Maison Em — Privacy & Cookie Policy

Maison Em L.L.C-FZ, Dubai, United Arab Emirates Last Updated: 15 August 2026 · Version: 2.0

This Policy covers both privacy and cookies. Cookies are dealt with in Part B.

PART A — PRIVACY

1. Who We Are

Maison Em L.L.C-FZ (“Maison Em”, “we”, “our”, “us”) is an independent fragrance discovery and curation business registered in Dubai, United Arab Emirates.

For the purposes of applicable data protection law, Maison Em L.L.C-FZ is the data controller for the personal data described in this Policy.

Contact for privacy matters: privacy@themaisonem.com

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its implementing regulations, together with any other data protection laws applicable to you.

2. How Maison Em Is Organised

Please read this section — it explains who handles your data, now and in future.

Maison Em L.L.C-FZ is the seller and the controller of your personal data.

Some of the functions behind the Services — in particular fragrance sourcing, authentication, decanting and preparation, and the classification, matching and recommendation technology that powers fragrance discovery — may be performed by Maison Em itself, or by a separate company under common ownership with Maison Em, or by a third-party supplier or successor. In this Policy, any such company is a “Group Company”.

What this means for your data:

• Personal data may be shared with, processed by, or transferred to a Group Company for the purposes set out in this Policy — in particular to operate, develop and improve the classification and recommendation technology.
• This applies whether that function is currently performed inside Maison Em or by a separate company. The way our business is organised may change; the purposes for which your data is used, as described in this Policy, will not change without notice to you.
• Any sharing with a Group Company is subject to a written agreement imposing confidentiality and security obligations at least equivalent to those in this Policy.
• Maison Em L.L.C-FZ remains responsible to you unless and until we notify you of a change of controller.

3. Important: How Maison Em Uses Your Data to Personalise

Maison Em is built around personalised fragrance discovery. This means we do more with your data than a conventional online shop, and we want that clear before you read the detail.

We build a preference profile about you. When you take our quiz, browse, rate, purchase, repurchase, skip or return fragrances, we combine that information into an evolving profile of your fragrance preferences (an “Aura Profile”). This profile is used to select and rank what we show and recommend to you, and to determine the contents of curated selections and, where offered, subscription cycles.

This involves automated processing. Recommendations, rankings, curated selections and some marketing decisions are generated automatically, without a person reviewing each one. These decisions affect what you are offered. They do not determine your legal rights, your access to any service, the price you pay, or any credit decision.

We use this data to develop and improve our classification and recommendation technology. Interaction data is used to build, train, test and improve the models, taxonomies and classification systems that power fragrance discovery.

That technology may be operated or owned by a Group Company. As described in Section 2, the classification and recommendation technology may be developed, owned, licensed or operated by a separate company under common ownership with Maison Em, or by a successor. Personal data used for these purposes may be shared with, or transferred to, that company.

You can object. You may object to profiling or automated processing, or ask us to stop using your data for technology development, at any time — see Section 10. If you do, we will still fulfil your orders and provide the service, but personalisation will be limited or unavailable.

4. Information We Collect

4.1 Information you give us

• Full name
• Email address
• Mobile / telephone number
• Billing and delivery addresses
• Account credentials and preferences
• Quiz responses, self-declared preferences, Aura selections
• Ratings, reviews, likes, dislikes, wishlists and saved items
• Fragrance feedback and free-text responses
• Where subscriptions are offered: subscription preferences, skips, swaps and cancellations
• Customer service correspondence, including by email, WhatsApp, social media or chat
• Gift recipient details, where you provide them (see Section 4.5)

4.2 Information generated by your use of the Services

• Order and transaction history
• Products viewed, searched, saved, added to basket and abandoned
• Session activity, click behaviour and time on page
• Email and message engagement (opens, clicks, unsubscribes)
• Delivery and returns history
• Derived preference data, including your Aura Profile, weightings, inferred affinities and predicted preferences

4.3 Information collected automatically

• IP address and approximate location derived from it
• Device type, operating system, browser type and language
• Referring URL and pages visited
• Cookie and similar identifiers (see Part B)

4.4 Payment information

Payments are processed by third-party providers. Maison Em does not receive or store complete payment card numbers. We receive confirmation of payment, payment method type, the last four digits of the card, and any fraud-screening outcome.

4.5 Data about other people

If you provide another person’s details (for example a gift recipient’s name and delivery address), you confirm you are permitted to share them with us for this purpose. We will use them only to fulfil that order.

4.6 Sensitive data

We do not seek health data, and you should not send it to us. If you tell us about an allergy, sensitivity or skin condition — for example in a product safety enquiry — we will use that information only to respond and to record the safety incident, and will retain it separately from your marketing and personalisation profile.

4.7 Children

Our Services are not directed at, and may not be used by, anyone under 18. We do not knowingly collect personal data from children. If we become aware that we hold data relating to a person under 18, we will delete it. Contact privacy@themaisonem.com if you believe a child has provided us with data.

5. Why We Use Your Information, and On What Basis

Purpose	Data used	Basis
Create and manage your account	Identity, contact, credentials	Performance of a contract
Process, fulfil and deliver orders	Identity, contact, address, order, payment confirmation	Performance of a contract
Manage subscriptions, billing cycles, skips and cancellations, where offered	Account, subscription, payment confirmation	Performance of a contract
Provide customer support and handle returns	Identity, contact, order, correspondence	Performance of a contract
Build and maintain your Aura Profile and personalise recommendations, ranking and curation	Quiz, behaviour, ratings, order history, derived preference data	Consent, or our legitimate interest in providing a personalised discovery service
Develop, train, test and improve our classification, matching and recommendation technology, including by a Group Company	Behavioural and preference data, pseudonymised or aggregated wherever practicable	Consent, or our legitimate interest in improving our service and technology
Send marketing emails, SMS and WhatsApp messages	Contact details, engagement, preference data	Consent, withdrawable at any time
Advertising and measurement on third-party platforms	Identifiers, hashed contact details, engagement	Consent, via our cookie banner
Product safety, incident handling and recall	Identity, contact, order and batch records, incident details	Legal obligation and vital interests
Detect and prevent fraud, abuse, chargebacks and unauthorised resale	Order, device, payment and behavioural signals	Legitimate interest and legal obligation
Accounting, tax, corporate tax and VAT records	Transaction and invoice data	Legal obligation
Establish, exercise or defend legal claims	Any relevant data	Legitimate interest
Group reorganisation, incorporation of new companies, financing or sale (see Section 7.4)	Any relevant data	Legitimate interest

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

6. Automated Processing and Profiling

We use automated processing to:

• assign and update your Aura Profile from quiz responses and behaviour;
• rank and select the fragrances shown to you;
• choose the contents of curated sets and, where offered, subscription cycles;
• determine the timing and content of lifecycle messages;
• flag orders for manual fraud review.

The logic, in plain terms: your stated preferences and actual behaviour are converted into weighted scores. Products carry comparable scores. The system estimates how closely a product matches your profile and orders results accordingly. Fraud screening compares order and device signals against known risk patterns.

Consequences: what you see, what you are recommended, and what arrives in a curated or subscription selection. Automated processing does not set your price, restrict access to the Services, or make any decision with a legal effect on you. Orders flagged for fraud are reviewed by a person before being refused.

Your rights: you may object to profiling, request human review of any automated outcome that affects you, contest the outcome, and ask us to reset your Aura Profile. Contact privacy@themaisonem.com.

7. Who We Share Information With

We do not sell personal data.

7.1 Service providers

We share data with providers who process it on our behalf and under contract, only as needed to deliver the Services:

• E-commerce and hosting platform (Shopify)
• Subscription management platform, where subscriptions are offered
• Payment providers (for example Shopify Payments, Stripe and other PCI-DSS compliant gateways)
• Couriers and delivery partners
• Email, SMS and messaging platforms
• Analytics and product-measurement providers
• Advertising platforms, where you have consented
• Customer support tooling
• Cloud infrastructure, storage and backup providers
• Professional advisers (legal, accounting, audit) under duties of confidentiality

7.2 Group Companies

Preference and behavioural data may be shared with a Group Company for the purpose of operating, developing and improving the classification and recommendation technology used by the Services, as described in Sections 2 and 3.

Order, product and batch data may be shared with a Group Company or supplier that carries out sourcing, preparation or fulfilment, to the extent needed to prepare and deliver your order and to maintain safety traceability.

7.3 Legal and regulatory

We may disclose data where required by law, court order, regulator or competent authority, including product-safety, consumer-protection, customs and tax authorities, and where necessary to establish, exercise or defend legal claims.

7.4 Group reorganisation and business transfers

If Maison Em, or any part of its business or assets, is reorganised, restructured, placed under a holding company, financed, merged, transferred or sold — including where a new company is incorporated to carry on the technology function or the sourcing and preparation function — personal data may be transferred as part of that transaction, subject to the receiving party being bound by obligations consistent with this Policy. Your rights under this Policy and applicable law will not be reduced, and we will notify you if the identity of your controller changes.

8. International Transfers

Some of our service providers and personnel are located outside the United Arab Emirates. In particular:

• our e-commerce, subscription, analytics, payment and messaging providers may store or process data outside the UAE;
• members of our operational, administrative and marketing team are located outside the UAE and may access customer and order data to perform their roles.
• Where we transfer personal data outside the UAE, we do so only where the destination provides an adequate level of protection, or under appropriate contractual safeguards, or where a lawful derogation applies.
• Request further information about our transfer safeguards at privacy@themaisonem.com.

9. How Long We Keep Information

Category	Retention
Order, invoice, tax and VAT records	As required by UAE law, currently a minimum of 5 years from the end of the relevant tax period
Account and profile data	For the life of your account, and 24 months after your last interaction, then deleted or anonymised
Aura Profile, quiz and preference data	For the life of your account; on deletion, either removed or irreversibly anonymised and retained in aggregate form only
Marketing contact data and consent records	Until you unsubscribe or object, plus 24 months as proof of consent
Customer support correspondence	24 months from closure of the enquiry
Product safety and batch traceability records	Minimum 5 years from date of supply
Fraud and abuse records	Up to 5 years
Cookie and analytics identifiers	As stated in Part B

Where data has been irreversibly anonymised so it can no longer be linked to you, it is no longer personal data and may be retained and used indefinitely, including in aggregate training datasets.

10. Your Rights

Subject to applicable law, you have the right to:

• Access — obtain a copy of the personal data we hold about you
• Rectify — correct inaccurate or incomplete data
• Erase — request deletion, subject to our legal retention obligations
• Restrict — ask us to limit how we use your data
• Object — object to processing based on legitimate interest, including profiling and technology development
• Portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
• Withdraw consent — at any time, for marketing, cookies or personalisation
• Object to automated processing — and request human review of any automated outcome
• Complain — to the competent supervisory authority in your jurisdiction

How to exercise your rights: email privacy@themaisonem.com. We will verify your identity before responding and will reply within one month, or tell you if we need longer. No charge, unless a request is manifestly unfounded or excessive.

What deletion means in practice: we will delete or anonymise your account, profile and marketing data. We must retain transaction, tax and product-safety records for their statutory periods. Data already incorporated into aggregate, anonymised training datasets cannot be individually extracted, but will no longer be attributable to you.

11. Marketing Communications

We send marketing only where you have opted in, or where permitted by law in relation to a previous purchase of similar products.

Marketing emails carry an unsubscribe link. SMS and WhatsApp marketing include an opt-out instruction. You may also email privacy@themaisonem.com.

Opting out of marketing does not stop transactional messages such as order confirmations, dispatch notices, renewal reminders, payment failure notices and product-safety notices.

12. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls on a need-to-know basis, role-based permissions for team members, restricted administrative access, and use of reputable platform and payment providers.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to you, we will notify the competent authority and, where required, notify you without undue delay.

13. Third-Party Websites

Our Services may link to third-party websites and platforms. We are not responsible for their content or privacy practices. Review their policies before providing personal data.

14. Changes to This Policy

We may update this Policy. The current version is published on this page with the effective date. Where changes are material — in particular any expansion of how we use data for personalisation, profiling or technology development — we will notify you by email or on-site notice before the change takes effect, and where the change requires consent, we will seek it.

15. Contact and Complaints

Maison Em L.L.C-FZ · Dubai, United Arab Emirates privacy@themaisonem.com · hello@themaisonem.com

If you are not satisfied with our response, you may complain to the UAE Data Office, or to the data protection authority in your country of residence where applicable.

PART B — COOKIES

B1. What Cookies Are

Cookies are small text files placed on your device when you visit a website. We also use similar technologies including pixels, tags, local storage and SDKs. In this Part, “cookies” covers all of these.

B2. Your Choices

You can change your choices at any time or You can also block or delete cookies through your browser settings, though this may affect how the site works.

B3. Categories We Use

Strictly necessary — session management, basket, checkout, load balancing, security and fraud prevention. Retention: session to 12 months.

Functional — language, region, saved items, previously entered details, dismissed notices. Retention: up to 12 months.

Analytics and performance — pages visited, journeys taken, where people leave, how features perform. Used in aggregate to improve the Services. Retention: up to 24 months.

Personalisation — quiz progress, linking browsing behaviour to your Aura Profile, tailoring products, content and recommendations. These cookies feed the profiling described in Part A, Sections 3 and 6. Retention: up to 24 months.

Advertising and measurement — set by us and by advertising partners to show relevant advertising on third-party platforms and measure campaign performance. May involve sharing identifiers or hashed contact details with those platforms. Retention: up to 13 months.

B4. Third Parties

Third parties that may set cookies through our site include our e-commerce platform, subscription platform, payment providers, analytics providers, and advertising and social platforms. They process data under their own privacy policies as well as our agreements with them.

A current list of the specific cookies in each category, with names, providers and durations, is available in the Cookie Settings panel.

B5. Do Not Track

Our site does not currently respond to browser “Do Not Track” signals. Use the Cookie Settings panel to control your preferences.

B6. Changes

We may update Part B as our use of cookies changes. Material changes to non-essential categories.

Contact: privacy@themaisonem.com