Privacy Policy

How we handle your information.

The full Monarch Luxe privacy policy — what we collect, how we use it, who we share it with, how long we keep it, and the rights you hold under GDPR, UK GDPR, and the strongest US state privacy standards.

Effective date: 2026-07-20 · Last updated: 2026-07-20 · Applies to monarch-luxe.com and all subdomains

Operated by Monarch Luxe LLC (single entity; no parent company, no affiliates).

1. Who we are

Monarch Luxe LLC operates a curated, independently authenticated luxury marketplace connecting buyers, retailers, and designers. We are a single operating entity with no parent company or affiliated businesses — there is no corporate group able to redirect your data.

Controller details:

If you are in the EEA, UK, or Switzerland, we process your data under the GDPR and/or UK GDPR. If you are in the United States, this Policy honors the strongest applicable standard across all nineteen US states with comprehensive privacy laws (California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Washington).

2. Information we collect

Categories:

  • Account and contact — name, email, phone, business name (from you).
  • Shipping and order — address, items, order history, delivery preferences (from you and courier).
  • Payment metadata — card brand, last four digits, billing address, Stripe customer ID (from Stripe; we never see or store full card numbers).
  • Inquiry communications — messages between buyers and retailers (from you and the Service).
  • Verification records — authentication certificate number, authenticator identity, outcome (from independent authenticators Entrupy and Real Authentication).
  • Retailer/supplier business data — business address, tax registration, plan tier, billing, catalog/dossier fields (from you).
  • Device and usage — IP, browser, device type, page views, session duration (automatic, first-party only).
  • Location — country, region, city inferred from IP, no GPS (automatic).
  • Cookies — session tokens, cart state, first-party analytics (automatic).
  • Communications with us — support emails, marketing preferences (from you).

What we do not collect:

  • Government identity numbers (except what customs law requires for a specific shipment).
  • Biometric data.
  • Health or financial-account data.
  • Data from third-party brokers, social-scraping services, email-append providers, or cross-site fingerprinting services.

3. How we use your information

Purposes and GDPR legal bases:

  • Provide the Service — Contract Art. 6(1)(b).
  • Authenticate and verify products — Contract + Legitimate interest Art. 6(1)(f).
  • Route and fulfill orders — Contract.
  • Route buyer inquiries to retailers — Contract + Consent.
  • Fraud detection — Legitimate interest Art. 6(1)(f).
  • Tax, accounting, legal compliance — Legal obligation Art. 6(1)(c).
  • Customer support — Contract + Legitimate interest.
  • First-party product analytics — Legitimate interest.
  • Marketing opt-in only — Consent Art. 6(1)(a) (withdrawable any time).

Automated decision-making: Authentication routing is at the SKU level, not the personal level. We make no automated decisions that produce legal or similarly significant effects on you without human review.

4. How we share your information

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not serve targeted advertising.

We share personal information only with:

  • Stripe — full payment information, to process transactions. Stripe is a separate data controller under their own policy.
  • Independent authenticators Entrupy and Real Authentication — order details and product characteristics, to produce the certificate of authenticity.
  • Atelier / freight partners — shipping address, contact, item (white-glove fulfillment, signature-required).
  • Retailers via inquiry routing — inquiry content + contact you provided (when you initiate an inquiry you direct this sharing).
  • Cloud hosting, email, and analytics providers — scoped to what they need; all bound by signed data-processing agreements, none monetize user data.
  • Government / courts — specific records under lawful compulsion.
  • Successor entity on acquisition — you will be notified beforehand and may delete your account.

5. Cookies and tracking

Strictly necessary cookies (auth, cart, security) require no consent. First-party analytics cookies (aggregate catalog performance) and functional preference cookies (locale, currency) require consent under GDPR/ePrivacy.

Cookie banner default for EEA/UK visitors: strictly necessary only. Change or withdraw at any time via “Cookie preferences” in the footer.

No third-party advertising cookies, retargeting pixels, Meta Pixel, Google Analytics cross-site features, TikTok Pixel, or LinkedIn Insight Tag — on any page.

6. Data retention

Retention periods:

Order records
7 years
Authentication certificates
Lifetime of product + 7 years
Inquiry communications
2 years from last activity
Account profile (no orders)
Until deleted or 3 years inactive
Marketing consent record
Until withdrawal + 3 years
Server logs
13 months
First-party analytics
12 months then de-identified
Support emails
3 years after closure

7. Security

In transit: TLS 1.2+. At rest: AES-256 encryption with encrypted backups. Access: principle of least privilege, access logged. Payment: never touches our servers in plaintext; Stripe is PCI-DSS Service Provider Level 1. Admin accounts: two-factor authentication required. Breach notification: within 72 hours of confirmation under GDPR Art. 33; per-state timing in the US.

8. International data transfers

Data is processed in the United States. For EEA/UK/Swiss residents we rely on: EU–US Data Privacy Framework (and UK Extension / Swiss-US DPF) where the recipient is self-certified; Standard Contractual Clauses (SCCs, 2021/914) with a transfer impact assessment; UK International Data Transfer Agreement (IDTA) for UK outbound transfers; Swiss SCCs for Switzerland. Copies of safeguards available at privacy@monarch-luxe.com.

9. Your rights — GDPR & UK GDPR (EEA, UK, Switzerland)

  • Access — Art. 15.
  • Rectification (edit in-account or email us) — Art. 16.
  • Erasure — Art. 17.
  • Restriction — Art. 18.
  • Portability — Art. 20.
  • Object to processing — Art. 21.
  • Withdraw consent (unsubscribe link in every email or email us) — Art. 7(3).
  • Supervisory authority complaint (we will not retaliate) — Art. 77.

How to exercise: email privacy@monarch-luxe.com. Response time: 30 calendar days, free of charge; extensions up to 60 further days with notice.

10. Your rights — US state privacy laws

(California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Washington — extended uniformly to all US residents.)

  • Know / Access.
  • Correct.
  • Delete (subject to retention exceptions).
  • Portability.
  • Opt out of sale or sharing — we do not sell or share for behavioral advertising; nothing to opt out of, but the right is preserved.
  • Opt out of profiling — none of our processing meets this threshold, but the right is preserved.
  • Limit use of sensitive personal information.
  • Appeal.

How to exercise: email privacy@monarch-luxe.com, subject “Privacy request.” Acknowledge within 10 business days; respond within 45 calendar days (extendable +45 with notice). No retaliation. Authorized agents accepted with proof of authorization. Appeal: reply to our denial within 45 days; we respond within 60 days.

11. Children’s privacy

We do not knowingly collect data from anyone under 16 (EEA/UK) or under 13 (US). Contact privacy@monarch-luxe.com if you believe we hold data from a minor; we will delete it promptly.

12. Marketing

Opt-in only. Every marketing email contains an unsubscribe link. Email open tracking, where used, is first-party only — no cross-site tracking.

13. Third-party links

This Policy does not cover third-party sites we may link to. Read their policies before providing them with personal information.

14. Changes to this Policy

Material changes are announced to active account holders by email with 30 days’ notice before taking effect. The “Last updated” date at the top changes with every revision.

Authoritative language: English.