Privacy policy

Last updated: 16 August 2026

Maison Sablé respects your privacy and is committed to protecting your personal data.

This Privacy, Data Protection, Security & Retention Policy explains how Maison Sablé collects, uses, processes, shares, stores, retains and protects personal information when you visit our website, place an order, arrange delivery or collection, contact us, subscribe to our communications or otherwise interact with Maison Sablé.

This Policy has been prepared with regard to the General Data Protection Regulation (EU) 2016/679, known as the GDPR, the Data Protection Act, Chapter 586 of the Laws of Malta, applicable Maltese tax, accounting and company law requirements and other applicable Maltese and European legislation.

1. Who We Are

Maison Sablé is a Malta based food and gifting business specialising in handcrafted cookies, gift boxes and related products.

For the purposes of applicable data protection legislation, Maison Sablé is the data controller in respect of personal data for which it determines the purposes and means of processing.

Maison Sablé
Malta
Email: hello-remove-this-@maisonsablemalta.com
Website: maisonsablemalta.com

References in this Policy to “Maison Sablé”, “we”, “us” and “our” refer to Maison Sablé.

2. Scope of This Policy

This Policy applies to personal information collected through:

• Our website
• Online orders
• Customer accounts, where available
• Delivery and collection arrangements
• Email communications
• Customer service enquiries
• Marketing subscriptions
• Social media communications with Maison Sablé
• Promotions and campaigns
• Other interactions with Maison Sablé

It also explains our approach to data retention, cybersecurity, personal data breaches and third party service providers.

3. Personal Data We Collect

The information we collect depends on how you interact with Maison Sablé.

We may collect the following categories of personal information.

Identity and Contact Information

This may include:

• Name
• Surname
• Email address
• Telephone number
• Billing address
• Delivery address

Order and Transaction Information

When you place an order, we may collect:

• Products ordered
• Order number
• Order date
• Order value
• Payment status
• Payment method
• Delivery or collection information
• Delivery instructions
• Gift information or gift messages you choose to provide
• Order history
• Refund information
• Cancellation information
• Customer service information relating to the order

Payment Information

Payments made through our website are processed by authorised third party payment providers.

Maison Sablé does not generally receive or store complete credit or debit card details.

We may receive and retain limited information relating to a transaction, such as:

• Transaction reference
• Amount paid
• Payment method
• Payment status
• Refund status

Payment providers process payment information in accordance with their own privacy policies, security procedures and legal obligations.

Website and Technical Information

When you visit our website, certain information may be collected automatically, including:

• IP address
• Browser type
• Device type
• Operating system
• Pages viewed
• Date and time of visits
• Website interactions
• Referring website or source
• Cookie identifiers
• Similar technical information

Communications

If you communicate with Maison Sablé by email, through our website, through social media or by another communication method, we may retain:

• Your contact information
• The contents of your communication
• Information necessary to respond to your request
• Our response
• Relevant subsequent correspondence

Marketing Information

Where you subscribe to Maison Sablé marketing communications, we may process:

• Your name
• Email address
• Marketing preferences
• Subscription status
• Information regarding your interaction with our marketing communications

4. Information You Provide About Other People

You may occasionally provide personal information concerning another person, for example when:

• Sending Maison Sablé products as a gift
• Providing a recipient's delivery address
• Providing a recipient's telephone number
• Including a gift message
• Arranging delivery on behalf of another person

Where you provide another person's personal information, you should only provide information that is reasonably necessary for the relevant purpose and that you are entitled to provide to us.

We ask that you do not include unnecessary sensitive or confidential personal information in gift messages, delivery instructions or order notes.

5. How We Collect Personal Data

We may collect personal information directly from you when you:

• Visit our website
• Place an order
• Create or use a customer account
• Arrange delivery or collection
• Contact us regarding an order
• Submit an enquiry
• Subscribe to marketing communications
• Complete a website form
• Communicate with us by email
• Communicate with us through social media
• Participate in a promotion or other Maison Sablé activity

Certain technical information may be collected automatically through cookies and similar technologies.

We may also receive limited information from third parties involved in providing our services, including ecommerce providers, payment processors and delivery providers.

6. How We Use Personal Data

Maison Sablé may use personal information to:

• Receive and process orders
• Process and verify payments
• Prepare orders
• Arrange delivery or collection
• Communicate regarding an order
• Process cancellations, amendments and refunds
• Respond to enquiries and complaints
• Provide customer service
• Maintain appropriate business records
• Operate and maintain our website
• Protect our website, accounts and systems
• Detect and prevent fraud and misuse
• Investigate suspicious transactions or activity
• Improve our products, website and customer experience
• Perform analytics where permitted
• Maintain financial and accounting records
• Comply with tax and VAT obligations
• Comply with other legal and regulatory requirements
• Establish, exercise or defend legal claims
• Send marketing communications where permitted by law

We do not sell or rent your personal information.

7. Our Legal Bases for Processing

Under the GDPR, Maison Sablé must have a lawful basis for processing personal data.

Depending on the circumstances, we may rely on one or more of the following.

Performance of a Contract

We process information where necessary to enter into or perform a contract with you.

This includes processing necessary to receive, prepare, deliver or otherwise fulfil an order.

Legal Obligation

We process or retain information where necessary to comply with applicable legal obligations, including Maltese accounting, tax, VAT and regulatory requirements.

Legitimate Interests

We may process information where reasonably necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms.

These interests may include:

• Operating Maison Sablé
• Providing customer service
• Protecting our website and systems
• Preventing fraud
• Maintaining appropriate records
• Improving our services
• Protecting our legal rights

Consent

We rely on consent where required, including for certain marketing communications and non essential cookies.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

8. Sharing Personal Data

Maison Sablé does not sell or rent your personal data.

We may share limited information with trusted third parties where reasonably necessary to operate our business or provide our services.

These may include:

• Shopify and other ecommerce providers
• Payment processors
• Delivery and courier providers
• Website hosting providers
• IT and technical service providers
• Email service providers
• Marketing platforms
• Analytics providers
• Cybersecurity and fraud prevention providers
• Accountants
• Lawyers and other professional advisers
• Government, regulatory, tax or law enforcement authorities where required or permitted by law

We seek to limit information shared with third parties to what is reasonably necessary for the relevant purpose.

Where required by law, appropriate contractual, organisational and technical safeguards are used in relation to third parties processing information on our behalf.

9. Shopify

Our online store is powered by Shopify.

Shopify provides the ecommerce infrastructure that enables Maison Sablé to operate its online store and process online orders.

When you visit our website, interact with the online store or place an order, Shopify may process certain personal information.

This may include:

• Device information
• Browser information
• IP address
• Website activity
• Customer information
• Order information
• Transaction information

Shopify processes information subject to applicable data protection requirements and its own privacy documentation.

10. Payment Providers

Payments are processed through authorised third party payment providers.

Payment providers may process information including:

• Your name
• Billing information
• Payment card or account information
• Transaction information
• Device information
• Fraud prevention information

Maison Sablé does not generally receive or store complete payment card details.

Payment providers maintain their own security systems and data retention obligations.

11. Delivery Providers

Where you request delivery, we may provide the person or company completing the delivery with information reasonably necessary to fulfil your order.

This may include:

• Your name
• Recipient's name
• Telephone number
• Delivery address
• Relevant delivery instructions

This information should only be used as necessary to arrange and complete the relevant delivery, subject to any independent legal obligations applicable to the delivery provider.

12. International Data Transfers

Some service providers used by Maison Sablé may process or store personal information outside Malta or the European Economic Area.

Where personal information is transferred internationally, appropriate safeguards will be used where required by applicable data protection law.

Depending on the circumstances, these may include:

• A European Commission adequacy decision
• European Commission approved Standard Contractual Clauses
• Another legally recognised transfer mechanism

13. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies are small files stored on your device and may be used for purposes including:

• Operating our online store
• Maintaining shopping basket functionality
• Remembering preferences
• Maintaining website security
• Preventing fraud
• Understanding website performance
• Analytics
• Improving our website and customer experience
• Marketing and advertising where applicable

Some cookies are strictly necessary for our website to function.

Where required by law, analytics, marketing and other non essential cookies will only be used after you have provided consent.

You may manage your preferences through the cookie settings available on our website.

Session cookies generally expire when you close your browser.

Persistent cookies may remain on your device for a specified period unless you delete them earlier or withdraw the relevant consent.

14. Marketing Communications

Where permitted by law, Maison Sablé may send communications concerning:

• New collections
• New products
• Seasonal releases
• Product availability
• Promotions
• Events
• Maison Sablé news and updates

Where consent is required, these communications will only be sent after consent has been provided.

You may unsubscribe at any time by using the unsubscribe option included in our marketing emails or by contacting:

hello-remove-this-@maisonsablemalta.com

Even after unsubscribing from marketing, you may continue to receive communications necessary to fulfil an order or provide a service you requested.

15. Social Media

Maison Sablé may maintain accounts on social media platforms.

If you interact with Maison Sablé through a social media platform, that platform may process information about you in accordance with its own privacy policy.

If you send Maison Sablé a direct message, enquiry or other communication through social media, we may process the information provided for the purpose of responding and managing the relevant interaction.

16. Data Retention

Maison Sablé follows the GDPR principle of storage limitation.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to comply with applicable legal, accounting, tax, VAT and regulatory obligations.

Different categories of information may therefore be subject to different retention periods.

Financial, Accounting and Tax Records

Financial, accounting, invoice, transaction and tax records may be retained for up to 10 years, or for any longer period required under applicable Maltese law.

This may include:

• Sales records
• Customer invoices
• Supplier invoices
• Receipts
• Credit notes
• Refund records
• Payment records
• Transaction records
• Bank transaction records
• Accounting records
• VAT records
• Tax records
• Records supporting financial statements
• Records relating to business expenditure

Where different statutory retention requirements apply to the same record, Maison Sablé may apply the longer applicable period.

Customer Orders

Customer order information that forms part of Maison Sablé's financial, accounting, tax, VAT or legally required business records may be retained for the applicable statutory period.

This may include:

• Customer name
• Order number
• Order date
• Products purchased
• Amount paid
• Payment status
• VAT information
• Invoice information
• Refund information

Personal information that is not required for these purposes will not automatically be retained for the full statutory accounting period.

Delivery Information

Personal information collected specifically to complete a delivery will be retained only for as long as reasonably necessary to complete the delivery and resolve related issues.

Where delivery information forms part of a legally required transaction record, relevant information may be retained for the applicable statutory period.

Customer Service and Enquiries

General customer enquiries that do not need to form part of a financial, contractual or legal record will normally be retained for up to 2 years after the enquiry has been resolved.

Correspondence concerning an order, complaint, refund, dispute or potential legal claim may be retained for longer where reasonably necessary.

Marketing Information

Marketing information may be retained while you remain subscribed.

If you unsubscribe, we may retain limited information, including your email address and unsubscribe status, where necessary to ensure that your request is respected and further marketing is not inadvertently sent to you.

Customer Accounts

Where customer accounts are available, account information may be retained while the account remains active.

If an account is closed, information that is not otherwise required for legal, accounting, tax, fraud prevention or dispute resolution purposes will be deleted or anonymised within a reasonable period.

Website and Analytics Information

Website usage and analytics information will be retained only for as long as reasonably necessary for the purpose for which it was collected.

Retention periods may vary according to the services and settings used by Maison Sablé.

Where possible and appropriate, information may be aggregated or anonymised.

Legal Claims and Disputes

Where information becomes relevant to an actual or reasonably anticipated complaint, dispute, investigation, regulatory matter or legal proceeding, we may retain it until the matter has been concluded and any applicable limitation period has expired.

17. Deletion and Anonymisation

At the end of the applicable retention period, personal information will, where appropriate, be:

• Securely deleted
• Securely destroyed
• Anonymised so that it no longer identifies an individual

Information that has been genuinely anonymised and can no longer be linked to an identifiable individual may be retained for statistical, analytical and business planning purposes.

18. Requests for Deletion

Under the GDPR, you may have the right to request deletion of your personal information.

The right to deletion is not absolute.

Maison Sablé may be legally entitled or required to retain certain information despite a deletion request.

For example, we may need to retain invoices, transaction records, VAT records, tax records and other accounting information to comply with Maltese law.

We may also retain information where necessary for the establishment, exercise or defence of legal claims or another lawful purpose.

Where no lawful reason for continued retention exists, information subject to a valid deletion request will be deleted in accordance with applicable law.

19. Data Security

Maison Sablé takes appropriate technical and organisational measures designed to protect personal information against:

• Accidental loss
• Unlawful destruction
• Unauthorised access
• Unauthorised disclosure
• Alteration
• Misuse
• Fraud
• Other unlawful processing

Security measures are reviewed as appropriate having regard to the nature of the information processed, available technology, risks associated with processing and the systems and service providers used by Maison Sablé.

We also rely on established third party service providers to maintain appropriate security measures for systems and information under their control.

20. Internet and Cybersecurity Risks

Although Maison Sablé takes reasonable and appropriate measures to protect personal information, no website, ecommerce platform, payment system, hosting provider, cloud service, internet connection, email system or method of electronic storage can be guaranteed to be completely secure.

The transmission and storage of electronic information involve inherent risks.

Cybersecurity incidents may include:

• Hacking
• Phishing
• Malware
• Ransomware
• Credential theft
• Unauthorised system access
• Distributed denial of service attacks
• Exploitation of software vulnerabilities
• Previously unknown or zero day vulnerabilities
• Attacks against third party providers
• Other malicious or unlawful activity

Accordingly, Maison Sablé cannot guarantee that unauthorised third parties will never defeat security measures or that information will never be accidentally or unlawfully accessed, disclosed, altered, lost or destroyed.

21. Personal Data Breaches

If Maison Sablé becomes aware of a personal data breach, we will assess the nature and potential consequences of the incident and take appropriate action in accordance with applicable data protection law.

Depending on the circumstances, this may include:

• Investigating the incident
• Taking reasonable steps to contain the incident
• Working with relevant technology or service providers
• Taking reasonable steps to mitigate potential harm
• Documenting the incident as required
• Implementing appropriate remedial measures

Where required by the GDPR, Maison Sablé will notify the competent supervisory authority without undue delay and, where applicable, within the legally prescribed period.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of affected individuals, Maison Sablé will communicate the breach to affected individuals where required by applicable law.

22. Third Party Security Incidents

Maison Sablé relies on independent third party providers for important parts of its online operations, which may include:

• Ecommerce infrastructure
• Website hosting
• Payment processing
• Email services
• Marketing technology
• Analytics
• Delivery services
• Cloud and technology services

A cybersecurity incident affecting personal information may therefore originate from infrastructure or systems operated or controlled by a third party.

Where we become aware of a third party incident affecting personal information for which Maison Sablé has responsibilities under applicable data protection law, we will take the steps reasonably required of us.

This may include cooperating with the relevant provider, assessing the effect on Maison Sablé customers, taking appropriate mitigation measures and complying with applicable notification requirements.

23. Limitation of Liability Relating to Cybersecurity and Data Breaches

Maison Sablé takes reasonable and appropriate technical and organisational measures intended to protect personal information. However, absolute security cannot be guaranteed.

To the fullest extent permitted by applicable law, Maison Sablé shall not be liable for loss, damage, costs or consequences arising solely from circumstances outside its reasonable control, including:

• Sophisticated malicious cyberattacks
• Unauthorised criminal activity by third parties
• Previously unknown or zero day security vulnerabilities
• Security incidents affecting independent third party platforms or infrastructure
• Failures or vulnerabilities within third party systems outside Maison Sablé's reasonable control
• Internet, telecommunications or infrastructure failures outside Maison Sablé's reasonable control

This limitation applies only to the extent permitted by applicable law and does not apply where liability arises from Maison Sablé's failure to comply with obligations that cannot legally be excluded or limited.

Nothing in this Policy is intended to exclude, restrict or limit:

• Any obligation imposed on Maison Sablé by the GDPR
• Any obligation imposed by applicable Maltese data protection law
• Any legally required personal data breach notification
• Any data subject right that cannot lawfully be waived
• Any liability that cannot lawfully be excluded or limited

Nothing in this section removes Maison Sablé's obligation to implement appropriate technical and organisational security measures in accordance with applicable law.

24. Third Party Services and Limitation of Responsibility

Maison Sablé selects third party providers having regard to the services they provide and, where appropriate, their security and data protection arrangements.

However, independent third party providers operate systems, infrastructure and services that are not under Maison Sablé's direct control.

To the fullest extent permitted by law, Maison Sablé is not responsible for the independent acts, omissions, security failures or unlawful conduct of third parties where those matters are outside Maison Sablé's reasonable control, subject always to Maison Sablé's own obligations under applicable data protection law.

Nothing in this provision limits any responsibility that applicable law places on Maison Sablé regarding the selection, use or supervision of processors or other service providers.

25. Your Security Responsibilities

Where customer account functionality is available, you are responsible for taking reasonable measures to protect credentials under your control.

You should:

• Use a secure password
• Keep passwords and account credentials confidential
• Avoid sharing login credentials
• Take reasonable precautions when accessing your account from shared or public devices
• Contact Maison Sablé promptly if you believe your account or interaction with us has been compromised

Maison Sablé will never ask you to provide your complete payment card password or banking password by email.

26. Your Rights Under the GDPR

Subject to applicable legal conditions and exceptions, you may have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate information
• Request completion of incomplete information
• Request deletion of personal information
• Request restriction of processing
• Object to certain processing based on legitimate interests
• Object to direct marketing at any time
• Receive certain personal information in a portable format
• Request transfer of certain information where applicable
• Withdraw consent where processing is based on consent
• Lodge a complaint with a competent supervisory authority

To exercise any of these rights, please contact:

hello-remove-this-@maisonsablemalta.com

We may request reasonable information to confirm your identity before responding to a request.

27. Automated Decision Making

Maison Sablé does not currently intend to make decisions producing legal or similarly significant effects on customers solely through automated processing.

Third party providers may use automated systems for purposes such as payment security and fraud prevention in accordance with their respective services and legal obligations.

28. Children's Privacy

Our website is intended for a general audience.

Maison Sablé does not knowingly seek to collect personal information from children where parental consent or another lawful basis would be required under applicable law.

If you believe personal information relating to a child has been provided to us inappropriately, please contact:

• hello-remove-this-@maisonsablemalta.com

29. Third Party Websites

Our website may contain links to websites and services operated by independent third parties.

Maison Sablé does not control the privacy, security or data processing practices of independent third party websites.

To the extent permitted by applicable law, Maison Sablé is not responsible for the privacy practices, security or content of independent third party websites outside our control.

We encourage you to review the privacy information provided by a third party before providing personal information to it.

30. Changes to This Policy

Maison Sablé may update this Policy from time to time to reflect changes to:

• Our business
• Our website
• Our products and services
• Our service providers
• Technologies we use
• Our data processing practices
• Applicable legal or regulatory requirements

The latest version will be published on our website and identified by the “Last updated” date.

Where required by law, we will take appropriate steps to bring material changes to the attention of affected individuals.

31. Contacting Maison Sablé

If you have questions about this Policy, would like information regarding the way Maison Sablé handles personal information, wish to exercise your data protection rights or believe there may have been a security incident involving your personal information, please contact:

Maison Sablé
Malta
Email: hello-remove-this-@maisonsablemalta.com
Website: maisonsablemalta.com

32. Complaints

If you have concerns regarding the way Maison Sablé processes your personal information, you may contact us at:

hello-remove-this-@maisonsablemalta.com

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Malta, the competent supervisory authority is the:

• Office of the Information and Data Protection Commissioner (IDPC)

Malta

Nothing in this Policy limits your right to contact or lodge a complaint with the competent supervisory authority.

33. Interpretation and Applicable Law

This Policy is intended to operate consistently with the GDPR and applicable Maltese law.

Nothing contained in this Policy is intended to waive, exclude or restrict a right or obligation where doing so would be prohibited by applicable law.

If any provision of this Policy is found to be invalid, unlawful or unenforceable, that provision shall, to the extent possible, be interpreted or limited so that it is valid and enforceable while preserving its intended purpose.

The remaining provisions shall continue to apply to the extent permitted by law.