Privacy policy
Last updated: 18 September 2026
This policy explains what personal data MUSU collects when you visit musubrand.com, place an order or write to us, why, with whom it is shared, how long it is kept and how to exercise your rights. It applies Regulation (EU) 2016/679 (the "GDPR") and French Law No. 78-17 of 6 January 1978 (the "French Data Protection Act (Loi Informatique et Libertés)").
1. Who is responsible for your data
MUSU, a French limited liability company (SARL) with a share capital of €5,000, Nice Trade and Companies Register (RCS) 901 778 902, 35 avenue de Profondeville, 06190 Roquebrune-Cap-Martin, France.
For any question about your data: team@musubrand.com, or by post to the address above. MUSU has not appointed a data protection officer; these requests are handled by the managing director.
2. The data we process
What you give us:
- Orders and customer account: surname, first name, delivery and billing addresses, email, phone number, items purchased, amount, order history. Card details are entered directly with our payment provider: MUSU neither sees nor stores them.
- Exchanges with us: messages sent by email, through the contact form or through the withdrawal form (order number, name, email, date of receipt, items, choice of refund, exchange or store credit, message), as well as photos of a returned pair.
- Information and offer emails: your email and the date you signed up (newsletter, or box ticked when ordering).
- Reviews and questionnaire: the review you post and your answers to the short questionnaire offered after purchase.
The fields marked as mandatory when ordering (name, address, email, phone number) are necessary to conclude and deliver the order: without them, we cannot accept it. The phone number is used by the carrier and by customer service. Other information is optional.
If you have an order delivered to another person, we process their name, address and phone number for delivery only.
What we receive from third parties: delivery tracking (carriers), the outcome of payment checks (Stripe, PayPal, Klarna), the performance of our advertising (Meta, Google).
Your browsing, depending on your choices in the cookie banner (section 9): pages viewed, IP address, device, browser, country, cookie identifiers. If you have accepted "Advertising and personalised emails" in the banner and you place an order, your email and phone number are sent to Meta and Google in pseudonymised (hashed) form: they can only match them with accounts they already know, in order to link an advertisement seen to a purchase.
We do not process any sensitive data.
3. Why, and on what legal basis
| What we do | Legal basis |
|---|---|
| Processing and delivering your order, handling customer service, returns, withdrawal and guarantees | Performance of the contract |
| Issuing invoices, keeping accounts, meeting customs obligations, keeping proof of withdrawals and of their acknowledgement of receipt | Legal obligation |
| Preventing payment fraud and abuse (false returns, false forms, anti-bot protection of forms) | MUSU's legitimate interest |
| Keeping a record of payment incidents (unpaid amounts, bank chargebacks disputed by MUSU and not resolved) in order to refuse a new order until the situation has been resolved; you are informed of this by email and may dispute this record at team@musubrand.com | MUSU's legitimate interest (avoiding further unpaid amounts) |
| Sending you our information and offer emails, if you have signed up to the newsletter or ticked the box provided when ordering (it is never pre-ticked) | Your consent |
| Sending you a reminder email when you have viewed a product or left a basket without ordering, if you have signed up to our emails and accepted "Advertising and personalised emails" in the banner | Your consent |
| Inviting you to leave a review and to answer the questionnaire after purchase; these emails contain no commercial offer and include a link to stop receiving them | Legitimate interest (understanding and publishing our customers' satisfaction); you may object |
| Publishing the review you choose to post | Your consent |
| Measuring the site's audience; showing you our advertisements on other sites and social networks, and measuring their effectiveness | Your consent (cookie banner) |
Profiling and automated decisions. Our email and advertising tools categorise customers according to their purchases and browsing, in order to tailor our messages; you may object to this. Our payment providers assign each payment a fraud risk score and may automatically block a payment judged to be at very high risk, under their own responsibility: you can then pay by another method or write to us at team@musubrand.com. Where it is MUSU that decides to cancel an order, that decision is always taken by a member of the team, and you may submit your observations. For payment in instalments, Klarna may decide automatically whether or not to accept the request, in accordance with its own policy.
4. Who receives your data
We do not sell your data for money. It is shared only with those who need it.
The MUSU team, within the limits of their duties.
Our processors, who process your data solely on our instructions:
- online shop and hosting: Shopify;
- shipping: Sendcloud;
- emails: Klaviyo; team email: Google Workspace;
- post-purchase questionnaire: Fairing; stockist map: Stockist;
- stock management: Horse; consolidation of our sales and marketing data: Funnel;
- anti-bot protection of forms: hCaptcha;
- audience measurement: Google Analytics; transmission of measurements from our servers: Addingwell;
- shop management assistant: Claude (Anthropic);
- our chartered accountant.
Recipients who process your data on their own behalf, in accordance with their own privacy policy:
- payment and fraud prevention: Stripe, PayPal, Klarna (Klarna also displays its payment offers on our pages; before your consent, its module stores on your device only its version number, which is necessary for display);
- parcel delivery: La Poste (Colissimo) and, for certain destinations, FedEx;
- customer reviews: Trustpilot, to which we send your name, your email and your order number in order to invite you to leave a review.
Joint controllers: for the collection on our site and the transmission of your browsing and purchase data for advertising purposes, MUSU is a joint controller with Meta Platforms Ireland Ltd (Facebook, Instagram) and with Google Ireland Ltd (Google Ads, Merchant Center). Each of them is solely responsible for any further processing. Main terms of these arrangements: https://www.facebook.com/legal/controller_addendum and https://business.safety.google/adscontrollerterms/.
The authorities that request it in accordance with the law, and customs authorities for shipments outside the European Union. The consumer mediator (CM2C) if you refer a matter to it.
Certain foreign laws, for example in California, may classify the transmission of data to Meta and Google for advertising as a "sale" or "sharing". You can refuse it in the cookie banner.
5. Transfers outside the European Union
Our contracting party for Shopify is Shopify International Limited (Ireland). Several providers process data outside the European Union:
| Provider | Country | Safeguard |
|---|---|---|
| Shopify, Klaviyo, Fairing, Google, Meta, Stripe, PayPal, hCaptcha, Anthropic, FedEx | United States | European Commission adequacy decision for companies certified under the "EU-U.S. Data Privacy Framework", failing which the Commission's standard contractual clauses |
| Shopify | Canada | European Commission adequacy decision |
| Stockist (stockist map) | Outside the European Union | European Commission standard contractual clauses |
You can ask us for a copy of these safeguards at team@musubrand.com.
For an order delivered outside the European Union, your delivery data is sent to the carrier and to the authorities of the destination country: this transfer is necessary for the performance of the contract (Article 49(1)(b) of the GDPR).
6. How long
| Data | Period |
|---|---|
| Order data | For the duration of the relationship, then archived for 5 years (limitation period, Article 2224 of the French Civil Code) |
| Sales contract for an amount of €120 or more | 10 years from delivery (Articles L. 213-1, D. 213-1 and D. 213-2 of the French Consumer Code; you may ask us for a copy at any time) |
| Customer account | Deleted after 3 years without a login or order |
| Subscription to our emails (customers and non-customers) | 3 years after your last purchase, contact or click, or until you unsubscribe |
| Invoices and accounting records | 10 years (Article L. 123-22 of the French Commercial Code) |
| Customs declarations | 3 years |
| Withdrawals, returns, complaints and the related evidence | 5 years after the end of the order |
| Payment incidents | Until resolved, and for no more than 3 years |
| Messages to customer service | 3 years after the last exchange |
| Reviews and questionnaire answers | 3 years |
| Cookies and the data they collect | See section 9 |
At the end of these periods, the data is deleted or anonymised.
7. Your rights
You may at any time:
- access your data and obtain a copy of it;
- have it corrected or completed;
- request its erasure;
- request the restriction of its processing;
- receive the data you have provided to us in a structured, commonly used and machine-readable format, in order to pass it on to another service (portability);
- withdraw your consent, without affecting what was done beforehand;
- set out instructions on the retention, erasure and communication of your data after your death (Article 85 of the French Data Protection Act). In the absence of instructions, your heirs may exercise your rights to the extent necessary to settle your estate and obtain the closure of your account (Article 85, II, of the French Data Protection Act).
Right to object. You may object at any time, without having to give reasons, to direct marketing and any related profiling. You may also object, on grounds relating to your particular situation, to the other processing based on our legitimate interest. Every marketing email contains a link allowing you to unsubscribe in one click.
Write to team@musubrand.com stating your request. We reply within one month, which may be extended by two months if the request is complex; we will inform you if so. We may ask you to prove your identity where there is reasonable doubt.
If you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the data protection authority of your country of residence in the European Union.
You may also register free of charge on the Bloctel telephone marketing opt-out list (www.bloctel.gouv.fr).
8. Minors
Purchasing and creating an account are reserved for adults (our terms of sale, Article 4.1). Our information emails are not intended for children under 15 (Article 45 of the French Data Protection Act); if we learn that a minor under 15 has signed up to them without parental consent, we delete their data.
9. Cookies
A cookie is a small file placed on your device when you visit; the same rules apply to other information that the site stores on or reads from your device. When you arrive, a banner lets you accept everything, decline everything, or choose purpose by purpose (audience measurement; advertising and personalised emails) using the "Customise" button. Declining is as easy as accepting, and does not prevent you from making a purchase.
You can change your mind at any time, as easily as you made your choice, using the "Manage cookies" link at the bottom of every page.
| Cookies | Issuer | What they are for | Duration | Your consent |
|---|---|---|---|---|
| Basket, session, security, language and country, remembering your choice | Shopify | Making the site work | From the session up to 12 months (your cookie choice is kept for 12 months) | Not required |
| Shop statistics | Shopify | Measuring visits | 12 months | Required |
| Google Analytics | Measuring audience | 13 months | Required | |
| Recently viewed products | Shopify | Displaying the products you have just viewed; the information stays on your device | Until deleted by your browser | Not required |
| Advertising and conversions | Meta, Google (Ads, Merchant Center) | Showing you our advertisements and measuring their effectiveness | Up to 13 months | Required |
| Anti-bot protection of forms | hCaptcha | Distinguishing a human from a bot on forms | Session | Not required (security) |
| Browsing tracking for our emails | Klaviyo | Linking the products viewed to your email, if you have signed up to our emails and accepted "Advertising and personalised emails" | Up to 13 months | Required |
YouTube videos are displayed in privacy-enhanced mode: YouTube does not place any advertising cookie, but the player may store technical information on your device when you start a video. MUSU keeps measurement data for no more than 14 months; Meta and Google keep the data they receive in accordance with their own policy.
10. Security
The site is encrypted (HTTPS). Payments go through PCI-DSS certified providers. Access to data is limited to the people and tools that need it, with protected accounts.
11. Changes
This policy may change. The date of the last update appears at the top of the page; in the event of a significant change, we will inform you on the site or by email. This policy exists in French and in English; in the event of any discrepancy, the interpretation most favourable to the data subject applies.