Privacy policy


Privacy & Cookie Policy

Last Updated: September 2026

At C’est Madeleine Limited (“we”, “us”, or “our”), we are committed to protecting and respecting your privacy.

This policy explains how we collect, use, store, and share your personal data when you visit our website www.cestmadeleine.co.uk (our "Site"), purchase products from us, or otherwise interact with us. Please read this document carefully to understand our views and practices regarding your personal data.

1. Who We Are (Data Controller)

For the purpose of UK data protection legislation, the data controller is:

C’est Madeleine Limited

Company Registration Number: 14434743

Registered Office: 20-22 Wenlock Road, London, N1 7GU, United Kingdom


2. Personal Data We Collect & Lawful Bases for Processing

Under the UK GDPR, we must have a lawful basis to process your personal data. The table below outlines what data we collect, why we use it, and the legal basis we rely on:

Data Category What We Collect Purpose Lawful Basis
Account & Identity Data Name, title, username, password, date of birth. To register your account, manage your profile, and verify your identity. Contractual Necessity
Contact Data Billing address, delivery address, email address, telephone number. To fulfill your orders, communicate regarding purchases, and deliver support. Contractual Necessity
Transaction Data Payment details, order history, products purchased, customer service communications. To process payments, fulfill orders, manage returns, and handle complaints or inquiries. Contractual Necessity / Legitimate Interests
Financial & Payment Data Encrypted payment token, billing address. (Note: Full card numbers are processed securely by our PCI-DSS compliant payment gateways and are never stored on our servers.) To process payments securely and facilitate faster checkout. Contractual Necessity
Marketing Data Preferences for receiving marketing, newsletter sign-ups, survey responses. To send you promotional updates, news, and special offers. Consent (Active Opt-in) / Legitimate Interests (Soft Opt-in for existing customers)
Technical & Usage Data IP address, browser type/version, time zone, location, operating system, browsing patterns, page interaction. To administer our site, troubleshoot errors, conduct data analytics, and protect against fraud. Legitimate Interests / Consent (for tracking cookies)
User-Generated Data Product reviews, feedback, competition entries. To display reviews on our site and run promotional competitions. Consent / Legitimate Interests

3. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to distinguish you from other users, personalize your browsing experience, and analyze web traffic.

  • Essential Cookies: Necessary for the operation of our website (e.g., shopping cart functionality, secure login).

  • Analytics & Performance Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics).

  • Marketing & Re-targeting Cookies: Used to track visitors across websites to deliver relevant advertisements (e.g., Meta Pixel, Google AdWords, Criteo, AdRoll, Pinterest, Twitter, TikTok).

Managing Cookies: When you first visit our Site, you will be presented with a cookie consent banner. Non-essential cookies will only be placed on your device if you provide active consent. You can update your preferences or withdraw consent at any time via the cookie settings on our Site or through your web browser.

4. Direct Marketing

We will only send you direct marketing communications if:

  • You have explicitly opted in (by checking an un-ticked consent box).

  • You are an existing customer who has purchased goods from us and has not opted out of receiving updates about similar products ("soft opt-in").

You can unsubscribe from marketing communications at any time by clicking the "Unsubscribe" link in any promotional email or by contacting us at contact@cestmadeleine.co.uk.

5. International Data Transfers

Our primary web servers are hosted in Europe. However, some of our third-party service providers (e.g., payment gateways, marketing tools, analytics engines) are located outside the United Kingdom and the European Economic Area (EEA).

Whenever we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

  • Transferring data to countries deemed to provide an adequate level of protection for personal data by the UK Government.

  • Using specific standard contractual clauses approved for use in the UK (the UK International Data Transfer Agreement / UK Addendum) alongside appropriate security assessments.

6. Data Security & Storage

All personal data provided to us is stored on secure servers. Payment transactions are processed using encrypted Secure Sockets Layer (SSL) technology through third-party PCI-DSS compliant providers.

Where you have chosen a password to access certain parts of our site, you are responsible for keeping this password confidential.

While we take all reasonable technical and organizational precautions to protect your data, transmission over the internet is inherently insecure, and we cannot guarantee complete security of data transmitted to our site.

7. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, tax, or regulatory reporting requirements.

  • Order & Financial Records: Retained for 6 years following the end of the tax year in which the transaction took place (UK tax requirements).

  • Account Data: Retained for as long as your account remains active or until you request deletion.

  • Marketing Preferences: Retained until you withdraw your consent or opt out.

8. Disclosure of Your Personal Data

We may share your personal data with selected third parties, including:

  • Service Providers: IT/hosting providers, payment processors, logistics and delivery couriers, and marketing platforms.

  • Professional Advisers: Lawyers, auditors, bankers, and insurers as necessary to run our business.

  • Corporate Transactions: Prospective buyers or sellers in the event that we sell or buy any business or assets.

  • Legal Obligations: Courts, law enforcement, or regulatory bodies to comply with legal processes or protect rights and safety.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow third-party service providers to use your personal data for their own independent purposes.

9. Your Statutory Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right to Access: Request a copy of the personal data we hold about you (Subject Access Request).

  • Right to Rectification: Request correction of any incomplete or inaccurate data.

  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no good reason for us continuing to process it.

  • Right to Object: Object to processing based on legitimate interests or for direct marketing.

  • Right to Restrict Processing: Request suspension of processing your personal data in certain scenarios.

  • Right to Data Portability: Request transfer of your data to you or a third party in a structured, commonly used format.

  • Right to Withdraw Consent: Withdraw consent at any time where we rely on consent to process your data.

To exercise any of these rights, please contact us at contact@cestmadeleine.co.uk. We respond to all legitimate requests within one month.

10. How to Complain (The ICO)

You have the right to make a complaint at any time to the UK supervisory authority for data protection issues:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF


Telephone: 0303 123 1113

(We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.)

11. Changes to This Privacy Policy

We reserve the right to update this policy from time to time. Any changes will be posted on this page with an updated date. Where appropriate, significant changes will be notified to you by email.

12. Contact Us

If you have any questions, comments, or requests regarding this Privacy & Cookie Policy, please contact us: