Privacy Policy

This privacy policy is intended to inform users and customers of the maisonratti.fr website, whether individuals (B2C) or professionals (B2B), of how their personal data is collected, used, retained and protected, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR), French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and the recommendations of the Commission Nationale de l'Informatique et des Libertés (CNIL).

The website is published and operated by WM Expert (SELAS), under the trading name "Maison Ratti". The company's full details are set out in the legal notice of the website.

By using the website, creating an account, placing an order, or submitting a quote request, you acknowledge that you have read and understood this policy.

The controller responsible for the personal data collected and processed in connection with the operation of the website is WM Expert (SELAS), operating the Maison Ratti brand, whose full details are set out in the legal notice.

Within the meaning of Article 4(7) of the GDPR, WM Expert determines the purposes and means of processing the data collected via the website: WM Expert is therefore legally responsible for complying with the principles of lawfulness, minimisation, security and maintenance of the record of processing activities.

WM Expert does not currently meet the activity thresholds that would require the appointment of a Data Protection Officer (DPO) within the meaning of Article 37 of the GDPR. The contact point below therefore validly serves as the sole point of contact for data protection matters, in a manner proportionate to the size and activity of the organisation.

The GDPR distinguishes between two roles under Articles 4 and 28: the controller (Art. 4(7)) determines the purposes and means of processing; the processor (Art. 4(8) and Art. 28) processes data on behalf of the controller, in accordance with the controller's documented instructions, without determining the purposes of processing.

On the Maison Ratti website, WM Expert is the data controller: it decides which data is collected, why, for how long, and with which service providers. Shopify International Limited acts as a processor: it provides the technical hosting infrastructure for the website and the Shopify Payments payment solution, strictly within the instructions and purposes defined by WM Expert.

In accordance with Article 28 of the GDPR, the relationship between WM Expert and Shopify is governed by a data processing agreement which requires Shopify, among other things, to process data only on documented instructions from WM Expert, to guarantee the confidentiality of persons authorised to process the data, to implement appropriate security measures, not to engage any further sub-processor without authorisation, to assist WM Expert in complying with its obligations, and to delete or return the data at the end of the service. The same applies to any other service provider acting as a processor on behalf of WM Expert (carrier, accounting service provider).

Depending on your use of the website, WM Expert may collect the following categories of data:

• Identity and contact details: surname, first name, e-mail address, delivery/billing postal address, telephone number (collected when placing an order, submitting a contact form, or a B2B quote request);
• Account data: login credentials, order history, any preferences;
• Order data: products ordered, quantities, amounts, dates;
• Payment data: processed directly by Shopify Payments within its secure environment; WM Expert does not access or retain full banking details;
• Browsing data: IP address, browser type and version, operating system, pages viewed, time spent on the site, via cookies and similar technologies (see the cookie policy);
• Professional data (B2B quote request form): company name, contact's job title, sector of activity, volume or nature of the need expressed.

WM Expert only collects data strictly necessary for the purposes pursued (minimisation principle, Art. 5(1)(c) GDPR) and does not collect any special categories of data within the meaning of Article 9 of the GDPR.

Each data processing operation carried out by WM Expert is based on a specific purpose and a legal basis within the meaning of Article 6 of the GDPR, summarised below.

WM Expert does not currently carry out any automated individual decision-making that produces legal effects concerning you or significantly affects you, nor any profiling within the meaning of Article 22 of the GDPR (for example: automated scoring, automatic order refusal, algorithmic price personalisation). Any change to the website that would introduce such processing would be subject to prior notice and, where applicable, to obtaining your consent under the conditions set out in the GDPR.

The personal data collected is intended, internally, for authorised Maison Ratti staff (Arthur and Tom Morel and, where applicable, employees whose duties justify it), strictly within the limits of their respective duties.

It may also be transmitted, to the extent strictly necessary for carrying out the purposes described above, to the following service providers, acting as processors within the meaning of Article 28 of the GDPR or, where applicable, as independent third-party recipients:

• Shopify (Shopify International Limited, Dublin, Ireland): hosting of the e-commerce platform and payment processing via Shopify Payments. The Shopify group, whose parent company Shopify Inc. is based in Canada, may process certain data outside the EU (see section 7). Transfer safeguards: standard contractual clauses adopted by the European Commission, incorporated into Shopify's data processing terms; Canada also benefits from a partial adequacy decision by the European Commission.
• Carrier(s) (selected by WM Expert according to destination and order volume, allowing the use of several service providers): physical delivery of orders (recipient's name, address and telephone number provided for delivery purposes). Processing takes place within the EU, no transfer outside the EU at present.
• Accounting service provider / accountant (where applicable): bookkeeping, compliance with legal invoicing and tax obligations. France, processing within the EU.
• Audience measurement, marketing or communication tools (Google Analytics, Meta Business, Klaviyo, Mailchimp or equivalents): audience measurement, advertising campaigns, sending newsletters. None of these tools is currently configured on the website. Should any of them be implemented in future, this policy and the cookie policy will be updated beforehand, with the required consent collected and a description of the applicable transfer safeguards.

WM Expert ensures, for each processor, that a contract compliant with Article 28 of the GDPR is in place, together with appropriate security safeguards. WM Expert does not sell or rent the personal data of its customers and prospects to third parties for commercial purposes.

WM Expert's data processing agreement is entered into with Shopify International Limited (Dublin, Ireland). The Shopify group, whose parent company Shopify Inc. is based in Canada, may nonetheless process certain data outside the European Economic Area in the course of providing its services.

These transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR, in particular the standard contractual clauses (SCCs) adopted by the European Commission, incorporated by Shopify into its data processing terms, and, where applicable, an adequacy decision by the European Commission recognising an equivalent level of protection in the recipient country.

No other transfer outside the EU has been identified to date in connection with the operation of the website. Any change in this respect will result in an update to this section.

In accordance with the storage limitation principle (Art. 5(1)(e) GDPR), data is retained for the period strictly necessary for the purposes for which it was collected, in compliance with applicable statutory periods. Once these periods expire, the data is either deleted or irreversibly anonymised, subject to any intermediate archiving obligations for evidentiary purposes required by law.

In accordance with the GDPR (Articles 15 to 22) and the French Data Protection Act, you have the following rights over data concerning you:

• Right of access (Art. 15): obtain confirmation that data concerning you is being processed, and obtain a copy of it;
• Right to rectification (Art. 16): have inaccurate or incomplete data corrected;
• Right to erasure (the "right to be forgotten", Art. 17), in the cases provided for by the GDPR;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20), for data provided and processed on a contractual basis or on the basis of consent;
• Right to object (Art. 21), in particular at any time with regard to commercial prospecting;
• Right to withdraw your consent at any time, where processing is based on consent;
• Right to set guidelines on the fate of your data after your death (Article 85 of the French Data Protection Act).

These rights may be exercised by sending your request by e-mail to contact@maisonratti.fr, for the attention of Arthur Morel and Tom Morel, or by post to the registered office address of WM Expert as stated in the legal notice. WM Expert may ask you to provide proof of your identity where reasonable doubt exists as to the identity of the person making the request, in accordance with Article 12(6) of the GDPR.

In accordance with Article 12(3) of the GDPR, WM Expert undertakes to respond to your request within one month of receiving it, which may be extended by a further two months given the complexity or number of requests, with prior notice of such extension.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

The website offers artisanal confectionery products for sale to the general public and is intended for adults with the legal capacity to enter into contracts online. It is not specifically designed for, or intended to be used by, minors.

WM Expert does not knowingly collect personal data relating to minors without the consent or supervision of a legal representative. If you are a parent or legal guardian and become aware that a minor in your care has submitted personal data via the website without your consent, you may contact contact@maisonratti.fr to request its deletion as soon as possible.

The website uses cookies and similar technologies (audience measurement, technical operation, and, where applicable, third-party marketing or analytics tools). Full details of the nature of the cookies used, their purposes, their retention period and how to manage your consent are set out in Maison Ratti's cookie policy, which supplements and clarifies this privacy policy on this specific point.

WM Expert implements appropriate technical and organisational measures, in accordance with Article 32 of the GDPR, to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access, in particular relying on Shopify's secure and certified infrastructure (encryption of exchanges via the HTTPS/TLS protocol, PCI-DSS compliance for payment processing), access to data restricted to authorised personnel only, and backup and access management procedures appropriate to the size of the organisation.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, WM Expert undertakes to notify the CNIL of such breach as soon as possible and, where necessary, to inform you directly, in accordance with Articles 33 and 34 of the GDPR.

This policy may be updated from time to time, in particular to reflect changes in legislation and regulations, developments in the website's features, or the addition of new service providers or tools. In the event of any substantial change, WM Expert undertakes to inform users through an appropriate means before it comes into effect. We invite you to check this page regularly to stay informed of any changes.