Global Privacy Policy

Maison L'Alchimiste is dedicated to creating olfactory and cosmetic compositions of exception, and we bring that same dedication to the trust placed in us by every Client. This Global Privacy Policy (the “Policy”) describes, with transparency and precision, how we collect, use, share, and protect the personal data of visitors to and clients of our online boutique, wherever they may be located. MAISON L'ALCHIMISTE, LLC, a company organized under the laws of the United States of America, with its registered office at 610 Undercliff Avenue, Edgewater - NJ (hereinafter “Maison,” “we,” or “our Maison”), operates the global online boutique www.maisonlalchimiste.com. Although our headquarters are located in the United States, we honor and respect the privacy of our clientele in every territory in which we operate, in accordance with the leading applicable international data protection frameworks. 1. Scope of Application This Policy applies to all personal data processed in connection with browsing, registration, purchasing, and the relationship with Maison, through our online boutique, applications, service channels, and electronic communications, regardless of the data subject's country of origin. By accessing our online boutique or providing us with personal data, the data subject acknowledges having read and understood the terms of this Policy, which applies together with Maison's International Terms and Conditions of Use and Sale and Cookie Policy. 2. Compliance with International Privacy Frameworks Maison has structured its privacy program to observe, in harmonized fashion, the following regulatory frameworks, among others applicable depending on the data subject's place of residence: • the Brazilian General Data Protection Law — Law No. 13,709/2018 (“LGPD”), for data subjects located in Brazil; • the General Data Protection Regulation (“GDPR” — Regulation (EU) 2016/679), for data subjects located in the European Economic Area, the United Kingdom, and Switzerland; • the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other applicable U.S. state privacy laws; and other national personal data protection laws that may, as the case may be, confer mandatory rights on data subjects in their country of residence. To the extent such laws diverge from one another, Maison will apply, for each data subject, whichever is the more protective standard between that required by the law of their residence and the voluntary commitments undertaken in this Policy. 3. Personal Data Collected 3.1. Data Provided Directly by the Data Subject We collect the data that the data subject voluntarily provides to us, such as: full name, billing and delivery addresses, e-mail address, telephone number, payment data (processed by specialized, certified providers, as described in Section 8), date of birth (when necessary for age verification), communication preferences, and, where applicable, data provided on the occasion of personalized service consultations (for example, olfactory curation consultations). 3.2. Data Collected Automatically While browsing our online boutique, we automatically collect technical information such as IP address, device identifiers, browser type, operating system, pages visited, products viewed, time spent, and referral source, through cookies and similar technologies, as further detailed in our Cookie Policy. 3.3. Data for Personalization of the Luxury Experience For the sole purpose of delivering an experience worthy of the Maison standard, we process data relating to purchase history, preferred fragrances and formulations, declared sensory preferences, and interactions with our client service team. This data allows us to anticipate preferences, curate recommendations, and reserve, exclusively, opportunities suited to each client's profile. 3.4. Sensitive Categories Should the data subject choose to voluntarily share sensitive information relating to skin sensitivities, allergies, or health-related restrictions, for purposes of safe product recommendation, such data will be processed with enhanced safeguards and only upon specific, prominent, and unambiguous consent, which may be withdrawn at any time. 4. Purposes of Processing Personal data is processed for the following purposes: • to process orders, payments, international deliveries, and any returns; • to authenticate access and maintain the security of the account and shopping bag; • to personalize the shopping experience, including recommendations of fragrances and products compatible with purchase history and declared preferences; • to provide excellent service, including pre- and post-sale support and olfactory consultation; • to communicate news, launches, and exclusive invitations, where the data subject has consented thereto; • to comply with legal, regulatory, tax, customs, and fraud-prevention obligations; and • to exercise, defend, or assert Maison's rights in administrative or judicial proceedings. 5. Legal Bases for Processing Maison processes personal data on the basis of one or more of the following legal grounds, depending on the law applicable to the data subject: (i) performance of a contract or of preliminary steps taken at the data subject's request; (ii) compliance with a legal or regulatory obligation; (iii) Maison's legitimate interest, always weighed against the data subject's fundamental rights and freedoms; and (iv) freely given, informed, and unambiguous consent, in particular for direct marketing purposes and for the processing of sensitive data. For data subjects in the European Union and the European Economic Area, the legal bases correspond to the grounds set out in Article 6 of the GDPR (and, where applicable, Article 9, for special categories of data). For data subjects in Brazil, the grounds set out in Article 7 of the LGPD apply (and Article 11, where relevant). 6. Sharing of Personal Data Maison does not sell, rent, or otherwise make available to third parties, for such third parties' own commercial purposes, the highly personal data of its clientele. Data is shared, in limited and proportionate fashion, exclusively with: • international logistics providers, customs brokers, and carriers, to enable delivery of orders; • payment processors certified under the PCI-DSS standard, for the validation and financial settlement of transactions; • information technology, hosting, and cybersecurity providers, subject to strict contractual confidentiality obligations; • legal, accounting, and audit advisors, when strictly necessary; and • competent public authorities, where required by law, court order, or legitimate regulatory request. Every provider that processes personal data on Maison's behalf is contractually bound to observe confidentiality and security standards equivalent to those described herein, and is prohibited from using the data for purposes other than those instructed by Maison. 7. International Data Transfer Because our corporate headquarters are located in the United States and our operations are, by nature, global, the personal data we collect may be transferred to, stored, and processed on servers located in the United States and in other countries where Maison or its service providers maintain operations. For data subjects located in the European Union, the European Economic Area, the United Kingdom, and Brazil, Maison adopts recognized international transfer mechanisms, including, as applicable: (i) Standard Contractual Clauses approved by the European Commission or by the Brazilian National Data Protection Authority (“ANPD”), as applicable; (ii) adequacy decisions, where they exist; and (iii) other appropriate contractual and technical safeguards, including encryption in transit and at rest. The data subject may request additional information regarding the safeguards applicable to the international transfer of their data through the channels indicated in Section 14 of this Policy. 8. Information Security Maison adopts technical and organizational measures that are rigorous and proportionate to the value and sensitivity of the data processed, including encryption, least-privilege access controls, continuous monitoring, environment segmentation, and periodic security testing. No system is absolutely impregnable; nonetheless, Maison commits to maintaining security practices consistent with the highest standards of the luxury sector and to notifying data subjects and the competent authorities in the event of a security incident that may pose a material risk, within the timeframes and in the manner required by applicable law. 9. Data Retention Personal data is retained for the period necessary to fulfill the purposes for which it was collected, subject to the statutory retention periods applicable for tax, accounting, customs, and defense purposes in judicial or administrative proceedings. Once those purposes have been fulfilled, the data will be deleted, anonymized, or rendered inaccessible, except where legally required to be retained. 10. Rights of Data Subjects Without prejudice to any additional rights provided under the law of the data subject's place of residence, Maison recognizes and enables the exercise of the following rights, as applicable: 10.1. Data Subjects in Brazil (LGPD) Confirmation of the existence of processing; access to data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the law; portability of data to another provider; deletion of personal data processed on the basis of consent; information about the entities with which the data has been shared; information on the possibility of not providing consent and the consequences thereof; and withdrawal of consent. 10.2. Data Subjects in the European Union and the European Economic Area (GDPR) The right of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing (including for direct marketing purposes and profiling), and the right not to be subject solely to automated decision-making that produces legal effects of similar significance. The data subject also has the right to lodge a complaint with the data protection supervisory authority of their country of residence. 10.3. Data Subjects in California and Other U.S. States with Applicable Legislation (CCPA/CPRA) The right to know which specific categories and elements of personal information are collected, used, disclosed, or sold; the right to deletion; the right to correction; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; the right to be informed of, and to opt out of, the use of automated decision-making technology (“ADMT”) in significant decisions, where applicable; and the right not to receive discriminatory treatment for exercising these rights. Maison states that it does not sell personal data in the traditional sense of the term, but recognizes and enables the exercise of all applicable rights under the CCPA/CPRA. 10.4. How to Exercise Your Rights Requests relating to the exercise of privacy rights may be submitted at any time to contact@maisonlalchimiste.com. Maison will respond within the timeframes legally required in the data subject's jurisdiction, and may request additional information strictly necessary to verify the requester's identity before processing the request, as a safeguard against fraud. 11. Non-Discrimination and Non-Commercialization of Highly Personal Data The exercise of any privacy right by the data subject will never result in prejudice, discrimination, or a reduction in the quality of service provided by Maison. We reiterate, with absolute clarity, that the highly personal and sensitive data of our clientele is never made available to third parties for independent commercial exploitation. 12. Cookies and Similar Technologies The use of cookies and similar technologies on our online boutique is governed by a dedicated document — Maison's Cookie Policy — which forms an integral part of this Global Privacy Policy. 13. Privacy of Minors Maison's online boutique is intended for persons 18 (eighteen) years of age or older. We do not knowingly collect personal data from minors. Should Maison become aware that a minor's data has been collected without the verifiable consent of a legal guardian, it will take appropriate steps to delete such data promptly. 14. Data Protection Officer and Contact Channel To exercise their rights, raise questions, or submit inquiries relating to this Policy, the data subject may contact our Data Protection Officer: • Data Protection Officer (DPO): Alex Albuquerque; • E-mail: contact@maisonlalchimiste.com; • Postal address: 610 Undercliff Avenue, Edgewater - NJ. 15. Changes to This Policy Maison may update this Policy from time to time to reflect legislative, operational, or technological changes. The version in force will always be made available on our online boutique, indicating the date of its last update. Material changes will be communicated through appropriate means before they take effect, where required by law. 16. Governing Law of This Policy This Global Privacy Policy is governed, as to its general aspects, by the laws of the State of New Jersey, United States of America, without prejudice to the application, with respect to mandatory data protection rights, of the law of each data subject's country of residence, which shall prevail to the extent so required. 17. Contact For any questions regarding this Policy, please contact: MAISON L'ALCHIMISTE, LLC, 610 Undercliff Avenue, Edgewater - NJ, e-mail contact@maisonlalchimiste.com.