Privacy Policy

1.1 Scope. This notice applies to the Maison The Five website, EU retail checkout, optional customer account and saved-item functions when enabled, contact and newsletter forms, order and payment administration, production and fulfillment, delivery and tracking, withdrawal, returns, refunds, product issues, product-safety handling and related customer communications. It applies to visitors, purchasers, account holders, newsletter subscribers, gift or delivery recipients and people who contact Maison.

1.2 Maison only. This notice covers Maison The Five activities on maisonthefive.com. It does not cover other websites, brands, services or activities operated separately from Maison The Five. Each separate activity has its own applicable notice.

1.3 Controller responsibility. Maison determines the purposes and essential means of the processing described here and acts as controller. Service providers may act as processors under Maison's instructions, while payment institutions, carriers, customs authorities, public authorities or other parties may act as independent controllers for parts of their own regulated operations. A party's role is determined by what it actually does, not only by its contract label.

1.4 Customer-facing contact. Maison remains the contact for processing it controls and for providers acting on its instructions. A payment institution, carrier, customs authority or other party may independently control part of its regulated processing. Maison will identify that controller and help route a request where appropriate, but the independent controller remains responsible for its own processing and response.

1.5 Other Maison policies. The Terms & Conditions explain the customer relationship. The withdrawal, returns and shipping policies explain the information needed for those processes. The Cookie Policy describes actual browser and device storage used on the live site. The Legal Notice provides the legally required business information. Those documents supplement this notice for their stated subject and do not replace it.

1.6 Collection notices. A short notice beside a form, account function or checkout field may explain a processing activity at the point of collection. It supplements this complete notice. If Maison introduces a materially different purpose, recipient or technology, it will provide the required information before or when that processing begins and request consent where consent is required.

2.1 Required identity. The legal controller identity and serviceable business address are provided below because data-protection law requires the person responsible for the processing to be identifiable. Personal details that are not required for this purpose are not published in this notice.

CONTROLLER Soufiane Boudarraja, sole proprietor trading as Maison The Five
Waldstr. 74, 65451 Kelsterbach, Hesse, Germany
Privacy contact: Maison The Five Contact page. State ‘Privacy and data protection’ in your message.

2.2 How to contact Maison. Use the Contact page for a question, request or objection and state that the message concerns privacy and data protection. You may also write to the postal address in the controller block. A rights request is not invalid merely because it was sent through another official Maison channel and clearly identifies the request.

2.3 Legal Notice. The Legal Notice contains the legally required seller and operator information. Maison does not repeat a private telephone number, personal mailbox, tax number or other unrelated personal detail in this Privacy Policy.

For the controlled business disclosure, read the Maison The Five Legal Notice.

3.1 Website and device data. This can include IP address, date and time, requested page or resource, referring page, browser, operating system, device and language information, network and security events, cookie or local-storage identifiers, consent choices and technical diagnostic data. Search terms, filters, locale or currency choices may also be processed when those functions are used.

3.2 Account and preference data. If account functions are enabled and you choose to use them, this can include your account identifier, sign-in address, profile details, authentication state, order history, saved items, selected variants, preferences, account activity and security events. Browsing and guest checkout remain available where the site offers them.

3.3 Cart, checkout and order data. This can include cart and visitor identifiers, products, variants, quantity, discount or promotion information, name, contact details, billing and delivery details, order number, prices, tax, shipping selection, transaction and payment status, fraud or security signals, contract version, timestamps, confirmations, withdrawal records, refund status and correspondence.

3.4 Payment data. Payment credentials are entered through the configured checkout and payment service. Maison normally receives transaction identifiers, payment method category, authorization or refusal status, amount, currency, risk or verification outcome, refund information and limited billing details rather than the full payment-card number or security code. A regulated payment provider may process additional information under its own legal duties.

3.5 Production and fulfillment data. This can include order number, products and variants, quantities, production files selected by Maison, recipient name, delivery address, contact details needed for delivery, production and fulfillment status, parcel references and information required to correct or investigate a production or fulfillment event. Maison does not currently offer customer-uploaded artwork or personalized customer content through the retail checkout.

3.6 Delivery, tracking and customs data. This can include recipient and address data, tracking number, carrier, dispatch and delivery events, failed attempt or collection information, return reason, delivery photograph, signature or one-time code, approximate delivery-location evidence, customs status, declared order information and an import or tax identifier only where a destination lawfully requires it.

3.7 Customer-care and claim data. This can include contact and order details, message content, dates, preferred outcome and relevant correspondence. For a withdrawal, return, delivery investigation, damaged or incorrect item, safety concern or other claim, it can also include photographs, video, product labels, size tags, parcel labels, packaging, packing documents, proof of payment or delivery and the resolution history.

3.8 Contact, newsletter and consent data. This can include the details and message you provide through a contact form, email address and optional preference information submitted for a newsletter, consent wording and status, collection and confirmation timestamps, source page, unsubscribe or objection status and a minimal suppression record used to ensure that a marketing objection is respected.

3.9 Sensitive information. Maison does not ask for special-category data in ordinary browsing, ordering, delivery or support. A product-safety or injury report may incidentally contain limited health information. Maison processes it only where necessary to assess the report, comply with safety duties or establish, exercise or defend legal claims, and limits onward disclosure. Product choices or messages printed on Maison products are treated as commercial order data and are not used to infer a customer's race, ethnicity, beliefs, health, sexual orientation or other sensitive characteristic.

4.1 Directly from you. Maison receives data when you browse, choose consent settings, create an account, save an item, search, add to cart, order, pay, subscribe, contact Maison, exercise a right, submit a withdrawal, report a delivery or product issue, request a refund or provide claim evidence.

4.2 From a purchaser or sender. A purchaser may provide another adult's name, delivery address and contact details for a gift or other delivery. The purchaser is the source of that recipient data. Section 11 explains the notice Maison gives to that recipient and the purchaser's responsibility to use accurate, appropriate details.

4.3 From operational systems and providers. Maison may receive data from the storefront and account platform, checkout and payment services, fraud-prevention controls, production and fulfillment operations, carriers, postal services, customs channels, communication systems and service providers used to operate and secure the site.

4.4 From authorities and advisors. Maison may receive information from customs, market-surveillance, tax, consumer-protection, law-enforcement or judicial authorities and from insurers, auditors, accountants or legal advisors where a lawful matter requires it.

4.5 No unrelated enrichment. Maison does not supplement ordinary customer records with unrelated data-broker or outbound prospecting information for the storefront processing described in this notice.

5.1 Site delivery and requested functions. Maison processes technical requests, essential session data, language or interface choices and necessary cart, authentication and checkout state to deliver the site and functions you request. The bases are Article 6(1)(b) GDPR where processing is necessary for steps at your request or performance of a contract, and Article 6(1)(f) for Maison's legitimate interests in providing a stable, usable and secure storefront.

5.2 Accounts and saved items. Where enabled, Maison processes account, sign-in, order-history and saved-item data to create and maintain the optional service you request, authenticate access and present your information. The basis is Article 6(1)(b) GDPR. Security logging and misuse prevention are based on Article 6(1)(f), reflecting Maison's interests in protecting accounts, customers and the service.

5.3 Checkout, payment and contract administration. Maison processes cart, identity, contact, billing, payment-status, order and contract-version data to take pre-contract steps, form and perform the sales contract, route payment, send confirmations, administer refunds and preserve the agreed terms. The principal basis is Article 6(1)(b) GDPR. Tax, accounting, consumer and payment-law records required of Maison are processed under Article 6(1)(c).

5.4 Fraud, abuse and transaction security. Maison and relevant payment or security services may assess proportionate transaction, device, account and risk signals to prevent fraud, unauthorized access, duplicate claims and misuse. Maison relies on Article 6(1)(f) for its legitimate interests in protecting customers, transactions, property and the integrity of the service. A provider may rely on a separate basis for its own regulated obligations.

5.5 Production, fulfillment and delivery. Maison processes order, product, recipient, address, contact, fulfillment and tracking data to produce, pack, dispatch, deliver and, where necessary, correct or reship an order. For the purchaser, the basis is Article 6(1)(b) GDPR. Where the recipient is another adult, Maison relies on Article 6(1)(f) for the legitimate interests of the purchaser, recipient and Maison in completing the requested delivery, subject to minimization and the recipient notice in Section 11.

5.6 Customs and destination requirements. Maison processes the limited information needed to satisfy a lawful customs, import, tax or transport requirement, respond to an authority and release a parcel. The basis is Article 6(1)(c) where Maison has a legal duty, Article 6(1)(b) where the step is objectively necessary to perform the order, or Article 6(1)(f) for the legitimate interest in resolving a destination requirement that applies to the recipient.

5.7 Customer care, withdrawal, returns and claims. Maison processes contact, order, delivery, product and evidence data to answer questions, document an electronic withdrawal, investigate an issue, determine a remedy, prevent duplicate recovery and administer a refund, replacement or redelivery. The bases are Article 6(1)(b) for contract performance, Article 6(1)(c) for consumer-law duties and Article 6(1)(f) for proportionate claim administration and the establishment, exercise or defense of legal claims.

5.8 Product safety and recalls. Maison processes incident, product, traceability, contact, delivery and limited evidence data to investigate a safety report, give warnings, coordinate corrective action, meet reporting and traceability duties and defend legal claims. The bases are Article 6(1)(c) and Article 6(1)(f). Maison does not request medical records through ordinary support. Health information necessary to establish, exercise or defend legal claims is processed under Article 9(2)(f) GDPR. Where health information is needed for another product-safety purpose, Maison will obtain explicit consent under Article 9(2)(a) or identify and document the specific statutory Article 9 condition before processing it. Information for which no Article 9 condition exists is deleted or redacted. Production and fulfillment providers receive only non-sensitive product and order facts; health information is limited to Maison and, where legally necessary, authorized advisors, insurers or authorities.

5.9 Service communications. Maison uses contact details to send requested or necessary account, security, order, payment, withdrawal, production, delivery, return, refund, product-safety and rights-request messages. The basis follows the underlying contract, legal duty or legitimate interest. Maison keeps operational messages separate from promotional content.

5.10 Newsletter and direct marketing. If you choose to subscribe, Maison uses the submitted address and consent record to send the selected marketing under Article 6(1)(a) GDPR and Section 7(2) no. 2 UWG. Consent is separate from checkout, the Terms and cookie choices and may be withdrawn at any time. Maison uses a confirmation step to verify control of the submitted address and document consent. Maison does not use order contact details for promotional email without that prior express consent.

5.11 Optional analytics. Where enabled, nonessential analytics is used to understand page performance, searches, product interaction and checkout journeys only after the required device-access and data-processing consent. The basis is Article 6(1)(a) GDPR together with consent under Section 25 TDDDG. Refusal does not prevent ordinary browsing or purchasing.

5.12 Legal compliance and claims. Maison processes and discloses information where necessary for tax, accounting, customs, consumer, product-safety, data-protection or other binding duties under Article 6(1)(c), and to obtain advice, enforce rights or establish, exercise or defend claims under Article 6(1)(f). Maison does not treat a general possibility of future usefulness as a legal basis.

6.1 Browsing. Technical request and essential security data are generated when a device connects to the site. Necessary cookies or storage may be required for transmission, security, consent storage, cart, account or checkout functions expressly requested by the user. A visitor may refuse nonessential technologies.

6.2 Ordering. Fields identified as required at checkout are needed to identify the purchaser, calculate the price and tax, route payment, fulfill and deliver the order, provide mandatory information and handle the contract. If required data is not provided or is materially inaccurate, Maison may be unable to accept, perform or deliver the order.

6.3 Optional account and marketing. An account, saved items, nonessential preferences and newsletter subscription are optional where offered. Refusing or withdrawing consent for marketing or analytics does not remove access to the core retail service. An account closure does not erase transaction records that Maison must retain.

6.4 Support and evidence. A question may be submitted with only the information needed to understand and answer it. For a withdrawal, delivery investigation, refund or product claim, the order reference and facts needed to verify the request may be required. Photographs, video or documents are requested only where reasonably useful and proportionate; the consequence of not providing useful evidence depends on whether the claim can otherwise be assessed.

6.5 Customs information. An authority or carrier may require a specific import or tax identifier or document for a particular destination. Maison will identify a secure verified channel where the information is genuinely required. Maison does not send government identity documents, passport copies or destination tax identifiers through a production or fulfillment system unless the applicable contract expressly permits and safeguards that data. Where required, Maison directs the person to a verified carrier, customs authority, payment institution or other authorized secure channel. If a lawful requirement is not completed, release or delivery may be delayed or impossible as explained in the Shipping & Delivery Policy.

7.1 Two legal layers. Storage of or access to information on a device is governed by Section 25 TDDDG, whether or not the information is personal data. Any later processing of personal data also needs a GDPR legal basis. Cookies, local or session storage, pixels, device identifiers, embedded content and script-based device reads can fall within these rules.

7.2 Essential technologies. Maison may use storage or access without consent only where it is strictly necessary to transmit a communication or provide a digital service expressly requested by the user, such as security, consent storage, cart, sign-in or checkout state. The exception is interpreted narrowly.

7.3 Optional technologies. Maison activates analytics, advertising, optimization, cross-site tracking or another nonessential technology only after verifying that it remains blocked until the required consent is given. Choices must be specific, informed and freely made, without preselected optional categories. Rejecting must be available as readily as accepting, and settings must be changeable through a persistent cookie control.

7.4 Live inventory. The Cookie Policy and consent layer identify each technology actually used on the live Maison site and, where required for informed consent, the responsible provider or third party, the information stored or accessed, its purpose, duration, consent category, recipients and international-transfer context. A supplier's general cookie policy is not Maison's site-specific inventory.

For the current site-specific inventory and controls, read the Maison The Five Cookie Policy.

8.1 Storefront, hosting and account services. Website hosting, content delivery, storefront, catalog, content-management, account, cart, checkout, form, customer-record, logging and related infrastructure providers may process technical, account, cart, order and communication data needed to provide and secure their function.

8.2 Payment and financial services. Checkout payment services, card schemes, banks, wallet providers and fraud-prevention services may receive identity, billing, transaction, device, authorization and risk data needed to execute, secure, refund or legally document payment. Some determine their own legally required processing.

8.3 Production and fulfillment services. Product production, printing, quality-control, packing, fulfillment and reshipment providers receive the order reference, selected products and variants, quantities, recipient and delivery data, and limited issue evidence needed to perform their assigned role. Maison does not permit them to use Maison customer data for their own direct marketing.

8.4 Delivery and customs recipients. Carriers, postal operators, pickup services, customs representatives, customs or tax authorities and destination service providers may receive recipient, address, contact, parcel, tracking, value, origin and limited customs data required for delivery, release, evidence or a lawful public duty.

8.5 Communications and customer care. Form, customer-relationship, transactional-message and newsletter delivery services may process contact details, message content, order references, communication status and consent or suppression data. Authorized Maison personnel access only what their role requires.

8.6 Consent, analytics and security. Consent-management, analytics, security, anti-abuse, monitoring and technical support providers may receive consent records, identifiers, device and event data, security signals and carefully limited diagnostic information. Optional analytics receives data only after the required consent.

8.7 Advisors, insurers and authorities. Accountants, auditors, legal advisors, insurers, courts, regulators, market-surveillance bodies, law-enforcement and other competent authorities may receive information where necessary for professional advice, insurance, legal claims or a binding legal request.

8.8 Recipient records. Maison describes recipients through precise functional categories where Articles 13 and 14 GDPR permit that approach and maintains an up-to-date internal record of actual recipients and transfers. Maison identifies an actual provider where informed consent, Article 15 GDPR or another applicable rule requires that identity, subject only to a lawful limitation.

8.9 No sale of customer data. Maison does not sell customer personal data or disclose it in exchange for money. Maison does not authorize production or fulfillment providers to build an independent marketing relationship with Maison customers.

9.1 Processing locations. Storefront, account and support data may be processed in the European Economic Area, Israel and the United States. Production and fulfillment data may be processed in the European Economic Area, the United Kingdom and the United States. Payment data is processed in the countries verified for the configured checkout service, and delivery data may be processed in destination or transit countries. Remote support or onward processing can also create an international transfer. Maison records the applicable transfer mechanism for each recipient category and activates only countries verified for the service.

9.2 Adequacy. Before relying on an adequacy decision, Maison verifies that the destination or qualifying recipient falls within its current scope. This can include a qualifying and currently certified United States recipient under the EU-US Data Privacy Framework where the certification and data type are covered.

9.3 Contractual safeguards. Before using a routine transfer for which no adequacy decision applies, Maison verifies an appropriate mechanism such as the European Commission's Standard Contractual Clauses and completes any required transfer assessment and supplementary contractual, organizational or technical measures. Onward transfers must be subject to corresponding verified controls.

9.4 Exceptional transfers. Maison relies on an Article 49 GDPR derogation only for an occasional exceptional transfer after verifying its statutory conditions. It is not used as the routine basis for cloud, platform, fulfillment or support processing.

9.5 Safeguard information. You may ask Maison for information about the safeguard relevant to your data and how to obtain or review an available copy. Commercial terms and security details may be redacted where necessary without removing the substance of the protection.

10.1 General rule. Maison keeps personal data only for the shortest period needed for the stated purpose, a binding recordkeeping duty, proportionate security or fraud prevention, or the establishment, exercise or defense of legal claims. Data is then deleted, irreversibly anonymized or isolated until lawful deletion. A legal hold suspends routine deletion only for the affected information. These periods also govern copies held by processors under Maison's instructions. Independent controllers apply their own disclosed retention rules.

10.2 Accounts and saved items. Account profile and saved-item data is kept while the account remains open and the function is requested. Maison periodically reviews inactive accounts and deletes or anonymizes profile and saved-item data when continued retention is no longer reasonably connected to the requested account service, after any appropriate advance notice. After closure, active profile and preference data is scheduled for deletion, while order, payment, consent, security and claim records are separated and retained only under the applicable period below. Authentication or security data may be kept longer where an active incident or misuse investigation requires it.

10.3 Carts and sessions. Cart, visitor and session records expire under the configured storefront and essential-storage lifecycle when the requested session or cart function is no longer active. Maison does not use an abandoned cart for promotional contact unless a separate lawful marketing basis applies. The Cookie Policy gives the verified browser-storage duration once the live configuration is active.

10.4 Orders and accounting. Order, invoice, payment-status and refund records are kept for contract administration and the applicable German commercial and tax periods. Depending on record type, core accounting records may be retained for ten years, booking vouchers and invoices generally for eight years, and relevant commercial or tax correspondence generally for six years, calculated from the legally prescribed year-end trigger.

10.5 Customer care, withdrawal and ordinary claims. Contact, withdrawal, return, delivery and product-issue records are kept until the matter is resolved and then, where needed for proof or claims, through the regular civil limitation period, generally three years from the end of the year in which the relevant claim arose and the statutory knowledge conditions were met. A longer special limitation period or pending dispute controls where applicable.

10.6 Photographs, video and delivery evidence. Raw photographs, video, labels, signatures, delivery images and location evidence are reviewed for necessity. Unneeded material is deleted earlier. Evidence needed for an unresolved claim is kept through the related case and applicable limitation period; product-safety, insurance or legal proceedings may require a longer documented hold.

10.7 Customs and destination documents. Customs identifiers and documents are kept only through release, appeal, accounting or claim needs and any specific statutory period. They are not retained as a general customer-profile attribute when the destination requirement has ended.

10.8 Marketing and consent records. Newsletter contact data is used until consent is withdrawn, the subscription ends or the address becomes invalid. Maison may keep the consent wording, confirmation and withdrawal evidence for up to three years after the end of the calendar year in which marketing stopped where needed to demonstrate compliance. A minimal suppression record may be retained for as long as necessary to honor an objection and is not used for marketing.

10.9 Analytics and consent choices. Identifiable analytics data is kept for the period stated in the live Cookie Policy and configured service, then deleted or aggregated so that it no longer identifies a person. Consent-choice evidence is retained only as long as needed to apply the choice and demonstrate compliance.

10.10 Security logs and rights requests. Ordinary security and technical logs are retained for the shortest configured period documented in Maison's retention schedule and are then deleted or anonymized. Logs connected with an incident, fraud investigation or legal duty may be isolated for the documented period required to resolve that matter. Rights-request correspondence and completion evidence are normally retained for three years after the end of the year in which the request was completed.

10.11 Backups and anonymized data. Deleted data may remain temporarily in protected rotating backups until overwritten under the applicable recovery cycle. Backups are isolated from ordinary use and are restored only for legitimate recovery. Information that has been irreversibly anonymized is no longer personal data and may be retained for statistical or operational analysis.

11.1 Other adult recipients. If you provide another adult's details for a gift or delivery, use only accurate information needed for that purpose and make this notice available to them. Maison processes the information to complete the requested delivery and related customer care. The recipient may exercise their own data rights with Maison.

11.2 Notice to the recipient. Where Maison obtains an adult recipient's personal data from a purchaser, Maison sends the recipient a direct privacy notice containing or linking to this policy. Maison does so at the earliest of: before the data is first disclosed onward for production, fulfillment or delivery; at the first communication with the recipient; or one month after receiving the data. Maison relies on an Article 14(5) exception only where its statutory conditions have been assessed and documented.

11.3 Adult-facing service. The Maison website, account, checkout, contact and newsletter functions are intended for adults. Products for children or family gifting do not make the digital service child-directed. A purchase for a child must use an adult purchaser, adult recipient and adult contact details.

11.4 Do not submit child data. Do not place a child's name, email, phone number, exact location, account credentials, image or other personal data in an order, support message or delivery instruction. If Maison learns that unnecessary child data was submitted, it will restrict and delete it as appropriate, subject to a legal safety or claim need.

11.5 Safe evidence submissions. Before sending a photograph or video, crop or cover faces, unrelated names, addresses, documents, screens, vehicle plates and background details. Remove unnecessary location metadata where possible. Show only the product, label, parcel or damage needed to assess the issue.

11.6 Restricted information. Do not send full payment-card details, security codes, passwords, account recovery codes, government identity documents, passport copies, precise live location, private communications, criminal-offense information or special-category data through a general contact form. If a legally required customs or safety process needs restricted information, Maison will identify a secure verified route and request only the necessary fields.

12.1 Marketing control. Every newsletter or direct-marketing message provides an easy way to stop future marketing. Withdrawing marketing consent does not affect processing that was lawful before withdrawal and does not stop necessary order, security, legal or safety messages.

12.2 No sensitive profiling. Maison does not use a customer's product views, purchases, gift choices or printed Maison messages to infer sensitive characteristics. Maison does not combine storefront data with unrelated broker data for behavioral targeting.

12.3 Significant automated decisions. Maison itself does not make decisions based solely on automated processing that produce legal or similarly significant effects within Article 22 GDPR. Payment, fraud or security providers may use automated checks for their own services. If a check prevents an order or materially affects access, contact Maison. Maison will provide the information available to it, correct inaccurate Maison data, identify an independent controller where appropriate and offer human review where Maison has authority to intervene.

12.4 Changes to this position. Before introducing significant automated decision-making, behavioral advertising or a materially new profiling purpose, Maison will complete the required assessment, update the notice and consent controls, and provide the additional Article 22 information and safeguards where applicable.

13.1 Proportionate safeguards. Maison uses risk-appropriate technical and organizational measures intended to protect confidentiality, integrity, availability and resilience. These include role-based access, provider due diligence and contractual controls, secure transmission and account controls where supported, data minimization, restricted handling of claim evidence, backup and recovery measures, monitoring and incident procedures.

13.2 No absolute guarantee. No internet transmission, account, storage system or delivery process is completely risk-free. Maison does not promise absolute security. It reviews material incidents, contains and remediates them and notifies affected people and authorities where data-protection law requires notification.

13.3 Internal access. Access is limited to Maison personnel and service-provider personnel who need the information for an authorized task and are subject to appropriate confidentiality and security obligations. Maison personnel must not enter customer order or support data into public artificial-intelligence tools or use it to train a general-purpose model. Service providers may process the data only for their authorized contractual purpose.

13.4 Customer precautions. Use a unique password where an account is offered, protect access to your email and device, verify Maison communications before providing data and contact Maison promptly about suspected account misuse, phishing, an unexpected customs demand or an unauthorized order.

14.1 Access. You may request confirmation of whether Maison processes your personal data, access to that data and a copy of the personal data undergoing processing, together with the applicable information about purposes, categories, recipients, transfers, retention, sources and rights. The first copy is provided free of charge. Where required, Maison will identify actual recipients rather than only categories, unless doing so is impossible or a lawful limitation applies.

14.2 Correction. You may ask Maison to correct inaccurate personal data and complete incomplete data. An address correction submitted after order acceptance may be limited by production, dispatch, carrier or legal constraints, but the underlying record will be handled accurately and the operational result explained.

14.3 Deletion. You may request deletion where the data is no longer needed, consent is withdrawn and no other basis remains, a valid objection succeeds, processing was unlawful or deletion is legally required. Deletion can be refused or limited where continued processing is required by law, freedom of expression and information, public-interest grounds or legal claims.

14.4 Restriction. You may request restriction while accuracy is checked, where processing is unlawful but you prefer restriction to deletion, where Maison no longer needs the data but you need it for legal claims, or while a legitimate-interest objection is assessed.

14.5 Portability. For data you provided that Maison processes by automated means based on consent or contract, you may request it in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, request direct transmission to another controller.

14.6 Objection. You may object to processing based on legitimate interests or a public-interest basis on grounds relating to your particular situation. The separate notice below explains the consequence. An objection to direct marketing is unconditional.

14.7 Consent withdrawal. You may withdraw consent at any time through the same type of setting or route by which it was given, including cookie settings or the unsubscribe control, or by contacting Maison. Withdrawal is as easy as giving consent and does not affect earlier lawful processing.

14.8 Automated decision safeguards. If Article 22 GDPR applies in a future process, you have the applicable right not to be subject to the decision and to obtain human intervention, express your point of view and contest it, together with meaningful information about the logic, significance and expected consequences.

14.9 Recipient notification. Where required, Maison communicates a correction, deletion or restriction to recipients to whom the data was disclosed and will inform you about those recipients on request, unless notification is impossible or involves disproportionate effort.

YOUR RIGHT TO OBJECT Where Maison relies on legitimate interests under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Maison will stop the processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time and without giving a reason; that objection also covers related profiling.

15.1 Request route. Submit a request through the Maison Contact page, using ‘Privacy and data protection’ as the subject, or write to the controller address in Section 2. Describe the right and relevant account, order or interaction. Do not send a full identity document with the initial request.

15.2 Identity verification. Maison may ask for additional information only where it has reasonable doubt about identity. Verification is proportionate to the data and risk and may use existing account, order or communication information. Unnecessary identity-document copies are not required as a routine condition.

15.3 Timing and fees. Maison responds without undue delay and within one month of receiving the request. Where permitted for a complex request or several requests, Maison may extend that period by up to two further months and will explain the extension within the first month. The first access copy and ordinary rights requests are free. Maison may charge a reasonable administrative fee for additional copies or, where it demonstrates that a request is manifestly unfounded or excessive, charge a reasonable fee or refuse to act. If Maison does not act, it will explain the reasons within one month and inform the requester of the right to complain to a supervisory authority and seek a judicial remedy.

15.4 Authorized representatives. A representative may submit a request, but Maison may verify the authority and the identity of the person concerned. Rights of other people and confidential information may be protected through redaction or another proportionate measure.

15.5 Supervisory complaint. You may complain to a competent data-protection supervisory authority, particularly in the EU or EEA country where you live, work or consider an infringement occurred. You do not have to contact Maison first.

15.6 Hesse authority. For Maison's establishment in Hesse, the ordinary competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Wilhelmstraße 7, 65185 Wiesbaden, Germany; email: poststelle@datenschutz.hessen.de; telephone: +49 611 1408-0. Current complaint and contact information is available at datenschutz.hessen.de.

Send a privacy request through the Maison The Five Contact page.

16.1 External links. A link to a carrier, payment institution, social platform, public authority or other external destination takes you to a separate service. That service is responsible for its own processing when it determines the purpose and means. Maison does not import the external service's privacy or cookie terms into this notice.

16.2 Prospective updates. Maison may update this notice when processing, technology, recipients, transfers, retention, law or regulatory guidance changes. The new version applies prospectively from its stated effective date. Maison will provide a prominent notice or direct communication where a material change requires it and will obtain a new consent where the law requires one.

16.3 No supplier precedence. A provider's policy, help article or later operational change does not silently amend this Privacy Policy or reduce Maison's responsibility. Maison assesses provider changes internally and updates the Maison notice and controls when the customer-facing processing changes.

16.4 Mandatory law. Nothing in this notice limits a non-waivable right under the GDPR, TDDDG or another applicable data-protection, consumer or communications rule. If a provision conflicts with mandatory law, the mandatory rule applies and the remaining provisions continue where legally possible.

Related Maison policies: Terms & Conditions; Right of Withdrawal; Returns, Refunds & Product Issues; Shipping & Delivery; Product Safety; and the Policies Hub.

POLICY MAINTENANCE Maison The Five maintains this notice and updates it when its processing, providers, transfers, technology or legal requirements materially change. The dated version in the Maison The Five Policies Hub is the current public notice. Earlier versions remain governed by the facts and law applicable during their effective period.