. State “Privacy and data protection” in your message. The legally required serviceable address is provided in the Privacy Policy and Legal Notice.

2.2 Controller identification. Maison identifies the individual controller as required by data-protection law. Maison's serviceable postal address and other legally required business information are available in the Privacy Policy and Legal Notice.

2.3 Customer-facing contact. Maison remains the contact for questions about the Maison consent interface and technologies used on the Maison customer journey. Maison will identify and help route a request to a separate controller where appropriate. Where another party is a joint controller, a visitor may exercise applicable rights against either controller. Maison's assistance or forwarding does not limit those rights or either controller's legal responsibility.

3.1 Cookies. A cookie is a small data record placed in a browser or device storage. A session cookie normally expires when the relevant browser session ends. A persistent cookie remains until it expires, is replaced, or is deleted. The terms first-party and third-party describe the domain relationship and do not determine whether consent is required.

3.2 Other storage. Comparable technologies include local or session storage, IndexedDB, cached data, service-worker storage, software development kits and other browser or application storage that can preserve or retrieve information.

3.3 Device access and signals. The rules can also cover pixels, tags, scripts, request headers, device identifiers, protocol identifiers, link decoration, tagged URLs, embedded content, device fingerprinting and other techniques that read or derive information from a device. A technology can fall within the rules even if it is described as cookie-free, first-party, server-side, hashed or pseudonymous.

3.4 Personal data. An identifier, consent string, IP address, event record or combination of technical signals may also be personal data when it relates to an identified or identifiable person. Information can be protected by the device-access rule even when it is not personal data.

3.5 Server-to-server operations. A provider that receives order or operational data only through a server-to-server process is not included in the Current Technology Inventory solely because it supports Maison behind the scenes. The inventory names every actor that stores information on or accesses information from a visitor's device and every controller that relies on visitor consent for a listed purpose. A downstream processor or recipient that does neither belongs in the Privacy Policy unless its identity is needed for the specific informed choice.

4.1 Device storage or access. Under Section 25(1) TDDDG, Maison obtains consent before storing information on or accessing information from a visitor's device unless a narrow statutory exception applies. The rule is technology-neutral and applies whether or not the information is personal data.

4.2 Strict-necessity exceptions. Consent is not required where the sole purpose is transmitting a communication over a public telecommunications network, or where storage or access is strictly necessary to provide a digital service expressly requested by the visitor. Maison assesses the exception technology by technology and purpose by purpose.

4.3 Later personal-data processing. If personal data is processed after device storage or access, Maison also identifies a GDPR legal basis. Depending on the verified purpose, this may be consent under Article 6(1)(a), contract steps or performance under Article 6(1)(b), a legal duty under Article 6(1)(c), or a proportionate legitimate interest under Article 6(1)(f). A GDPR legitimate interest does not replace device-access consent where Section 25(1) TDDDG requires consent.

4.4 Consent standard. Consent must be freely given, specific, informed and unambiguous; it must result from an affirmative choice. Silence, inactivity, scrolling, continued browsing, a preselected option or acceptance of another agreement is not consent. Maison bears responsibility for demonstrating a valid choice.

4.5 Classification. A label chosen by Maison, a consent service or a provider does not create a legal exemption. Maison documents why each technology is strictly necessary or keeps it blocked until valid consent. Convenience, commercial usefulness or a provider's default setting does not establish strict necessity. Audience measurement, by itself, does not establish strict necessity; the actual purpose and configuration must be assessed.

5.1 Two connected resources. The Cookie settings interface controls consent choices. The separately published Current Technology Inventory is Maison's versioned, site-specific schedule of verified technologies and forms part of this policy. The inventory displays its version and last-verified date. A material inventory change results in a new dated inventory and, where the stable policy text changes, a revised policy version.

5.2 Required inventory details. For every active technology, the inventory states its exact name or key, type, host or domain, first-party or third-party status, each actor that stores or accesses device information, the exact information involved, triggering action, concrete purpose, category, whether a third party can access the information, whether it is session-based or, if persistent, its exact expiration period, and what happens after withdrawal. It also states whether consent is required under Section 25(1) TDDDG or, if not, which precise Section 25(2) exception applies; the downstream GDPR purpose and legal basis if personal data is subsequently processed; relevant recipients or other controllers; the transfer country or region; the transfer mechanism; and where information about a safeguard can be obtained.

5.3 Accuracy standard. Maison lists only technologies it has verified on the live site and connected customer-facing services. General provider lists, consent-service templates and automated scans may assist that verification but do not by themselves establish whether a technology is active, absent or strictly necessary.

5.4 Connected surfaces. Maison verifies the storefront and every connected customer-facing surface, including hosted sign-in, account, checkout, payment return, order confirmation, forms and any embedded content. An optional technology on a surface remains blocked unless that surface can receive a valid existing choice or obtains a new valid choice.

5.5 Category display. The Cookie settings interface uses the four-category framework described in Section 6. A category label alone does not mean that an optional technology is active. Only verified active technologies and providers appear in the Current Technology Inventory. Maison does not populate the inventory with hypothetical analytics, advertising, social-media or fulfillment technologies.

5.6 How to open settings. Use the persistent Cookie settings control in the Maison website footer. The control remains available after the first consent layer is closed so visitors can review their choices at any time and directly access the Current Technology Inventory.

6.1 Essential (strictly necessary). This category is limited to technologies that meet the strict-necessity standard in Section 4.2. Depending on the verified configuration, this can include narrowly configured security, fraud-prevention, load-balancing, consent-choice, cart, authentication, checkout or transaction-state technology. A technology in this category may operate without consent only for the strictly necessary purpose and duration.

6.2 Preferences. This category can remember optional interface choices, presentation settings or enhanced features that are not essential to the requested core service. Maison requests consent unless a specific item is strictly necessary for a function the visitor expressly requested. A preference label alone does not create an exception. Storage used for recent searches or for locale or currency settings is described only if the final deployment actually uses it.

6.3 Analytics. This category can measure visits, navigation, search interactions, product interaction, errors, page performance or checkout journeys. Nonessential analytics technology remains blocked until consent. Maison does not send names, email addresses, raw order identifiers, raw search queries, message text, payment data or account credentials to optional analytics.

6.4 Marketing. This category can measure campaigns, attribute activity across sites, build an audience, personalize advertising or enable retargeting. It remains blocked until the required consent is obtained. Maison does not treat an ordinary purchase or newsletter subscription as consent to advertising technology.

6.5 Social media and embedded content. An ordinary outbound link does not by itself justify tracking on the Maison page. A social plugin, video, map, review widget or other embed can transmit device data to another provider and therefore remains blocked until consent unless its specific operation is strictly necessary. Where used, Maison assigns the embed to the Preferences, Analytics or Marketing category that matches its verified purpose and may use a consent-protected placeholder that lets the visitor choose whether to load the content.

6.6 One technology, several purposes. If one technology supports both a necessary and an optional purpose, Maison separates the purposes where technically possible. It does not use a necessary security, consent or cart identifier for analytics, profiling or marketing without the additional required consent and disclosure.

7.1 Restrictive default. Before a visitor makes a choice, Maison permits only technology that has a documented strict-necessity basis. Optional categories, tags, requests and provider calls remain off by default. A platform's permissive default does not override this rule.

7.2 First-layer choices. The first consent layer provides clearly visible Accept All, Reject Optional and Manage Preferences controls. The acceptance and rejection options are equally accessible and are presented without deceptive emphasis, repeated pressure or a design that makes refusal materially harder. The layer states the concrete purposes and explains before consent that choices can later be withdrawn through Cookie settings. Where relevant, it also states that profiles are enriched across sites and that data is processed outside the EEA, and it identifies the number of controllers receiving the data.

7.3 Granular control and direct information. Selecting Manage Preferences opens a view that explains the available purposes and relevant providers and lets the visitor select optional categories separately. Optional toggles are off until selected. Technology in the Essential category is identified and explained. It is locked as active only where it meets the strict-necessity standard in Section 4.2. The banner and detailed settings provide direct access to the Current Technology Inventory, Privacy Policy and Legal Notice without requiring consent to optional technologies.

7.4 No consent wall. Rejecting optional technology does not prevent ordinary browsing, search, purchasing, account use, customer care or another core retail function. A consent-protected optional embed or enhancement may remain unavailable until its category is accepted.

7.5 Prior blocking. Maison blocks optional storage, reads, pixels, scripts and network transmissions before consent. Activating an optional technology before consent and deleting or disabling it only after refusal does not satisfy this rule. Custom code and third-party applications are subject to the same control.

7.6 Accessibility. The consent layer and Cookie settings control are usable by keyboard, readable with assistive technology, responsive on mobile devices and operable at enlarged text and zoom settings. Consent information is written in clear language appropriate to the site audience.

8.1 Initial refusal. Choose Reject Optional to continue with only strictly necessary technology. Maison records and applies the refusal so that optional categories remain blocked.

8.2 Changing a choice. Open Cookie settings from the footer to review the Current Technology Inventory, activate an optional category, deactivate a previously accepted category or reject all optional categories. Withdrawal is as easy as acceptance, takes effect immediately for future storage and access, and takes effect without undue delay for associated personal-data processing.

8.3 Effect of withdrawal. Maison disables future activation and access for every integrated provider that relied on the withdrawn consent and communicates the withdrawal to processors and to joint or independent controllers relying on that consent. Maison removes optional first-party storage it controls where technically possible. A cookie or other storage item placed on a third party's domain may remain until deletion or expiration, but Maison prevents its future use through the integration. Browser controls or a separate request to that controller are supplemental and do not shift Maison's withdrawal duty to the visitor. Withdrawal does not make earlier lawful processing unlawful.

8.4 Browser and device controls. A browser or device may let a visitor view, block or delete storage. Those controls supplement Cookie settings and may remove a saved consent choice or the stored state needed for a cart, sign-in or another requested function. Blocking all storage can impair functions that are strictly necessary. Deleting browser storage does not delete personal data held on Maison's servers. To request deletion of that data, use the rights-request process described in the Privacy Policy.

8.5 Device-specific choices. A choice may be stored for a particular browser, device, profile or domain. A visitor may need to choose again after clearing storage, using a private session, switching devices or browsers, or moving to a surface that cannot lawfully or technically receive the existing choice. Every optional technology on that surface remains blocked until a new valid choice is obtained.

8.6 Renewed request. Consent has no universal statutory expiration period. Maison requests consent again for a new or materially changed purpose, actor or technology, when a demonstrable choice has been lost or can no longer be applied, or at an appropriate documented interval based on the processing context and reasonable user expectations. Maison does not repeatedly pressure a visitor who has refused merely to obtain a different answer.

9.1 Provider identification. The Current Technology Inventory names every actor that stores information on or accesses information from a visitor's device and every controller that relies on the visitor's consent. A downstream processor or recipient that does neither is named in the Privacy Policy unless its identity is needed for the specific informed choice. Generic references to partners are not used when the responsible actor must be named.

9.2 Roles. A storefront, hosting, consent, security, payment, analytics or embedded-content provider may act as Maison's processor, a joint controller or an independent controller depending on the actual purpose and control. The Current Technology Inventory and Privacy Policy describe the applicable relationship without transferring Maison's own responsibility to a provider.

9.3 Operational suppliers. An operational supplier that receives only server-side order data, such as a production or fulfillment supplier or a carrier, is not listed in the Current Technology Inventory unless consent, data-protection law or another mandatory rule requires its identification. Related processing is described in the Privacy Policy.

9.4 External destinations. When a visitor intentionally follows an ordinary link to a payment institution, carrier, social platform, public authority or another external destination, that service's own notice governs technology used on its separate page. Maison does not adopt that notice as its own and remains responsible for any device access that occurs before the visitor leaves Maison's journey.

9.5 Provider policies. Maison may link to a provider notice when it gives useful additional information about separate provider processing. That link is supplemental. The visitor is not required to consult a provider policy center to understand Maison's categories, purposes, choices, and Current Technology Inventory.

10.1 Data involved. Depending on the verified technology and choice, data can include cookie or storage identifiers, consent status, IP address, date and time, requested page or resource, referring page, browser, operating system, device and language details, security or diagnostic events and limited interaction events. The Current Technology Inventory identifies the actual information stored or accessed.

10.2 Recipients and transfers. The Current Technology Inventory and Privacy Policy identify the relevant recipient or controller, destination country or region and transfer mechanism. Before enabling any transfer outside the European Economic Area, Maison verifies that an applicable adequacy decision covers the recipient and data, including the current certification and scope when the EU-US Data Privacy Framework is used. Without adequacy, Maison verifies an Article 46 GDPR mechanism, such as the European Commission's Standard Contractual Clauses, together with any required transfer assessment and supplementary measures. Maison does not use an exceptional Article 49 consent derogation as the routine basis for tracking transfers.

10.3 Browser-storage duration. For each active technology, the Current Technology Inventory states whether it is session-based or gives its exact expiration period. Maison does not describe a technology merely as persistent where a more precise duration is available. A provider-configured maximum does not replace verification of the duration actually deployed.

10.4 Related server records. Browser-storage expiration and server-side retention are separate. The Current Technology Inventory and Privacy Policy state the exact verified retention periods for personal data collected through optional analytics and for related operational logs. Maison states that data is anonymized so it is no longer personal data only where that technical outcome has been demonstrated. An incident, binding legal duty or legal hold can require a separately documented period.

10.5 Consent evidence. Maison keeps proportionate evidence needed to apply and demonstrate a visitor's consent or refusal. This can include a minimized consent identifier, timestamp, selected purposes or providers, language or regional context and later withdrawal or change. Maison does not create a durable unique identifier solely to prove consent. It archives the exact first layer, detailed settings, provider list, default toggle states and workflow associated with each interface, policy and inventory version. Evidence is retained only for the duration of the consent-based processing and the strictly necessary compliance or legal-claims period documented for the actual system, then deleted or anonymized so it is no longer personal data.

10.6 Deletion after withdrawal. Withdrawal stops future consent-based use. Data already collected is deleted under the applicable retention rule unless continued retention is necessary for a separate, previously disclosed purpose supported by its own legal basis, such as a legal obligation or the establishment, exercise or defense of claims. Maison does not retrospectively switch the same optional tracking to legitimate interests or silently repurpose the same dataset merely because consent was withdrawn.

11.1 Data-protection rights. Where a technology involves personal data, the applicable rights can include access, correction, deletion, restriction, portability, objection and withdrawal of consent. The Privacy Policy explains each right, applicable limitations, identity verification and response timing.

11.2 Request route. Use the Maison The Five Contact page and state “Privacy and data protection” in your message. Identify the relevant browser, device, account, order or interaction only to the extent needed to locate the data. Do not send a full identity document with the initial request.

11.3 Objection and consent. A consent withdrawal is handled through Cookie settings or the contact route. Where Maison separately relies on legitimate interests for related personal-data processing, a visitor may object on grounds relating to the particular situation. An objection does not replace the consent rule for device storage or access.

11.4 Complaint. A visitor may complain to a competent data-protection supervisory authority, in particular in the Member State of the visitor's habitual residence, place of work or place of the alleged infringement. For Maison's establishment in Hesse, the ordinary competent authority is the Hessian Commissioner for Data Protection and Freedom of Information. Current authority contact details are provided in the Privacy Policy.

For rights, retention and supervisory-authority details, read the Maison The Five Privacy Policy.

12.1 Production verification. Before publication and after a material deployment, Maison tests browser storage and network activity on the live site and connected services using a fresh browser profile with no existing cookies or saved choices. Maison verifies the states before a choice, after Reject Optional, after each granular choice, after Accept All, and after withdrawal, including connected sign-in, account, checkout, forms, confirmation, and embedded-content surfaces.

12.2 Change control and records. Maison reviews a new application, script, tag, provider, embed, analytics destination, or material release before activation. It updates the internal technology register, Current Technology Inventory, consent interface, and this policy when the customer-facing facts change. A nonessential technology remains blocked until its disclosure and consent control are ready. For each version, Maison preserves the exact first layer, detailed settings, provider list, default toggle states, withdrawal route, and associated policy and inventory content needed to demonstrate the choice presented.

12.3 Prospective updates. A revised policy applies prospectively from its stated effective date. Maison gives a prominent notice or direct communication when appropriate and obtains renewed consent before activating a materially different optional purpose or provider if required by law.

12.4 No silent provider change. A provider's policy, help article, configuration default or operational change does not silently amend this policy, broaden consent or reduce Maison's responsibility. Maison assesses provider changes and updates the Maison notice and controls when the deployed processing changes.

12.5 Precedence. Mandatory law prevails over an inconsistent provision. The current version of this Maison policy and its versioned Current Technology Inventory govern Maison's customer journey, while the Cookie settings interface applies the visitor's current choices. A provider notice governs only that provider's separate service and cannot reduce a non-waivable right or Maison's customer-facing commitments.

Related Maison resources: Privacy Policy, Terms & Conditions, Legal Notice, and the Policies Hub.

POLICY MAINTENANCE Maison The Five maintains this policy, the Cookie settings interface and the versioned Current Technology Inventory. The dated policy and inventory in the Maison The Five Policies Hub are Maison's current public notice. A provider's general policy may contain additional information about that provider's separate services, but it does not replace Maison's notice, silently change the consent choices available through Maison or take precedence over mandatory law.