Privacy policy
Last updated: September 2026
MAJNOON operates this store and website and the related services (the “Services”). MAJNOON is a store powered by Shopify. This policy describes how we collect, use and disclose your personal information when you access or use the Services or make a purchase. Where it conflicts with our terms of sale, this policy prevails on everything concerning your personal information.
Data controller
The data we collect
When you place an order
Name, delivery and billing address, email address, telephone number, and the details and amount of your order.
When you pay
Your card details are entered directly on the secure Shopify Payments interface. They do not pass through our servers and we never have access to them. We keep only the last four digits and the card type, solely for accounting reconciliation and refunds.
When you create an account or subscribe to the newsletter
Your email address, and any information you choose to save in your account.
When you browse the site
IP address, browser and device type, pages viewed, date and time of connection, referring site. This comes from the cookies described in Part 7.
We collect no special category data within the meaning of Article 9 GDPR, and the site is not directed at people under fifteen.
Legal bases and retention periods
Under Articles 6 and 13 GDPR, the table below states, for each purpose, the legal basis for processing and how long the data is kept.
|
Purpose |
Legal basis |
Retention |
|
Process your order, ship it, handle returns, exchanges and customer service |
Performance of the contract (Art. 6.1.b) |
3 years from your last order |
|
Issue and keep invoices and accounting records |
Legal obligation (Art. 6.1.c) |
10 years (Art. L.123-22, French Commercial Code) |
|
Create and manage your customer account |
Performance of the contract (Art. 6.1.b) |
Until deletion, or 3 years of inactivity |
|
Send you our newsletter and promotions by email |
Consent (Art. 6.1.a) |
Until consent is withdrawn, and at most 3 years without interaction |
|
Measure site traffic |
Consent (Art. 6.1.a) |
Cookies: 13 months. Data from cookies: 25 months |
|
Authenticate accounts, secure payments and prevent fraud |
Legitimate interest (Art. 6.1.f) |
Duration of the commercial relationship; 1 year for connection logs |
|
Respond to legal requests and handle disputes |
Legal obligation and legitimate interest (Art. 6.1.c and 6.1.f) |
Duration of proceedings plus limitation periods |
Withdrawing consent does not affect the lawfulness of processing carried out beforehand. Once these periods expire, data is deleted or anonymised unless a longer legal retention applies.
Who receives your data
Your data is neither sold, rented nor transferred to third parties for commercial purposes. It is shared only with the providers strictly necessary to run the store, which act as processors on our instructions:
Your data may also be passed to administrative or judicial authorities where the law requires it.
Relationship with Shopify
The Services are hosted by Shopify, which collects and processes information about your access to the Services in order to provide and improve them. For certain features Shopify is itself the controller: you can consult its privacy policy and privacy portal at privacy.shopify.com.
Transfers outside the European Union
Shopify is established outside the European Union and some data may be hosted or processed in Canada and the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission, supplemented where applicable by the providers' adherence to the EU–US Data Privacy Framework.
Security
The site is served entirely over HTTPS. Payments are handled by Shopify Payments, which complies with the PCI-DSS standard. Access to order data is limited to the controller and protected by individual authentication.
No system is infallible. Should a data breach occur that is likely to result in a high risk to your rights, we undertake to inform you and to notify the CNIL within the periods set out in the GDPR.
Children's data
Under Article 7-1 of French Act No. 78-17 of 6 January 1978 as amended, processing the data of a child under fifteen on the basis of consent is lawful only where that consent is given jointly by the child and the holder of parental responsibility. We do not knowingly collect such data; if you are the parent or guardian of a child who has provided it, write to us to request its deletion.
Your rights
You have the following rights. They are not absolute: in some cases we may refuse a request to the extent the law allows, in particular where retention answers a legal obligation.
To exercise these rights, write to majnoonbrand@gmail.com or to 20 rue du Docteur Pinel, 94000 Créteil, France. We reply within one month, extendable to three months where the request is complex. We may ask for proof of identity in case of reasonable doubt. Exercising these rights is free of charge.
Complaints
If you wish to complain, please contact us first. If our response does not satisfy you, you may lodge a complaint with the French data protection authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. If you live in another country of the European Economic Area, you may contact the supervisory authority of your country of residence.
Changes
This policy may be updated to reflect changes in our practices or for legal or regulatory reasons. The version that applies is the one published on the site on the date of your visit.