Effective date: [01.07.2026]
Last updated: [01.07.2026]

1. Who we are

MAHÉ ("MAHÉ," "we," "us," or "our") operates the website [insert domain, e.g. maheswim.com] (the "Site"), an online store selling swimwear and lifestyle products. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.

MAHÉ is registered in the Seychelles. If you have questions about this policy or your data, contact us at hello@maheswim.com.

This policy applies to visitors and customers worldwide. Where local law gives you additional or different rights (for example, under the EU General Data Protection Regulation or the California Consumer Privacy Act), those specific rights are set out in Section 8.

2. What personal data we collect

We collect the following categories of data:

CategoryExamplesWhen collectedContact informationName, email, shipping/billing address, phone numberCheckout, account creation, newsletter signupOrder informationProducts purchased, order value, order historyCheckoutPayment informationLimited to the last 4 digits of your card, payment method typeCheckout (full card details are handled directly by our payment processor — see Section 5)Account informationLogin email, password (encrypted), order historyAccount creationMarketing preferencesEmail/SMS opt-in status, engagement with campaignsNewsletter signup, email interactionsDevice and browsing dataIP address, browser type, pages viewed, referral source, approximate locationAutomatically, via cookies and similar technologiesCustomer communicationsMessages you send us via email, contact forms, or social mediaWhenever you contact us

We do not collect sensitive personal data (health, biometric, religious, political information, etc.) and ask that you don't include this in messages to us.

3. How we use your data

We use personal data to:

• Process and fulfil orders, including payment, shipping, and customer service
• Create and manage your account
• Send order confirmations, shipping updates, and service messages
• Send marketing emails or SMS, where you've opted in (Section 6)
• Improve the Site, understand traffic patterns, and measure the effectiveness of our marketing
• Run retargeting and lookalike advertising campaigns (Section 6)
• Prevent fraud and protect the security of the Site
• Comply with legal obligations (tax, accounting, consumer protection law)

We do not sell personal data for money. Under some US state laws, sharing data with advertising partners (like Meta or Google, for interest-based ads) is legally classified as a "sale" or "share" even without money changing hands — see Section 8 for your opt-out rights.

4. Legal basis for processing (EU/UK visitors)

Where GDPR applies, we rely on:

• Contract — to process your order, deliver products, and provide customer service
• Consent — for marketing emails/SMS and non-essential cookies
• Legitimate interest — for fraud prevention, Site analytics, and improving our service
• Legal obligation — for tax and accounting records

You can withdraw consent at any time (Section 8) without affecting the lawfulness of processing before withdrawal.

5. Who we share data with

We share data with the following categories of service providers, each of which processes data under its own privacy policy and (where required) a data processing agreement with us:

ProviderPurposeData sharedShopifyE-commerce platform, hosting, checkoutAll data needed to run the storeShopify Payments / StripePayment processingPayment and order detailsKlaviyo / MailchimpEmail and SMS marketingEmail, name, purchase history, engagement dataGoogle (Analytics, Ads)Site analytics, advertisingBrowsing behaviour, device data, approximate locationMeta (Pixel, Ads)Advertising, retargetingBrowsing behaviour, device data, hashed contact info if you engage with adsShipping carriersOrder deliveryName, address, contact number

We do not share data with third parties for their own independent marketing purposes without your consent.

We may also disclose data if required by law, to protect our legal rights, or in connection with a business transfer (merger, acquisition, sale of assets).

6. Cookies and tracking technologies

The Site uses cookies and similar technologies to:

• Keep your cart and login session active (essential — cannot be disabled)
• Understand how visitors use the Site (analytics)
• Show you relevant ads on other platforms and measure their performance (advertising/retargeting, via Google and Meta pixels)

You can control non-essential cookies through the cookie banner on the Site, and through your browser settings. Blocking essential cookies may affect Site functionality (e.g. checkout).

California and other opt-out rights: Because we use advertising pixels, some US state laws treat this as a "sale" or "share" of data. You can opt out via [Do Not Sell or Share My Personal Information link] or by enabling the Global Privacy Control signal in your browser.

7. Data retention

We keep personal data for as long as needed for the purposes above:

• Order and transaction records: retained for the period required by applicable tax and accounting law (typically 5–7 years)
• Account data: retained while your account is active, deleted on request
• Marketing data: retained until you unsubscribe or request deletion
• Analytics data: retained per the default settings of our analytics providers, generally 14–26 months

8. Your rights

If you are in the EU/UK (GDPR)

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

If you are a California resident (CCPA/CPRA)

You have the right to:

• Know what personal data we collect, use, and share
• Delete personal data we hold about you
• Correct inaccurate data
• Opt out of the "sale" or "sharing" of personal data
• Non-discrimination for exercising these rights

For all visitors

To exercise any of the above, email hello@mahethelabel.com with your request. We'll respond within the timeframe required by applicable law (generally 30–45 days). We may need to verify your identity before actioning certain requests.

9. Children's privacy

The Site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. International data transfers

Your data may be processed in countries outside your own, including the United States and the Seychelles, by us and by the service providers listed in Section 5. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect data transferred internationally.

11. Security

We use industry-standard measures — including encryption at checkout and access controls — to protect personal data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy as our practices, tools, or legal obligations change. The "Last updated" date at the top reflects the most recent revision. Material changes will be reflected on this page; we encourage you to review it periodically.

13. Contact us

MAHÉ
Email: hello@maheswim.com
Eden Island P12A11, Victoria, Mahé Seychelles

This document is a draft template based on the information you provided (Shopify, Klaviyo/Mailchimp, Google/Meta pixels, global launch). It is not legal advice. Before publishing, have a lawyer review it — especially the GDPR and CCPA sections — since exact obligations depend on your revenue, EU establishment status, and how much data you actually process at launch.