1. Data controller
The controller is Rosalie Mockey, sole trader — MR WAX, 114 boulevard de l’Hôpital, 75013 Paris, France. Privacy contact: rosalie.mockey@mrwaxshop.com — +33 7 69 75 19 16. No Data Protection Officer is appointed at launch.
2. Data collected
Depending on how you use the website, MR WAX may process identity and contact details, main and delivery addresses, basket content, orders, products, payment status, DHL tracking, pickup information, customer accounts, consent records, newsletter information, reviews, referrals, campaigns, WhatsApp interactions, technical information, IP address, browser, cookies, UTM parameters and browsing events.
MR WAX never receives or stores the full card number or security code. Those details are entered directly in the secure environment of the payment provider.
3. Purposes and legal bases
- Fulfilling orders, payments, delivery, pickup, returns, guarantees and complaints: performance of the contract and legal obligations.
- Creating and securing the customer area, preventing fraud, maintaining the website and security logs: performance of the contract and legitimate interests.
- Sending order, payment, account and security notifications: performance of the contract.
- Sending newsletters, offers, WhatsApp marketing, prospect reminders and personalised advertising: consent where required.
- Offering similar fabrics to an existing customer: legitimate interests where permitted by law, with clear information and an easy opt-out.
- Managing reviews, referrals, statistics and service improvement: consent, performance of the requested service or legitimate interests depending on the feature.
- Keeping invoices, evidence and tax records: legal obligations.
4. Automatic customer account
When checkout information is entered, MR WAX may create a customer record and provision an inactive account to attach the order and facilitate tracking. No password is required during purchase. Activation from the invitation email is optional. Even without activation, DHL tracking is available through the tracking number and link supplied.
5. Payments and fraud prevention
The chosen payment provider receives the information needed to authorise and confirm the transaction. Stripe, PayPal or a mobile-money provider may apply its own fraud checks and regulatory obligations. MR WAX keeps the transaction reference, amount, status, date and necessary evidence, but not full card details.
6. DHL delivery and pickup
For delivery, MR WAX sends DHL the contact details, address, logistical contents, declared value where required and information needed for transport and customs clearance. For pickup, the information is used to prepare the order, arrange an appointment and send necessary reminders.
7. Recipients and service providers
Data is available to authorised MR WAX personnel and, depending on the services actually enabled, to OVHcloud, DHL, Stripe, PayPal, Wave, Orange Money, MTN, Wero or its payment provider, the bank, the SMTP provider, Sender or Brevo, Meta/WhatsApp/Facebook/Instagram, TikTok, Google Analytics, Google Ads, Google Business Profile when the review integration is enabled, and necessary technical service providers. Each recipient receives only the data required for its role.
8. Transfers outside the European Economic Area
Some international providers may process data outside the European Economic Area. Depending on the provider and country, the transfer relies on an adequacy decision, European Commission Standard Contractual Clauses or another recognised safeguard. The actual list depends on the services enabled in the back office.
9. Retention periods
- Anonymous basket: 7 days.
- Identifiable abandoned basket and provisional account without an order: 30 days.
- Detailed browsing events subject to consent: 13 months.
- Aggregated information not directly identifying a person: 25 months.
- Prospects and newsletter subscribers: 3 years after the last active contact.
- Customer marketing data: during the relationship and 3 years after the last purchase.
- Consent evidence: 5 years after withdrawal or the end of its use.
- Opt-out and suppression list: 5 years.
- Inactive customer account: 3 years after the last activity, except legally required records.
- Complaints and contractual evidence: 5 years after closure.
- Invoices and accounting records: 10 years.
- Technical and security logs: 12 months.
- Reviews: while the product is marketed, until a deletion request, or for the time necessary to prove authenticity.
10. Newsletter, campaigns and abandoned baskets
Newsletter subscription uses an unticked checkbox and double opt-in. Every marketing message includes one-click unsubscribe. Creating an account or placing an order does not automatically subscribe a person to the newsletter.
An abandoned-basket reminder is sent to a prospect only where valid marketing consent exists. An existing customer may receive offers for similar fabrics where permitted by law, provided the customer was informed and can easily object.
11. WhatsApp, social networks and referrals
Transactional WhatsApp order notifications are separate from marketing campaigns. WhatsApp marketing requires appropriate consent. Interactions with Facebook, Instagram and TikTok also depend on the settings and policies of those platforms. The referral programme uses codes, clicks, orders and rewards needed to attribute benefits and prevent fraud.
12. Customer reviews
After checkout, MR WAX may offer a short private survey about the shopping experience. After delivery or pickup, MR WAX may invite the customer to submit an internal review linked to the order and, when enabled, separately publish a review on Google Business Profile.
External invitations are offered without an incentive, reward or selection based on the internal rating. After moderation, an internal review may display the first name, initials, city and country, together with a “Verified purchase” label. The customer may request deletion. MR WAX keeps the information needed to verify that the review follows a genuine purchase experience. A review published on Google remains subject to Google rules and must be managed on that platform.
13. Cookies and analytics
The website distinguishes necessary storage, audience measurement and marketing/advertising. Non-essential trackers are blocked until you consent. The banner offers “Accept all”, “Reject all” and “Customise” with comparable prominence. The choice is kept for six months and can be changed at any time through “Manage my cookies”.
Google Analytics, Google Ads, Meta Ads/Pixel and TikTok Ads/Pixel are loaded only after consent when enabled. Internal analytics that follow an individual journey or attribute a campaign are also consent-based. Data strictly necessary for the basket, security, language and authentication works without optional consent. Marketing QR codes record a pseudonymised scan and the relevant printed support in order to measure usage. Attribution of a journey or order to a QR campaign is stored in the browser only after marketing consent.
14. Your rights
You may request access, correction, deletion, restriction, objection and portability, and may withdraw consent, by writing to rosalie.mockey@mrwaxshop.com. A deletion request may also be submitted through the customer area; the administrator verifies it and deletes or anonymises data where possible. Invoices, evidence and records still required by law or needed to defend legal claims may be kept in a separate archive.
MR WAX normally responds within one month. You may complain to the French data protection authority, the CNIL, if you believe your rights have not been respected.
15. Security and updates
MR WAX uses measures including HTTPS, access controls, encrypted secrets, backups, rate limiting, security logs and separation of sensitive configurations. As no system is infallible, the measures are adapted to the risks and development of the service. The applicable version and date are displayed at the top of this policy.