Last updated: 12th of August 2026.
This policy covers the MAISON DEE website at maison-dee.com. Nothing is sold here and no orders are placed here.
Our retailer ordering portal at order.maison-dee.com is a separate service with its own privacy notice. If you are a stockist logging in to place an order, that notice applies to you, not this one.
MAISON DEE is a brand of DA DESIGN ApS, a Danish company.
Personal data reaches us through this website in five ways:
1. You subscribe to our newsletter. We use your email address to send it, with your consent, until you unsubscribe.
2. You write to us. We use your email address and what you wrote to answer you and to keep a record.
3. You accept statistics cookies. We use Google Analytics to count visits and see which pages are read.
4. Whatever you choose about cookies, we record that choice so we can honour it.
5. Our hosting provider reads your IP address to keep the site available and to stop abuse.
We do not sell personal data. We do not share it with advertising networks. We do not build profiles of visitors and we make no automated decisions about anyone.
Cookies are covered separately in our Cookie Policy.
The data controller is:
DA DESIGN ApS
Piniehøj 17
2960 Rungsted Kyst
Denmark
CVR / VAT: DK45305481
Email: contact@maison-dee.com
DA DESIGN ApS trades under the name MAISON DEE and operates maison-dee.com.
We are not required to appoint a Data Protection Officer under Article 37(1) GDPR and we have not appointed one. Privacy questions go to contact@maison-dee.com and are handled by our management.
What we collect. Your email address, the date and time you subscribed, and a record of the consent wording shown to you at that moment.
Why. To send you the MAISON DEE newsletter: new fragrances, events, and where our fragrances are available.
Legal basis. Your consent, Article 6(1)(a) GDPR, together with section 10(1) of the Danish Marketing Practices Act (markedsføringsloven). We send the newsletter only to people who ticked the newsletter box themselves. The box is never pre-ticked.
How long we keep it. Your email address stays on the list until you unsubscribe. When you unsubscribe, we move your address to a suppression list and keep it there for 24 months, so that we do not add you back by mistake and so that we can show we acted on your request. We keep the consent record for as long as we send you the newsletter and for 24 months after the last email we send you. The copy of your signup held inside Webflow is deleted at the end of the calendar quarter following the one you subscribed in.
Who receives it. Webflow, Inc. stores the signup, and its sub-processors Cloudflare, Inc. and Mailjet deliver the site and the internal notification of your signup. Plus Five Five, Inc., trading as Resend, sends the newsletter itself.
Is it required? No. Giving us your email address is voluntary and is neither a legal nor a contractual requirement. If you prefer not to, we simply cannot send you the newsletter.
What we collect. Your email address, your name if you give it, and whatever you write, including any attachments.
Why. To read your message, answer it, and keep a record of what was said. This covers questions from customers, enquiries from journalists, and enquiries from shops that want to carry MAISON DEE.
Legal basis. Our legitimate interests, Article 6(1)(f) GDPR. The interest is specific: receiving, answering and administering enquiries addressed to us, and keeping a record of that correspondence for the ordinary conduct of our business. We weighed this against your interests and concluded that a person who writes to a company expects a reply and expects the exchange to be recorded. You can ask us for the details of that assessment at contact@maison-dee.com.
How long we keep it. 24 months from the last message in the exchange. Where correspondence forms part of our accounting records, Danish bookkeeping law requires us to keep it for 5 years from the end of the financial year it relates to.
Who receives it. Our email runs on Google Workspace, provided by Google Ireland Limited.
Is it required? No. You choose what to write to us. If you leave out the information we need to answer, we cannot answer.
What we collect. Your IP address, which Google uses to work out an approximate location and then discards. Your browser and device type, your operating system, the pages you open, the order you open them in, how long you stay, and the site or search that brought you here.
Why. To count visits and understand which parts of the site are read, so that we can make the site better. We use Google Analytics 4 for this.
Legal basis. Your consent, Article 6(1)(a) GDPR, given through the cookie banner. The same consent covers the storage of the cookies themselves under section 3 of the Danish cookie order (cookiebekendtgørelsen). No statistics cookies are stored and no statistics are collected until you accept. If you decline, or ignore the banner, Google Analytics does not run.
How long we keep it. Google Analytics deletes the underlying event and user data 14 months after collection. The cookies themselves expire on the schedule set out in our Cookie Policy.
Who receives it. Google Ireland Limited, as our processor, with Google LLC in the United States as its sub-processor.
Can we identify you from it? No. We hold no name or email address alongside this data and we cannot connect it to you. Under Article 11(2) GDPR this means the rights of access, rectification, erasure, restriction and portability do not reach your statistics data, because we cannot find your records. If you send us information that lets us identify them, we will act on your request.
Is it required? No. The site works the same whether you accept statistics cookies or not.
What we collect. Which cookie categories you accepted or declined, and when.
Why. To honour the choice you made, to avoid asking you again on every page, and to be able to show that we asked properly.
Legal basis. Article 6(1)(c) GDPR: we are legally obliged to obtain and demonstrate valid consent, under Article 7(1) GDPR and section 3 of the Danish cookie order. Recording the choice is how we meet that obligation, so the record itself does not need your consent.
How long we keep it. The record sits in your browser for 12 months, or 14 days if you declined any category. We hold no copy of it, so it disappears the moment you clear your browser storage.
Who receives it. No one. The record stays in your browser and is never sent to us or to anyone else.
Can we identify you from it? No. The record sits in your browser under the name dee_consent, it is not tied to your name or email address, and we hold no copy of it. There is nothing for us to look up, correct or delete on request. Clearing your browser storage removes it. Article 11(2) GDPR.
What we collect. Your IP address and basic request information, read as the page loads.
Why. To deliver the site quickly, to tell apart visitors sharing one internet connection, and to block automated attacks.
Legal basis. Our legitimate interests, Article 6(1)(f) GDPR. The interest is specific: keeping maison-dee.com available and protecting it from attack and abuse. We weighed this against your interests. The data is read in the moment, used only for security, and never used to recognise you or to build any picture of you. You can ask us for the details of that assessment at contact@maison-dee.com.
How long we keep it. We hold no copy at all. Cloudflare’s own log retention periods are set out in Webflow’s data processing agreement, and we can send you the relevant part on request.
Who receives it. Webflow, Inc. and its sub-processor Cloudflare, Inc.
Can we identify you from it? No. We never see this data and hold nothing that would let us connect an IP address to you. Under Article 11(2) GDPR the rights of access, rectification, erasure, restriction and portability therefore do not reach it.
These are the only organisations that receive personal data from this website. Each acts on our written instructions under a data processing agreement, and none of them may use your data for their own purposes.
Recipient
What they do
Where
Webflow, Inc.
Hosts maison-dee.com and stores form submissions
United States, on Amazon Web Services (us-east-1)
Cloudflare, Inc.
Delivers the site and blocks abuse, as Webflow’s sub-processor
United States
Mailjet, Inc.
Sends us the internal notification when a form is submitted, as Webflow’s sub-processor
United States
Plus Five Five, Inc., trading as Resend
Sends the newsletter
United States
Google Ireland Limited
Provides Google Analytics 4 and Google Workspace
Ireland, with sub-processing by Google LLC in the United States
No third party
Your cookie choice is recorded in your own browser and is not passed to anyone
Your own browser
We also disclose personal data to Datatilsynet, the Danish tax authority, the police or a court, where Danish or EU law requires it. We have not made and do not plan to make any such disclosure on our own initiative.
We do not sell personal data and we do not disclose it for anyone else’s marketing.
Webflow, Cloudflare, Mailjet, Resend and Google LLC are established in the United States, and the personal data described above reaches them there.
Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 recognises the EU-US Data Privacy Framework as providing adequate protection. That decision is in force. Webflow, Inc., Plus Five Five, Inc. and Google LLC are each certified under it, and their status is published on the official list at dataprivacyframework.gov.
An action to annul the decision was dismissed by the General Court on 3 September 2025 in Case T-553/23, Latombe v Commission, and has been appealed to the Court of Justice of the European Union. Should the decision be annulled or withdrawn, we will transfer on the basis of the European Commission’s Standard Contractual Clauses, Implementing Decision (EU) 2021/914, which already form part of our agreements with Webflow, Resend and Google.
Cloudflare and Mailjet receive data as Webflow’s sub-processors. Webflow’s data processing agreement passes the Standard Contractual Clauses down to them, so that safeguard covers those transfers whether or not each company holds its own certification.
To request a copy of any of these clauses, write to contact@maison-dee.com.
Data
Kept for
Newsletter subscription
Until you unsubscribe
Email address after unsubscribing (suppression list)
24 months
Newsletter consent record
While we send you the newsletter, then 24 months
Messages you send us
24 months from the last message in the exchange
Correspondence forming part of our accounting records
5 years from the end of the relevant financial year
Google Analytics event and user data
14 months
Our log of cookie consents
24 months
Form submissions held in Webflow
Deleted at the end of the calendar quarter following the one you submitted in
Security and hosting logs
We hold no copy. Held by Cloudflare, Inc. as Webflow’s sub-processor, for the periods set out in Webflow’s data processing agreement
You can exercise any of these by writing to contact@maison-dee.com. We answer within one month. If a request is complex we can extend that by two months, and we will tell you inside the first month if we do. This costs nothing..
You can object to direct marketing at any time, and we must stop. This right is absolute. We do not weigh it against anything and we do not ask for a reason. Unsubscribe using the link at the bottom of every newsletter, or write to contact@maison-dee.com. Article 21(2) GDPR.
You can object to our handling of correspondence you sent us, and to the security processing described in section 5, on grounds relating to your particular situation. We then stop unless we can show compelling grounds that override your interests. This does not apply to the newsletter, to statistics or to the cookie consent record, which rest on other bases. Article 21(1) GDPR.
Access — you can ask what personal data we hold about you and receive a copy. Article 15 GDPR.
Rectification — you can have inaccurate data corrected and incomplete data completed. Article 16 GDPR.
Erasure — you can ask us to delete your personal data where one of the grounds in Article 17(1) applies, for example where you withdraw your consent, or where the data is no longer needed for the purpose we collected it for. We keep data despite such a request where Danish bookkeeping law requires it, and we keep your address on the suppression list so that we can honour your own unsubscribe.
Restriction — you can ask us to hold your data without using it, where one of the situations in Article 18(1) applies: while we check whether data is accurate, while we consider an objection you have made, in place of erasure where you prefer that, or where you need the data for a legal claim.
Withdrawal of consent — where we rely on your consent, you can withdraw it at any time, and withdrawing is as easy as giving it. For the newsletter, use the unsubscribe link in any email. For statistics cookies, open Cookie Settings in the footer of any page. Withdrawal does not make our earlier use of the data unlawful. Article 7(3) GDPR.
Portability — where we rely on your consent, you can receive your data in a machine-readable format and have it sent to another controller. This applies to your newsletter subscription. Article 20 GDPR.
How these apply across the five activities:
1. Newsletter — all of them, including portability.
2. Messages you send us — access, rectification, erasure, restriction and objection under Article 21(1). Portability does not apply, because this rests on legitimate interests rather than consent or contract.
3. Website statistics — none of them reach your data, for the reason given in section 3 above.
4. Your cookie choice — access, rectification and restriction, once you send us the identifier described in section 4. Erasure does not apply while we are legally required to keep the record as proof of consent. Portability does not apply, because this rests on a legal obligation.
5. Security and hosting — objection under Article 21(1). The others do not reach it, for the reason given in section 5 above.
If we correct, delete or restrict your data, we tell each recipient listed above, unless that proves impossible or disproportionate. You can ask us who they were. Article 19 GDPR.
We make no decisions about you by automated means, and we do not profile visitors. Article 22 GDPR does not apply here.
If you are unhappy with how we handle your personal data, tell us first at contact@maison-dee.com. You also have the right to complain to a supervisory authority, in the country where you live, where you work, or where you believe something went wrong. The Danish authority is:
Datatilsynet (the Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby
Denmark
Telephone: +45 33 19 32 00
Email: dt@datatilsynet.dk
datatilsynet.dk
This website is not directed at children and we do not knowingly collect personal data from them. Under Danish law, a person must be at least 15 years old to consent to an information society service in their own right. Below that age, consent must be given or authorised by a parent or guardian.
If you believe a child under 15 has given us personal data, write to contact@maison-dee.com and we will delete it.
We keep personal data on services that encrypt it in transit and at rest, we limit access to the people who need it to do their work, and we use multi-factor authentication on the accounts that hold it. Our suppliers are bound by written data processing agreements.
No system is perfectly secure. We notify Datatilsynet of a personal data breach without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to your rights. Article 33 GDPR. Where a breach is likely to result in a high risk to your rights, we tell you directly as well. Article 34 GDPR.
When we change how we handle personal data, we update this page and change the date at the top. Where a change adds a purpose, adds a recipient or lengthens a retention period, we tell you directly before it takes effect. Earlier versions are available on request.
DA DESIGN ApS
Piniehøj 17, 2960 Rungsted Kyst, Denmark
Registered office: Hørsholm, Denmark
CVR / VAT: DK45305481
contact@maison-dee.com