PRIVACY POLICY

1. Introduction

Below, we provide information about the processing of personal data when using:

• our websites www.maison-valerion.fr, www.maison-valerion.com and www.maison-valerion.de
• our social media profiles

Personal data means any data that can be linked to a specific natural person, such as their name or IP address.

1.1 Contact details

The data controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

Our data protection officer can be contacted via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.

1.2 Scope of data processing, purposes of processing and legal bases

The scope and purposes of data processing, as well as the legal bases, are explained in detail below. In general, the following legal bases may apply to the processing of data:

• Art. 6(1)(a) GDPR: This is the legal basis for processing operations for which we obtain consent.
• Art. 6(1)(b) GDPR: This is the legal basis where the processing of personal data is necessary for the performance of a contract, for example when a website visitor purchases a product from us or we provide a service to them.
• Art. 6(1)(c) GDPR: This applies when we process personal data to comply with a legal obligation, as may be the case, for example, under tax law.
• Art. 6(1)(f) GDPR: This is the legal basis when we rely on legitimate interests to process personal data, for example for cookies that are necessary for the technical operation of our website.

1.3 Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions adopted by the European Commission pursuant to Art. 45(3) GDPR ensure that the data is protected when transferred, where such decisions exist. If no adequacy decision exists, the legal basis for the data transfer will generally be the standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

1.4 Data retention period

Unless expressly stated otherwise in this Privacy Policy, the data we store will be deleted as soon as it is no longer required for its intended purpose, provided that no statutory retention obligations prevent deletion.

1.5 Data subjects’ rights

Data subjects have the following rights in relation to their personal data:

• Right of access
• Right to rectification or erasure
• Right to restriction of processing
• Right to object to processing
• Right to data portability
• Right to withdraw consent at any time

Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. Contact details for the data protection supervisory authorities are available at https://www.bfdi.bund.de.

1.6 Obligation to provide data

In the course of a business relationship, customers, prospective customers or third parties are only required to provide us with the personal data necessary to establish, perform and terminate the business relationship, or data that we are legally required to collect. As a rule, without this data we will have to refuse to enter into a contract. Mandatory information is identified as such.

1.7 Contacting us

When you contact us, for example by email or telephone, we store the data you provide (such as your name and email address) in order to respond to your questions. The legal basis for processing is our legitimate interest (Art. 6(1)(f) GDPR). We delete the data collected in this context once it is no longer necessary to retain it.

2. Newsletter

We reserve the right to inform customers who have already used our services or purchased goods about our offers by email from time to time, provided they have not objected to this. The legal basis for this data processing is Art. 6(1)(f) GDPR. Customers may object to the use of their email address for advertising purposes at any time and free of charge.

Interested parties may subscribe to a free newsletter. We process the data provided during registration solely for the purpose of sending the newsletter. The legal basis is Art. 6(1)(a) GDPR. Consent may be withdrawn at any time.

3. Data processing on our website

3.1 Informational use of the website

When the website is used for informational purposes, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. The legal basis is Art. 6(1)(f) GDPR.

This data includes:

• IP address
• Date and time of the request
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Browser and operating system

This data is stored in log files and deleted after 14 days.

3.2 Web hosting and provision of the website

Our website is hosted by DYNAbit Systemhaus GmbH, Alt-Moabit 94, 10559 Berlin, under a data processing agreement. The legal basis is Art. 6(1)(f) GDPR.

3.3 Contact form

When you contact us using the contact form on our website, we store the data requested in the form and the content of your message. The legal basis is Art. 6(1)(f) GDPR. We delete the data once it is no longer necessary to retain it.

3.4 Customer account

Visitors can create a customer account on our website. We process the requested data on the basis of the website visitor’s consent. The legal basis is Art. 6(1)(a) GDPR. Consent may be withdrawn at any time.

3.5 Ordering wine and Crémant

We offer wine and Crémant for sale through our website. As part of the ordering process, we process the following data:

• First and last name
• Billing address
• Delivery address
• Telephone number
• Email address

Processing is necessary for the performance of the contract concluded with the website visitor (Art. 6(1)(b) GDPR).

We share the data required for delivery with the following service providers:

• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
• Shipping service provider of our choice

3.6 Payment service providers

We use various payment processors to process payments. These providers act as independent data controllers under data protection law and include:

• Credit card providers (Visa, Mastercard, American Express)
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
• Apple Inc., USA (for Apple Pay)
• Klarna Bank AB (publ), Sweden

The legal basis is Art. 6(1)(b) GDPR.

3.7 Technically necessary cookies

Our website uses cookies. Cookies are small text files stored in your web browser. Where these cookies are necessary for the operation of our website, the legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in providing a fully functional website.

Specifically, we use technically necessary cookies for the following purposes:

• Cookies that store the shopping cart
• Cookies that store login details
• Cookies set by payment providers to process payments

3.8 External service providers and analytics tools

Google Analytics

We use Google Analytics for analysis. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data in the USA. The legal basis is Art. 6(1)(a) GDPR (consent). The legal basis for the transfer is the standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Further information: https://policies.google.com/privacy?hl=de

Google Tag Manager

We use Google Tag Manager to manage analytics and advertising tags. The provider is Google Ireland Limited. The legal basis is Art. 6(1)(a) GDPR. Further information: https://policies.google.com/privacy?hl=de

Meta Pixel (Facebook Pixel)

We use Meta Pixel for analysis. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data in the USA. The legal basis is Art. 6(1)(a) GDPR. The legal basis for the transfer is the standard contractual clauses. Further information: https://www.facebook.com/policy.php

Microsoft Clarity

We use Microsoft Clarity for website analytics. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. The provider processes usage data in the EU. The legal basis is Art. 6(1)(a) GDPR. Further information: https://privacy.microsoft.com/de-de/privacystatement

Trustpilot

We use Trustpilot for customer reviews. The provider is Trustpilot A/S, Pilestraede 58, 5th Floor, DK-1112 Copenhagen K, Denmark. The legal basis is Art. 6(1)(f) GDPR. Further information: https://de.legal.trustpilot.com

Criteo

We use Criteo for advertising. The provider is Criteo SA, 32 rue Blanche, 75009 Paris, France. The legal basis is Art. 6(1)(a) GDPR. Data is stored for a maximum of 13 months. Further information: https://www.criteo.com/de/privacy/

Other analytics and marketing tools

We also use the following tools for analytics and marketing, in each case on the basis of Art. 6(1)(a) GDPR (consent):

• Google Marketing Platform
• Google Merchant Center
• Microsoft Advertising
• Awin (affiliate marketing)
• TrustedShops (quality seal)
• AB Tasty (A/B testing)

Customer surveys and feedback

We use Zenloop to collect customer feedback. The provider is SaaS.group zenloop GmbH, Rathausgasse 1, 12529 Schönefeld, Germany. The legal basis is Art. 6(1)(a) GDPR. We have concluded a data processing agreement pursuant to Art. 28(3) GDPR. Further information: www.zenloop.com

4. Data processing on social media platforms

We maintain a presence on social media networks to present our organisation and services. The operators of these networks regularly process their users’ data for advertising purposes. When users contact us through our profiles on these networks, we process the information they provide in order to respond to their enquiries. The legal basis is Art. 6(1)(f) GDPR.

4.1 Facebook

The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy Policy: https://www.facebook.com/policy.php. Under an agreement pursuant to Art. 26 GDPR, we are jointly responsible with Facebook for the processing of data.

4.2 Instagram

The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy Policy: https://help.instagram.com/519522125107875

4.3 YouTube

The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy Policy: https://policies.google.com/privacy?hl=de

4.4 TikTok

The operator is musical.ly Inc., 10351 Santa Monica Blvd #310, Los Angeles, CA 90025, USA. Privacy Policy: https://www.tiktok.com/de/privacy-policy

4.5 LinkedIn

The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy Policy: https://www.linkedin.com/legal/privacy-policy

4.6 Pinterest

The operator is Pinterest Inc., 505 Brannan Street, San Francisco, CA 94107, USA. Privacy Policy: https://policy.pinterest.com/de/privacy-policy

5. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy with effect for the future. The current version is always available on this page.

6. Questions and contact

If you have any questions or comments regarding this Privacy Policy, please feel free to contact us using the contact details provided above.

© Maison Valérion | Lindenstr. 3-4, 12207 Berlin
Last updated: September 2026