Privacy policy

Version: 15 October 2026 · This English translation is provided for convenience only. Only the German version is legally binding.

This policy informs you in accordance with Art. 13 and 14 GDPR about which personal data we process when you visit maison-the-bravest.com, place orders, withdraw from contracts and contact us.

1. Controller

Doms-Elements UG (haftungsbeschränkt), Wolfsbankring 27, 45355 Essen, Germany. Contact: via our contact form and the contact details given in the legal notice . Maison the Bravest is a brand of Doms-Elements UG (haftungsbeschränkt).

2. Data protection officer

We are not obliged to appoint a data protection officer and have not appointed one. Please send questions about data protection via our contact form or to the contact details given in the legal notice .

3. Hosting and shop system

We operate the website, shop, customer management, accounting and email dispatch with the software Odoo of Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium, as processor under Art. 28 GDPR. According to Odoo, data is processed in data centres in the EU (France, Belgium); backups may temporarily also be stored in Canada, for which an adequacy decision of the EU Commission exists. Odoo uses sub-processors, including OVH SAS and Google Cloud EMEA Ltd.; the current list is available at odoo.com/privacy. The legal basis is Art. 6(1)(b) and (f) GDPR.

4. Server logs

When the website is accessed, IP address, date and time, requested address, status code, referring page, browser and operating system are technically processed in order to deliver the website and defend against attacks (Art. 6(1)(f) GDPR). The logs are only stored for as long as necessary for this purpose.

5. Cookies and consent

We use technically necessary cookies (session_id for session and cart, frontend_lang for the language, tz for the time zone and a cookie that stores your choice in the cookie notice). The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(b) and (f) GDPR. We only set optional cookies with your consent via the cookie notice (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time by deleting your browser cookies for this website. Further information: Cookie policy.

6. Audience measurement

We use the audience measurement integrated in Odoo, based on Plausible Analytics. Your browser loads a script from download.odoo.com and transmits page views to saas-analytics.odoo.com (Odoo S.A.). No cookies are set and no profiles are created; the IP address is not stored but only used to form a daily changing, untraceable checksum. Pages visited, referral source, country, device type and browser are recorded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving our offering. In addition, the shop system records without cookies which pages and products are viewed, with time, language and country derived from the IP address. You can object at any time (section 17).

7. Fonts and external content

Fonts are not loaded from Google servers. We do not embed videos, maps or social media plugins.

8. Orders

For orders we process name, billing and delivery address, email address, phone number (if provided), ordered items, prices and payment status to perform the contract, deliver, invoice and handle warranty and withdrawal (Art. 6(1)(b) GDPR) and to fulfil commercial and tax law obligations (Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB). A customer account is optional.

9. Payment

We process payments via the payment service providers shown during the ordering process. This is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Depending on what PayPal offers, you can also pay there by direct debit, credit card or invoice; PayPal's terms apply. We transmit the order amount, order reference, name, email and billing address to PayPal. In the payment step, your browser loads scripts of the payment service provider, which receives your IP address and device information and may set cookies. PayPal also processes data under its own responsibility, for example for fraud prevention, and may transfer it to affiliated companies, including in the USA. The legal basis is Art. 6(1)(b) GDPR and § 25(2) no. 2 TDDDG. We do not receive complete bank or card details.

10. Shipping

For shipping we use the shipping service provider Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands, as processor and hand the parcel over to DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn) or the shipping provider shown during the ordering process. For this we transmit name and delivery address (Art. 6(1)(b) GDPR). We only pass on your email address or phone number to announce delivery if this is necessary for delivery or you have consented (Art. 6(1)(a), (b) GDPR).

11. Order emails

We send order confirmations, invoices, shipping confirmations and replies to enquiries via the mail servers of Odoo or our email provider using our business sender address (Art. 6(1)(b) and (c) GDPR).

12. Newsletter

If you expressly consent during the ordering process or on the website, we will send you information about new scents and offers by email (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in every email or by contacting us. We do not send advertising emails without your consent.

13. Withdrawal function

If you withdraw from a contract via maison-the-bravest.com/vertrag-widerrufen , we process name, order number, email address, optional information and the date and time of receipt in order to process the withdrawal and send the legally required confirmation of receipt (Art. 6(1)(c) GDPR in conjunction with § 356a German Civil Code). We store the data until the limitation period expires (three years from the end of the year) or the tax retention periods expire.

14. Contact form, email and chat

If you write to us via the contact form, by email or, where offered, via live chat, we process your details to answer you (Art. 6(1)(b) or (f) GDPR) and delete them once the request has been dealt with and there is no retention obligation, at the latest after three years.

15. Recipients and third countries

Recipients are Odoo S.A. and its sub-processors, payment service providers, Sendcloud and shipping providers, our tax advisors and authorities where we are legally obliged. We do not transfer any data to third countries ourselves. PayPal may transfer data to the USA under its own responsibility; the basis is the adequacy decision on the EU-US Data Privacy Framework, insofar as the recipients are certified, and EU standard contractual clauses. We do not sell any data.

16. Storage period

We store data for as long as necessary for the purpose. We keep accounting records such as invoices for eight years, commercial and business letters for six years, books and annual financial statements for ten years (§ 147 AO, § 257 HGB), each from the end of the calendar year. We delete visit data of the shop system at the latest 90 days after the last visit.

17. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent given with effect for the future (Art. 7(3) GDPR).

18. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

19. Obligation to provide data, automated decisions

Name, address and email address are required for orders; without them we cannot conclude a contract. We do not make any exclusively automated decisions within the meaning of Art. 22 GDPR. Payment service providers may carry out automated checks for fraud prevention under their own responsibility.

20. Security and changes

The website is transmitted encrypted via HTTPS. We adapt this policy when services or the legal situation change.