Privacy Policy
1. Data controller
The controller responsible for the personal data described in this policy is Meiqi JIA, a sole trader operating under the trade name Magmei (referred to as “Magmei”, “we”, “us” or “our”).
Website: https://www.magmei.com
Email address for privacy-related questions: contact@magmei.com
12 Avenue de Picardie 26130 Saint-Paul-Trois-Châteaux
Magmei has not appointed a data protection officer as of the date of this version. Any privacy-related request may be sent to the contact address above.
2. Purpose and scope
This policy explains how Magmei collects, uses, shares, retains and protects personal data when you browse the website, contact us, create a customer account, add a product to your cart, place an order, request delivery, a return or a refund, or interact with our communications.
The public website uses an independent Next.js interface hosted by Vercel. Shopify provides the product catalogue, customer account where applicable, cart, order, payment and checkout functions. Cloudflare may be used for domain management, security, network performance and email routing. Depending on the service concerned, these providers act as processors for Magmei or as separate controllers for their own obligations.
This policy is separate from the Legal Notice and the Terms and Conditions of Sale.
3. Data we may collect
Identity and contact data: first name, last name, email address, telephone number, billing address, delivery address and country.
Account data: account credentials, order history, preferences and information required to manage the account, where customer accounts are offered.
Order and customer-relationship data: products ordered, selected variants and sizes, amount, currency, discounts, delivery information, order status, returns, refunds, complaints and communications with customer service.
Limited payment data: payment status, amount, currency, transaction reference, payment method and information required for fraud prevention. Magmei does not directly receive or retain the full payment-card number or card security code.
Data you provide voluntarily: the content of a message sent by form or email, any attachments and any information you choose to provide.
Technical and browsing data: IP address, date and time, pages or products viewed, referring URL, device type, operating system, browser, language, technical identifiers, security logs and error or performance information.
Cookie and preference data: session identifiers, cart contents, login state, consent choices and, only where you consent after they are activated, analytics or advertising data.
4. Sources of data
We collect data directly from you when you complete a form, create an account, place an order, select a delivery option or contact us. Some data is collected automatically by the website, Shopify, Vercel, Cloudflare or payment providers through technical logs, cookies or similar technologies. We may also receive information from carriers, payment providers or technical partners to confirm a payment, track a delivery, process a return or prevent fraud.
5. Purposes and legal bases
We process data only for specified purposes and on an appropriate legal basis.
| Purpose | Legal basis |
|---|---|
| Website operation, security, abuse prevention and error resolution | Legitimate interests in providing a reliable and secure service |
| Creation and management of the cart, account, order, payment, delivery, returns and after-sales service | Pre-contractual steps and performance of the contract |
| Invoicing, accounting, tax obligations, warranties and responses to authorities | Legal obligation |
| Responding to enquiries that do not yet relate to an order | Pre-contractual steps or legitimate interests in responding to enquiries |
| Fraud prevention, protection of our rights and dispute management | Legitimate interests and, where applicable, legal obligation or establishment, exercise or defence of legal claims |
| Newsletters and electronic direct marketing where consent is required | Consent |
| Advanced audience measurement, Google Analytics, Google Ads, conversion tracking and personalised advertising | Prior consent |
6. Mandatory and optional data
Data identified as mandatory during checkout or order creation is required to enter into and perform the sale, process payment, deliver products and comply with our legal obligations. If you do not provide this information, we will be unable to process the order.
Optional information, newsletter subscriptions and consent to non-essential cookies remain voluntary. Refusing analytics or advertising cookies does not prevent you from browsing the website or placing an order, subject to cookies strictly necessary for the cart, security and payment.
7. Recipients and service providers
To the extent necessary for their role, data may be accessed by Magmei and the following categories of recipient:
- Shopify and its group companies, for the e-commerce infrastructure, cart, customer accounts, orders, payment, security and checkout;
- Vercel, for hosting and delivering the website’s public interface;
- Cloudflare, for the domain, security, network performance and, where used, email routing;
- payment providers offered at checkout, to authorise, secure and process payments;
- carriers and logistics providers, for preparation, dispatch, tracking, delivery and returns;
- professional providers bound by confidentiality, such as accountants, legal advisers, IT providers or insurers;
- public authorities, courts or authorised bodies where required by law or necessary to defend our rights.
We do not sell your personal data. We do not disclose your data to third parties for their own direct marketing without an appropriate legal basis.
8. Payments
Payments are processed within the secure environment of Shopify and the payment provider selected or offered at checkout. Magmei receives the information required to manage the order and evidence payment but does not directly retain complete payment-card details. Where an option to save a payment method is offered, its operation and legal basis are governed by the relevant provider and the choice made by the user.
9. Transfers outside the European Economic Area
Some technical providers, including Shopify, Vercel, Cloudflare or their subprocessors, may process data from countries outside the European Economic Area, including the United States or Canada. Where the relevant country is not covered by an applicable adequacy decision, the transfer is protected by safeguards recognised under the GDPR, such as the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional measures. You may contact us for information about the safeguards applicable to a particular transfer.
10. Retention periods
We retain data for a period proportionate to the purpose of the processing, then delete it or place it in restricted-access archives where the law requires longer retention.
| Category | Indicative retention period |
|---|---|
| Orders, contracts and commercial correspondence | For the duration of the commercial relationship, then for five years as evidence; electronic contracts worth at least €120 are retained for ten years from delivery. |
| Invoices and accounting records | For ten years from issue or the close of the relevant financial year, depending on the record. |
| Customer-account data | For the period during which the account is used, then for as long as needed to handle requests and evidence obligations; earlier deletion on request where no retention obligation prevents it. |
| Enquiries not linked to an order | Up to three years after the last meaningful exchange, unless deletion is requested earlier or certain information is required for a dispute. |
| Prospects and newsletters | Until consent is withdrawn or three years after the last active contact, subject to the rules applicable to the channel used. |
| Technical and security logs | Normally for up to twelve months, unless an incident or obligation justifies longer retention. |
| Cookie choices | Normally for six months, after which the choice may be requested again. |
| Data relating to a dispute | For the duration of the proceedings and until expiry of the applicable appeal or limitation periods. |
11. Cookies and similar technologies
The website and Shopify checkout may use cookies, pixels, local storage or similar identifiers. Strictly necessary cookies are used to display the website, protect sessions, remember cart contents, record privacy preferences, authenticate an account and secure payment. They may be used without consent where they are essential to a service expressly requested by the user.
Non-essential cookies, including those used for advanced audience measurement, advertising tracking, advertising personalisation or matching activity across websites or devices, must not be stored or read until you have consented. You must be able to refuse them as easily as accepting them and withdraw consent at any time.
When non-essential cookies are activated, the consent-management interface must provide details of the active cookies, their purpose, provider and duration. Your choice may be retained for six months before it is requested again, unless the service changes or a new purpose requires fresh consent.
You may also configure your browser to limit certain cookies. Blocking strictly necessary cookies may, however, prevent the cart, login or payment functions from working correctly.
12. Audience measurement and advertising: Google Analytics and Google Ads
Subject to your prior consent, Magmei may use Google Analytics 4, Google Ads and conversion-tracking tools to measure use of the website, understand browsing journeys, assess campaign performance and improve the relevance of advertising communications.
Depending on the services to which you consent, these technologies may process online identifiers, browser and device information, the IP address and approximate location that may be inferred from it, pages viewed, interactions with the website, the source of the visit and conversion events. Google may receive and process this information in accordance with the service settings and its own privacy documentation.
Non-essential tags, pixels and cookies associated with these purposes are not loaded or read until you have consented. You may accept or refuse the proposed categories separately and withdraw your consent at any time through the Cookie Preferences tool. Refusal does not prevent access to the website’s essential functions or checkout.
The Cookie Preferences tool identifies the technologies that are actually active, their provider, purpose and retention period. This operational information supplements this policy and is updated when service configurations change. Any new purpose requiring consent will be accompanied by appropriate information and a fresh request for consent.
13. Direct marketing and newsletters
If newsletters or promotional communications are offered, they will be sent on the basis of your consent where consent is required. You may unsubscribe at any time through the link included in each message or by writing to contact@magmei.com. Communications strictly related to an order, payment, delivery, return, security or contractual change are not promotional communications and may be sent where necessary to perform the contract or comply with the law.
14. Your rights
Subject to the conditions set out in the GDPR and French law, you have the right of access, rectification, erasure, restriction, objection and, where the relevant conditions are met, data portability. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You may also issue instructions regarding the use of your data after your death, under the conditions provided by French law.
To exercise your rights, write to contact@magmei.com and specify the subject of your request. Where we have reasonable doubts, we may request additional information strictly necessary to verify your identity. We normally respond within one month. This period may be extended by two months for a complex request or a large number of requests; if so, we will explain the reasons for the extension.
You may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at https://www.cnil.fr.
15. Security
We implement technical and organisational measures proportionate to the risks, including encryption in transit, access controls, data minimisation, permission management, backups and incident monitoring. No system can, however, provide absolute security. If a personal-data breach is likely to pose a risk to individuals, we will apply the notification and communication obligations required by the GDPR.
16. Children
The website and Magmei products are intended for adults and are not designed knowingly to collect personal data from children. If you believe that a child has provided data to us without appropriate authorisation, contact us so that we can review the situation and, where appropriate, delete the data.
17. External links
The website may contain links to third-party websites or services. Processing carried out directly by those third parties is governed by their own privacy policies. We encourage you to review them before providing information.
18. Changes to this policy
We may amend this policy to reflect legal, technical or commercial developments. The update date at the top of the document will be changed. Where a change is material, including the addition of a new purpose or tracking tool, appropriate notice will be provided and fresh consent will be obtained where required by law.
19. Contact
For any question about this policy or our use of your personal data, write to contact@magmei.com.
Data controller: Meiqi JIA - Magmei
12 Avenue de Picardie 26130 Saint-Paul-Trois-Châteaux