Privacy Policy

Effective date: 20 July 2026
Last updated: 20 July 2026

This Privacy Policy explains how Boulangerie Brume (“we”, “us”, “our”) processes personal data when you visit mamaheartspace.mom, contact us, place an order, or visit our bakery in Nantes. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and French law, under the supervision of the Commission Nationale de l’Informatique et des Libertés (CNIL).

1. Controller

• Business name: Boulangerie Brume
• Address: 14 Rue Crébillon, 44000 Nantes, France
• Email: [email protected]
• Phone: 02 40 48 72 15

2. Personal data we collect

• Identity and contact data — name, email, phone number, billing address
• Order data — products requested, pickup dates, allergen notes you share
• Communication data — messages via form, email or telephone
• Technical data — IP address, browser type, pages visited, cookie identifiers (see our Cookie Policy)

3. Purposes and legal bases

• Contract performance — to fulfil orders and bakery services (Art. 6(1)(b) GDPR)
• Legitimate interests — website security, service improvement, enquiries (Art. 6(1)(f) GDPR)
• Legal obligation — French accounting and tax rules (Art. 6(1)(c) GDPR)
• Consent — non-essential cookies and optional marketing (Art. 6(1)(a) GDPR)

4. Sharing of data

We do not sell personal data. We may share data with IT/hosting providers, payment providers, professional advisers, and public authorities where required by French or EU law.

5. International transfers

Where data is transferred outside the EEA, we use an adequacy decision, Standard Contractual Clauses, or another GDPR-approved safeguard.

6. Retention

• Order and invoice data: generally up to 10 years under French commercial rules
• Contact messages: typically up to 24 months after last correspondence
• Cookie preferences: as described in the Cookie Policy

7. Security

We apply appropriate technical and organisational measures to protect personal data.

8. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to certain processing. You may also define instructions for the handling of your data after death under French law. Contact us to exercise rights.

9. Complaints

You may lodge a complaint with the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.

10. Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do.