Cookie Policy

A cookie (or tracker) is a small text file placed and/or read on the user's device (computer, tablet, smartphone) when browsing a website. For its period of validity, it allows the issuer to recognise the device concerned on each new visit and to store or retrieve certain information: basket contents, chosen language and currency, customer account authentication, traffic measurement, advertising preferences, and so on.

This policy covers, in a broad sense, all trackers that may be placed while browsing the site, whether they are cookies in the strict HTTP sense, local storage, or other equivalent technologies (invisible pixels, tracking tags). The term "cookie" is used hereafter for convenience to refer to all of these technologies.

Two categories of parties may place cookies during browsing on maisonratti.fr: Maison Ratti / WM Expert, as publisher of the site, for cookies necessary to its operation (session identifiers, basket, language and currency preferences); and Shopify Inc., as provider of the technical platform on which the site is built and hosted, for cookies essential to the provision of the service (browsing session, payment security, fraud prevention) and, where applicable, for its own measurement purposes.

As of today, no third-party audience measurement or external marketing tool beyond Shopify is configured on the site. Should such a tool be added, this policy would be updated accordingly and the consent banner adapted.

The table below lists, by functional category, the cookies actually liable to be placed by the Shopify platform on which the site runs, as well as the categories not yet active to date but for which this policy has already been drafted.

Strictly necessary cookies (exempt from consent, cannot be disabled from the banner): basket identifier (remembers basket contents between pages and visits, Shopify, up to 12 to 14 days after the last addition); session identifier (maintains browsing continuity, Shopify, duration of the session); customer account authentication (Shopify, up to approximately 2 weeks); payment security and fraud prevention (Shopify, session to 24 months); load balancing and technical routing (Shopify, session). These cookies fall within the consent exemption provided for by the CNIL and by Article 82 of the French Data Protection Act: they are strictly necessary for the provision of a service expressly requested by the user.

Functional cookies (preferences): browsing language (Shopify, up to 12 months); display currency (Shopify, up to 12 months); approximate country/region location (Shopify, session to 12 months). These cookies, where they are limited to remembering an explicit user choice, are generally considered necessary and exempt from consent.

Audience measurement cookies: not active to date. Should a statistics tool be activated in future, the corresponding cookies would be documented here before going live, with their precise purpose, issuer and retention period (up to 13 months maximum). Unless configured in a strictly anonymised manner in line with CNIL recommendations, these cookies are subject to prior consent.

Marketing and social media cookies: not active to date (Meta Pixel, TikTok Pixel, Pinterest Tag, sharing buttons, marketing email tools such as Klaviyo or Mailchimp). Should any be added, the corresponding cookies would be documented here (targeted advertising, advertising performance measurement, marketing personalisation, up to 13 months maximum). These cookies are systematically subject to the user's prior, informed consent, collected via the cookie management banner.

In accordance with the General Data Protection Regulation (GDPR), the ePrivacy Directive, Article 82 of the French Data Protection Act, and CNIL recommendations, the placing of cookies that are not strictly necessary is subject to the user's prior, free, specific and informed consent.

Only cookies strictly necessary for the provision of a service expressly requested by the user, necessary for securing the site and preventing fraud, or audience measurement cookies strictly meeting the exemption criteria set by the CNIL, are exempt from prior consent.

All other cookies, in particular non-anonymised audience measurement cookies, marketing, advertising, personalisation or social media sharing cookies, may only be placed after the user's explicit consent has been obtained. No cookie of this kind is placed before the user has made a positive choice via the consent banner.

Once a tool subject to consent is activated on the site, an information and consent banner will be displayed on the user's first visit, before any non-essential cookie is placed.

In line with the CNIL's settled position, this banner must respect the principle that refusing cookies must be as simple as accepting them:

• a "Reject" button must be presented at the same level, with the same visibility, the same size and in an identical number of clicks as the "Accept" button;
• there must be no visual disparity putting the choice to refuse at a disadvantage compared with the choice to accept;
• the user must be able to access a detailed settings area allowing them to accept or refuse each purpose separately;
• no non-exempt cookie may be placed until the user has expressed a positive choice;
• continuing to browse without any action by the user does not amount to consent;
• closing the banner using a cross or continuing to browse without interacting with it is equivalent to a refusal, not an acceptance.

The user may withdraw their consent at any time, as easily as it was given. This withdrawal is carried out via the "Manage my cookies" link, permanently available in the site footer, which reopens the cookie settings panel and allows previously expressed choices to be changed or revoked, purpose by purpose.

Withdrawal of consent does not affect the lawfulness of processing carried out beforehand and takes effect for future processing. Depending on the tool concerned, a reasonable technical delay may be necessary for the deactivation to become fully effective.

Independently of the site's consent banner, the user retains the option to configure their browser to accept, block or delete all or some cookies, and to be warned before they are placed:

• Google Chrome: menu > Settings > Privacy and security > Cookies and other site data;
• Mozilla Firefox: menu > Settings > Privacy and security > Cookies and site data;
• Safari (macOS / iOS): Settings > Privacy, to enable intelligent tracking prevention or block all cookies;
• Microsoft Edge: menu > Settings > Cookies and site permissions.

Completely blocking cookies, including strictly necessary ones, is liable to degrade or prevent certain features of the site, in particular adding to basket, logging into a customer account and completing an order.

In accordance with CNIL recommendations, the lifetime of cookies subject to consent does not exceed 13 months from the date they are placed on the user's device, without automatic renewal on subsequent visits. Strictly necessary cookies have a duration suited to their technical purpose, generally ranging between the length of a browsing session and 24 months at most for security and fraud prevention mechanisms.

Consent obtained from the user, where required, is itself retained for a period of 6 months, after which it is sought again.

This cookie policy may be amended at any time, in particular to reflect changes in the tools used on the site, CNIL recommendations or applicable regulations.

Maison Ratti undertakes to inform users, via a visible notice on the site and, where applicable, a fresh prompt of the consent banner, in the event that a new audience measurement, marketing or other tracking tool not previously described in this policy is added.

Information collected via certain cookies (in particular audience measurement or marketing cookies, once activated) may constitute personal data within the meaning of the GDPR. The processing of this data, the applicable legal bases, the recipients, the overall retention periods and users' rights are described in detail in the privacy policy, which prevails for any question relating to personal data in the broad sense.

For any question relating to this cookie policy or to exercising their rights, the user may refer to the contact details and full identification of the publisher set out in the legal notice.