Statement on the protection of your personal data collected in connection with purchases and use of our website

1. Who are we? Who is the Data Controller of your personal data?

When you visit our website, make a purchase, subscribe to our newsletter, or contact us, the Data Controller of your personal data (hereinafter the “Data Controller”), within the meaning of Regulation (EU) 2016/679 (GDPR), is:

Maryna Yatsava
Elara Maison Heritage
Kraków, Poland
NIP: 9452305085
REGON: 540730170

Elara Maison Heritage is responsible for processing customers’ personal data in connection with the operation of the website, order fulfillment, marketing communication, and customer service.

---

Scope of Activity

Elara Maison Heritage is a premium interior design brand specializing in carefully curated collections of:

• Furniture
• Interior decorations
• Lighting
• Textiles

We create refined, design-led collections that combine functionality with aesthetic discipline — serving private residences, hospitality spaces, and commercial interiors across Europe and internationally.

---

Our Commitment

At Elara Maison, we attach the highest importance to the protection of your personal data. We process your data responsibly, transparently, and in full compliance with applicable legal regulations, including the GDPR.

We implement appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of your data — whether you are browsing our collections, placing an order, or contacting our team.

Privacy, like design, requires structure, clarity, and discipline.

And we treat it with the same level of care.

2. What Is “Personal Data”?

Personal data refers to any information that identifies you — directly or indirectly — as a customer or visitor of our Website.

This may include information such as:

• Your name and surname
• Email address
• Shipping or billing address
• Telephone number
• Payment-related information
• IP address or device identifiers
• Order history and purchase details

Personal data can also include unique digital identifiers, such as an IP address or cookies, that allow us to recognize your device and improve your browsing experience.

At Elara Maison, we collect and process only the data necessary to provide you with a seamless, secure, and refined customer experience — from your first visit to final delivery.

Your privacy is not treated as a formality. It is treated as part of our standard of excellence.

---

3. Why and How We Process Personal Data

3.1 How Do We Collect Your Personal Data?

At Elara Maison, we collect personal data in a transparent and responsible manner, ensuring that every interaction with our brand remains secure and refined.

We collect your personal data in the following ways:

Directly from you — when you interact with our website and services, including when you:

• place an order,
• create an account,
• subscribe to our newsletter,
• contact our customer service team,
• submit inquiries through contact forms,
• request product information or design support.

Automatically — when you visit www.elaramaison.com, certain technical data may be collected through cookies and similar technologies, such as:

• IP address,
• browser type and device information,
• browsing behavior on our website,
• interaction data related to products and pages viewed.

This data helps us provide a seamless purchasing experience, ensure website security, process orders efficiently, improve our services, and personalize communication in line with your preferences.

Our objective is not only operational efficiency — it is to deliver a luxury customer experience built on trust, clarity, and respect for your privacy.

---

3.2 What Data Do We Collect?

We collect various categories of personal data relating to customers and website visitors.

Personal Data Collected Directly From You

Your personal data is collected when you use our website www.elaramaison.com and interact with our services. This particularly applies when you:

• place an order,
• create or manage a customer account,
• contact us via contact forms or email,
• subscribe to our newsletter or request product information,
• request design guidance or product availability details.

Categories of collected personal data may include:

Identification and contact details
– name, surname, billing and shipping address, email address, phone number.

Order and transaction data
– purchased products, order history, payment confirmation details (we do not store full payment card information), invoice data, delivery preferences.

Customer communication data
– information you provide when contacting us, including inquiries, feedback, or after-sales service requests.

We process this data solely for purposes related to order fulfillment, customer service, contractual obligations, legal compliance (such as accounting and tax requirements), and—where applicable—marketing communication based on your consent or legitimate interest.

Your personal data is never used for purposes unrelated to your interaction with Elara Maison.

---

Personal Data Collected Automatically

When you use our website, we automatically collect certain technical and usage information through cookies and similar technologies.

This may include:

Technical information
– details about the device used to access the website (operating system, browser type, device type), IP address, approximate location derived from the IP address, access time, pages visited, and the referring source.

User activity information
– interaction with website content, viewed products, session duration, and navigation patterns.

This data enables us to:

• ensure website security and prevent fraud,
• improve website performance and user experience,
• analyze how visitors interact with our collections,
• optimize content and services.

All automatic data collection is conducted in accordance with applicable data protection laws and, where required, subject to your consent via our cookie management system.

3.3 On What Legal Grounds and for What Purpose Do We Process the Collected Data?

In accordance with applicable data protection regulations, including the General Data Protection Regulation (GDPR), we process personal data only where a valid legal basis exists.

Personal data is processed on the basis of:

i. Performance of a contract or pre-contractual measures
ii. Your consent
iii. Our legitimate interest
iv. Our legal obligations

---

(i) Performance of a Contract or Pre-Contractual Measures

We process your personal data where it is necessary to enter into or perform a contract with you, including:

• processing and fulfilling orders,
• managing payments and invoicing,
• arranging delivery and logistics,
• handling returns, warranties, and after-sales support,
• responding to pre-purchase inquiries regarding products, availability, or delivery terms.

Without this data, we would not be able to provide you with our products and services.

---

(ii) Your Consent

Where required by law, we process personal data based on your consent, particularly for:

• sending newsletters and marketing communications,
• informing you about new collections, product launches, and curated selections,
• using non-essential cookies and analytics tools.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

---

(iii) Legitimate Interest of Elara Maison Heritage

We may process your personal data where it is necessary for our legitimate business interests, provided that such interests are not overridden by your fundamental rights and freedoms.

This includes:

• responding to inquiries and customer service requests,
• improving website performance and user experience,
• analyzing website traffic and customer behavior,
• preventing fraud and ensuring transaction security,
• protecting our brand, content, and digital infrastructure,
• defending our interests in the event of disputes or legal proceedings.

Our legitimate interest is always balanced with your right to privacy.

---

(iv) Legal Obligations

We may process and retain personal data where required by applicable law, including:

• accounting and tax regulations,
• record-keeping obligations,
• compliance with regulatory authorities,
• protection of our rights in administrative, judicial, or legal proceedings.

Data is retained only for the period required by law or necessary to protect our legal interests.

3.4 Who Has Access to Your Data?

3.4.1 Accessibility of Data Within Elara Maison Heritage

Your personal data is processed internally by Elara Maison Heritage strictly for the purposes described in this Privacy Statement and is accessible only to authorized personnel who require such access to perform their professional duties.

Access to personal data is limited, proportionate, and granted on a need-to-know basis.

Depending on the nature of your interaction with us, your data may be processed by:

Customer Experience & Communication Department
– to manage inquiries, provide product information, process orders, handle after-sales support, and send newsletters or curated communications (where permitted).

Operations & Order Fulfilment Team
– to process orders, manage logistics, coordinate deliveries, and handle returns or warranty matters.

IT & Security Department
– to ensure the technical security, integrity, and proper functioning of the website www.elaramaison.com and related systems.

Legal & Compliance Department
– to ensure regulatory compliance, manage claims or disputes, prevent fraud, and protect the rights and legitimate interests of Elara Maison Heritage.

All employees and collaborators processing personal data are bound by confidentiality obligations and operate under strict internal data protection policies.

Your data is never accessed without a legitimate business purpose.

3.4.2 Accessibility of Data to Third Parties

In certain circumstances, your personal data may be shared with trusted third-party service providers. Such access is strictly limited to what is necessary for the proper functioning of our services and fulfillment of contractual and legal obligations.

(i) Our Subcontractors and Service Providers

We may share personal data with carefully selected service providers for operational, technical, and logistical purposes, including:

• Courier and transport service providers – to arrange delivery of your orders and manage logistics.
• Payment service providers – to process secure transactions (we do not store full payment card details).
• Website hosting and maintenance providers – to ensure the proper functioning and security of www.elaramaison.com.
• IT security and fraud prevention providers – to protect transactions and prevent unauthorized activity.
• Marketing and communication service providers – to send newsletters and manage email communication (where permitted).
• Analytics and performance tools – to analyze website usage and improve customer experience.

These service providers process data solely on our behalf and under contractual agreements that ensure full compliance with applicable data protection regulations.

---

(ii) Administrative and Judicial Authorities

We may disclose personal data to public authorities, courts, or regulatory bodies where such disclosure is:

• required by law,
• necessary to comply with regulatory obligations,
• or required to protect our legal rights and legitimate interests.

---

All third-party entities processing your data are required to implement appropriate technical and organizational measures to ensure confidentiality, integrity, and security in accordance with applicable data protection laws.

Your data is never sold to third parties.

---

3.5 Is Personal Data Transferred Outside the European Economic Area (EEA)?

Your personal data is primarily processed within Poland and the European Economic Area (EEA) by Elara Maison Heritage.

However, in certain cases, we may use trusted external service providers who are located outside the EEA or who cooperate with data processors located outside the EEA. These may include technology, hosting, analytics, payment, or marketing service providers whose infrastructure operates globally.

In such situations, personal data may be transferred to countries where data protection regulations may differ from those in the European Union.

Whenever personal data is transferred outside the EEA, we ensure that appropriate safeguards are implemented in accordance with the GDPR. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission,
• data processing agreements ensuring equivalent levels of protection,
• transfers to countries recognized by the European Commission as providing an adequate level of data protection,
• or other legally recognized transfer mechanisms.

Elara Maison Heritage takes all necessary technical and organizational measures to ensure that any international data transfer maintains a level of protection consistent with European data protection standards.

Transfers are carried out only where necessary and always in compliance with applicable data protection laws.

3.6 How Long Do We Store Your Data?

Your personal data is stored only for as long as necessary to fulfill the purposes for which it was collected. After this period, the data is deleted or anonymized, unless applicable legal regulations require a longer retention period.

Retention periods depend on the category of data and the purpose of processing:

Identification and contact data
(e.g., name, surname, billing and shipping address, email, phone number)
is stored for the duration of the contractual relationship and for the period necessary to fulfill post-sale obligations (returns, warranties, support), and thereafter in accordance with applicable accounting and tax regulations.

Order and transaction data
(including invoice data and payment confirmations)
is retained for the period required by tax and accounting laws, which may extend up to the statutory limitation period under applicable regulations.

Newsletter and marketing data
is retained for the duration of your subscription and deleted once you unsubscribe or withdraw your consent.

Customer service correspondence
(including inquiries and support requests)
is retained for the time necessary to resolve the matter and for an additional period required to protect our legitimate interests, including potential claims.

Technical and security-related data
(including IP address, browser type, and device information)
is stored for a limited period necessary to ensure website security, prevent fraud, and maintain system integrity, and is then deleted or anonymized.

Data related to complaints, disputes, or legal proceedings
is retained for the duration necessary to resolve the matter and for the period required to protect our legal rights, including statutory limitation periods.

After the applicable retention periods expire, personal data is permanently deleted or anonymized, unless there is a legal obligation requiring further storage.

4. What Are Your Rights Regarding the Processing of Your Data?

4.1 Right of Access, Rectification, and Data Portability

In accordance with applicable data protection regulations, including the GDPR, you have the right to access your personal data processed by Elara Maison Heritage.

You may request confirmation as to whether we process your personal data and obtain information about:

• the categories of data processed,
• the purposes of processing,
• the recipients of the data,
• the retention period,
• and the safeguards applied in case of international transfers.

You also have the right to request the correction of your personal data if it is inaccurate, incomplete, or outdated. Where appropriate, you may request the completion of incomplete data necessary for the intended purpose of processing (for example, order or invoice information).

To process your request, we may ask you to verify your identity to ensure the security of your data. In certain cases, additional information may be required to confirm your rights and prevent unauthorized access.

We will respond to your request within the timeframes required by applicable data protection laws.

You also have the right to data portability. This means you may request a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible, you may also request that we transmit this data directly to another controller.

This right applies within the limits and conditions set out by applicable law.