Privacy policy

Thank you for choosing to shop at Maison Marou (“Marou”). We hope you will have the best experience when shopping at Maison Marou. Here, we always guarantee your privacy by implementing privacy policies and other measures required by the laws so that your data is processed in a lawful and secured manner.  

We are MAROU CHOCOLATE JOINT STOCK COMPANY, bearing the Enterprise Registration Certificate No. 0311389477 and having registered address at No. 152-154-156-158-160 B2 Street, An Khanh Ward, Ho Chi Minh City, Vietnam (“Marou”).

We recognize that visitors and customers to our site may be concerned about the information they provide to us and how we handle that information. Marou is the controller, as defined by applicable law, and is responsible for this website. This privacy notice (“Privacy Notice”) describes the types of information we collect from and about you when you visit our website where this notice is posted (or the mobile optimized version of the website) (the “Website”), or when you otherwise interact with us online or in person. This Privacy Notice also explains how we may use and disclose such information, as well as your choices regarding the collection, use and disclosure of your personal information.

During the course of the Marou’s activities, we will collect, use, disclose, store and/or process information, including your personal data (which may include basic and sensitive personal data), in a manner which will be fully detailed below. Marou only collects, uses, disclose, stores and/or processes your personal data in accordance with this Privacy Policy and the prevailing laws of Vietnam.

For information about how to contact us regarding the collection, use, and disclosure of your personal information, please see below.

1 - COLLECTION OF PERSONAL DATA AND PROCESSING ACTIVITIES

1.1. Types of personal data collected and processed

Collected and processed personal data of our customers typically include, but not limited to:

(i) Basic personal data which refers to personal data that reflects common personal factors and background information frequently used in transactions and social relationships, including names, gender, billing addresses, shipping addresses, telephone numbers, e-mail addresses,  nationalities, dates of birth; purchase information including product type, date of purchase, delivery address, purchase receipt; location settings, cookies information.

(ii) Sensitive personal data which refers to personal data associated with an individual's privacy rights; when violated, it directly affects the legal rights and interests of agencies, organizations, including credit card information, bank account information, payment information when you make a purchase directly on our Website so that we can fulfill your request; your special biological characteristics being allergy to food or substances.

1.2. Primary sources of personal data

Generally, Marou receives personal data from the customers directly when you choose to provide it to us via various interactions by this Website. However, in some cases personal data will be supplied by third parties; or collected from publicly available resources.

The following are the primary ways the Marou collects personal data about customers

(i) We may collect personal data when you:

  • sign up as a member to the website;
  • make a purchase by using the cart feature on the website or by contacting directly with Marou;
  • access our Website using cookies, log fields, web beacons, tags or pixels;
  • sign up for cooking classes via the registration form provided on the website;
  • contact Marou through the Website;
  • subscribe to marketing emails from us;
  • participate in any social media offerings (such as contacting us through our social media platforms such as Facebook);
  • use any feature, function, application available on the Website;
  • interact with us through another service or application such as Facebook, Messenger, Grab, etc.

(ii) We may collect other personal data to improve our Website and other online services from you, third parties (including but not limited to agents, suppliers, contractors, partners and any other service providers who collect your personal data and/or perform functions on our behalf or with our partners, including but not limited to payment partners, government’s data sources, financial service providers, credit organizations, delivery partners, marketing and other services), our other related partners or data is automatically collected when you access the Website. We may also receive personal information about you from other sources if you have given permission for that information to be shared or the information is published according to the laws. This may include information from commercially available sources, such as public databases and data aggregators, and information from third parties.

2 - THE BASIS AND PURPOSE OF DATA COLLECTION, USE, AND DISCLOSURE

2.1. Lawful basis for personal data processing

We will not process your personal data without a valid legal basis. Accordingly, we will only process your personal data where:

  • The processing is necessary for us to fulfill your request to purchase the products offered by Marou, register account on this website, register for participation in experiential activities we offer, provide you with after-sale support and other customer services, among others;
  • It is required to comply with our legal or regulatory obligations (such as for tax obligations, our obligations in cooperation with investigations of authorities);
  • We have obtained your prior consent for the processing purposes; and/or
  • The processing is otherwise permitted or required by applicable law.

2.2. Purpose of personal data processing

We collect and process personal data for various purposes including, but not limited to: (the “Purpose”):

2.2.1. Providing online shopping services via this Website and maintain our relationship with you

  • Generate your account for e-commerce purchase and maintain your account on our website;
  • Confirm, process, and fulfill your orders on our website and other platforms (such as delivery platforms);
  • Initiate necessary actions for Marou’s internal management, which may include storing data in internal system to manage orders and maintain sales record;
  • Communicate with you regarding order status, delivery, or related matters;
  • Manage returns, refunds, or exchanges where applicable;
  • Resolve issues or disputes arising in connection with your orders, by responding to your inquiries, complaints, or service requests through available communication channels (website’s contact form, email, phone, online chat on our social media account, etc.);
  • Track and manage customer support interactions to ensure service quality and resolution;
  • Provide after-sales support, including claims on quality of the products (if applicable).

2.2.2. Experiential Activities Participation

For the purpose of this notice, “Experiential Activities” refers to the Marou Academie classes or chocolate sampling classes that our customers may register via the relevant section on this website. To ensure your participation in the Experiential Activities, we will:

  • Collect your information from the registration form on this Website, which may include sensitive personal data regarding your special biological characteristics being allergy to food or substances;
  • Process your registration via our registration form and confirm your participation;
  • Communicate with you regarding the status of the class, such as the timeline, preparation or related matters;
  • Perform necessary action to organize the activities, including preparing venues, tools, among others;
  • Gather your feedback regarding the organization and the quality of the classes and improve our services.

It is Marou’s principle to ensure that all children [under the age of 16] are accompanied by adult during participation of Experiential Activities. As such, we will request you to provide the age of the children to ensure that they are accompanied by an adult. Other than the age of the child, we do not process any information that may identify the child, and accordingly, to be considered a personal data.

2.2.3. Promotional and Marketing Activities

We may use your personal data to:

  • Understand your preferences and browsing history regarding products similar to those Marou may provide;
  • Enhance the features and usability of our website and services;
  • Deliver advertisements and marketing content that reflect your interests and interaction history (including personalized emails or digital campaigns);
  • Carry our promotional and marketing activities on our official channels (such as website or social media accounts) to update our activities to the public;
  • Occasionally, carry out formal promotional media and marketing campaigns e.g. external advertisements for Marou.

2.2.4. Security and Fraud Prevention

Your personal data is processed to:

  • Ensure the security of your purchase and preventing unauthorized access;
  • Detect, investigate, and mitigate fraudulent transactions or activities that may compromise your account or our systems;
  • Protect our legal rights and preventing abuse of our services; and
  • Implement CCTV at our premises for security and monitoring purposes.

2.2.5. Compliance with Legal Obligations

We may process, store, or disclose your personal data when required to:

  • Comply with applicable laws and regulations in Vietnam, including in order to comply with any requirement of any applicable statute, regulation or regulatory rule, such as compliance with tax and accounting obligations; anti-money laundering laws and safeguarding requirements;
  • Fulfill requests, inspections, or orders from competent authorities (e.g., cybersecurity, tax, or consumer protection agencies);
  • Retain data for mandatory archiving or record-keeping periods under relevant legislation.

Other than the purposes as listed above, we may collect and process your personal data for other purposes (i) in accordance with prevailing laws of Vietnam or (ii) as informed and duly consented by you from time to time before implementing the respective collection and processing activities.

2.2.6. Other circumstances where whe process your data without requiring your consent

According to applicable laws, there may be times that we are permitted to process personal data without your consent, including:

  • To safeguard and take appropriate action to protect the life, health, honor, dignity, rights, and lawful interests of the personal data subject or others in urgent situations; to protect our or others’ legitimate rights or interests, or the interests of the State or organizations when necessary against acts that infringe upon those interests.
  • To address emergency situations; threats to national security that have not yet reached the level of declaring a state of emergency; prevention and control of riots, terrorism, crime, and legal violations;
  • To serve the operations of state agencies and state management activities in accordance with the law.

In such cases where we need to process personal data without obtaining your consent, we will undergo appropriate procedures and implement suitable measures under the law to ensure the legitimacy of personal data processing.

3 - PERSONAL DATA RETENTION AND SHARING

3.1. Retention of personal data

Personal data is maintained on the website’s servers, our internal database or those of our service providers and is accessible to authorized employees, representatives and agents who require access for the purposes described in this Notice.

We retain personal information in accordance with our record retention policies. Where we collect personal data for a specific purpose per this Privacy Notice and your consent, we will not keep it for longer than is necessary to fulfil that purpose, unless we have to keep it pursuant to the prevailing laws, including but not limited to the retention and use of your personal data as necessary to resolve disputes and exercise legal rights and obligations.  Retention periods are set taking into account the purpose for which the personal information was collected, applicable legal requirements, and our legitimate need to retain business records for reasonable periods.

We will cease processing your personal data as soon as:

(i) there are adequate reasons that the storage of personal data does not serve the intended purposes and is no longer necessary for any legal and financial purpose;

(ii) you request the deletion of your personal data, and there is no legal basis to continue storing and processing your personal data;

(iii) otherwise as agreed with you in writing.

At the end of the retention period, personal data (in physical or electronic form) will be deleted, destroyed or anonymized by the Marou using appropriate measures to ensure it cannot be restored.

3.2. Sharing of personal data

For the most part, personal data collected by Marou will remain within our organization, and will be processed by appropriate individuals only in accordance with their roles and our policies, i.e, on a “need-to-know basis”. We do not sell or otherwise disclose personal information about the visitor and customer on our Website, except as described in this Privacy Policy.

However, we may share or allow to share your personal data and/or transfer your personal data to a third party and/or our partners for the purposes stated in this Privacy Policy. Third parties and partners in Vietnam or abroad, including but not limited to:

  • Third party service providers we have retained to perform a business, professional or technical support functions for us, including the Software-as-a-Service (SaaS) or infrastructure provider; other service providers to the extent necessary or desirable to help fulfill orders, complete your transaction, delivery or provide customer service. This type of external data processing is subject to contractual assurances that personal data will be kept securely and used only in accordance with Marou’s specific directions; and
  • Third parties as required by laws or government authorities where they have followed due legal process to request us to disclose the information.

These third parties may have access to personal information about our customers if it is needed to perform their functions for Marou, but they are not authorized by Marou to use or disclose the information except as necessary to perform services on Marou’s behalf or to comply with legal requirements.

In situations where a third party under contract with Marou collects and processes your personal data, we will use our best endeavor to require the third party to apply appropriate personal data protection measures in order to exercise reasonable care in protecting your information, mitigate any risk, consequences and unexpected damage during the processing.

When disclosing your personal data to a third party, we guarantee the third party and concerned partners will protect your personal data from illegal access, collection, use, disclosure, processing activities or similar risks and only store personal data in necessary time for the purposes stated above.

If you wish to stop receiving advertising messages from these third parties, please contact us under the details specified in the “Contact Us” section below. In addition, you may be able to refuse the receipt of marketing emails and advertisement, by not opt in the tick box to receive our marketing emails, or through the privacy settings in each social media platform.

We may also share personal data in connection with any acquisition, merger or any acquisition in our business activities, provided that we meet the requirements of data protection laws applicable when disclosing your personal data.

4 - CROSS-BORDER TRANSFER OF DATA

We can transfer or allow the transfer of your personal data outside Vietnam for any purpose defined in this Privacy Policy. In such case, we will put in place appropriate measures to ensure the adequate protection of your personal data when it is transferred to countries that do not provide the same level of protection for personal data; and ensure that the cross-border transfer of data complies with applicable laws.

5 - YOUR RIGHTS AND OBLIGATIONS

You have a number of rights in relation to your personal data. These are:

(i) Right to be informed: You have the right to understand how Marou processes your personal data. This Privacy Policy is designed to provide you with clear and sufficient information about our data handling practices.

(ii) Right to consent and withdraw consent: You may decide to consent or not to the Marou’s processing of your personal data. You may ask Marou to provide a copy of the personal data that we hold on you in accordance with the laws or agreement between Marou and you, as long as such request does not harm national defense, security, social order and safety or infringe upon the life, health or property of others.

(iii) Right to access and rectify: You may ask Marou to correct any information we hold about you if it is incorrect.

(iv) Right to erase, restrict, and object to Personal Data Processing: You may ask Marou (under certain conditions) to delete information that Marou holds on you. You may object, on grounds relating to your particular situation, to any of the Marou’s particular processing activities in order to prevent or restrict the disclosure of personal data or the use of personal data for advertising and marketing purposes.

(v) Right to complain and seek compensation: You may file complaints, denunciations, and lawsuits with the relevant competent authorities and claim compensation for damages arising from any unlawful processing of your personal data.

(vi) Right to request for protection measures: You may request authorities to implement necessary measures to protect your personal data in accordance with the provisions of civil law and other relevant legislation.

You may exercise your rights related to your Personal Data by submitting a request to the Personal Data Protection Department using the contact information provided in the relevant section, either by sending a direct written request, via email, or through other electronic means.

Any request for exercise of your rights above shall clearly set out at least the following content: (i) Your information (full name, email or phone number, Employee ID number and Department); (ii) the specific rights you would like to exercise and the categories of personal data subject to the requests; (iii) the reasons, purposes for exercising your rights; and (iv) relevant information, documents to your exercise of your right.

Upon receiving your request, we will verify the identity of the requester, the completeness and accuracy of the request in accordance with legal regulations, and assess the feasibility of fulfilling the request. We reserve the right to request additional information for verification purposes, or to refuse to process the request if: (i) you fail to provide sufficient information to verify your identity and the validity of the request; or (ii) legal regulations do not permit us to fulfill your request; or (iii) there is a specific request from a competent government authority

Please note that the rights mentioned above are not absolute and may be subject to certain legal limitations and exceptions; as well as other requirements and principles under the law. In specific circumstances, Marou may be entitled to deny or restrict the exercise of these rights in accordance with applicable laws.

You also have the following obligations:

(i) To protect your own personal data, including safeguarding account credentials and exercising caution when disclosing personal data to third parties.

(ii) To respect and protect the personal data of others, and refrain from acts that infringe upon the privacy or data protection rights of other individuals.

(iii) To provide complete and accurate personal data as required by law, contractual obligations, or when giving consent to the processing of their personal data.

(iv) To comply with personal data protection laws and actively participate in the prevention, detection, and reporting of violations related to the protection of personal data.

6 - SECURITY

While Marou implements appropriate technical and organizational measures to safeguard your personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction, no method of transmission over the internet or method of electronic storage is entirely secure. Accordingly, we cannot guarantee absolute security.

Despite our best efforts, there remains a risk that unauthorized access, data breaches, or misuse may occur. Such incidents may lead to adverse consequences, including but not limited to reputational harm, emotional distress, or increased exposure to identity theft or fraud. To mitigate such risks, we have implemented a robust security program that includes encryption, access controls, and regular security audits, as well as other organizational and technical measures according to the prevailing laws and industry standards to protect your personal data from the moment we collect it and throughout the processing period.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

7 - RIGHTS TO AMEND THIS PRIVACY POLICY

We reserve the right to amend this Privacy Notice from time to time to ensure our business operation, market changes and compliance to the Vietnamese laws. Material changes made to this Privacy Notice will be updated and published on our website and notify by pop-up windows and/ or via the communication method that you have provided to us.

Notwithstanding, we encourage you to review this Privacy Notice periodically in order for you to stay updated and notified of any changes. Your continued use of this Website and app and acceptance of our services after any changes to this Privacy Notice constitutes your acknowledgement, understanding and consent to any such changes, to the extent such consent is not otherwise provided.

8 - COOKIES POLICY

We are Marou Chocolate Joint Stock company, bearing the Enterprise Registration Certificate No. 0311389477and having its registered address at 152-154-156-158-160 B2 Street, An Khanh Ward, Ho Chi Minh City, Vietnam (“Marou”).

We may use data collection devices such as “cookies” on certain pages of our Website to personalize your online experience, help analyze our Website flow, and measure promotional effectiveness. The below explains about the cookies we use on our websites.

1. What are Cookies?

Cookies are text files stored on the device you use to visit our website. Some cookies are essential for our websites to work, others collect anonymous or personal information to allow us to improve our websites and to show you relevant content.

2. Why do Marou use Cookies?

  • Personalization: Cookies enable us to remember your preferences, such as language and display settings, providing a customized user experience.
  • Analytics: Cookies help us understand how you interact with our Website, allowing us to optimize user experience and improve functionality.
  • Targeted Information: Cookies allow us to deliver information and advertisements that align with your interests, enhancing the relevance of the content you see.
  • Feature Accessibility: Certain features on our Website are only available through the use of cookies, enhancing overall functionality.

3. How long are Cookies stored on my devices?

Two types of cookies can be stored:

  • Session cookies which are automatically deleted when you close your browser.
  • Persistent cookies which remain on your computer until they are deleted or expire. Persistent cookies can keep your user preferences to help make future browsing easier and more relevant.

4. How do I change my Cookie preferences?

Most browsers automatically accept cookies, but you can choose whether or not to accept cookies through your browser controls, often found in your browser’s “Tools” or “Preferences” menu.

5. Type of Cookies we use

Essential cookies

Without these cookies, our website may not work properly. These cookies are strictly necessary for Marou to ensure security, ease of use and functionality. Others provide you with services available across our websites and are needed to use some of its features.

Analytics cookies

Analytics cookies are used to understand how visitors use our website. This includes capturing visitors’ location, how pages are browsed, patterns and preferences within their journey, time spent on site and additional data that helps us improve your experience. Some of these include third party cookies used by external companies, which provide a service to Marou and are implemented to provide you with a quick and seamless personalized experience.

Performance and functional cookies

We use performance & functional cookies to further improve our website in order to always provide you with the best possible online experience. For example, to ensure the speed of our web pages, enable video content and faster browsing. These technologies are not always essential but without these cookies, certain website functionality may become unavailable. Some of these cookies are third party cookies used by third party companies which provide a service to Marou.

Advertising and marketing cookies

Advertising and marketing cookies are used to limit the number of times you see an advert, to show you adverts relevant to you and to help measure the effectiveness of marketing activities. These cookies can be third party cookies used by third party companies, which provide a service to JLL. Among others, they include social media cookies. Advertising and Marketing cookies can be utilized to build a profile of your interests based on the browsing information they collect from you, which includes identifying your browser and terminal equipment. If you do not allow these cookies, you will get a less targeted experience.

For more information about how Marou process your personal information please refer to our Privacy Notice.

More information

For further details about cookies, please refer to the third-party sources listed below:

  • Website Cookies: http://www.allaboutcookies.org/manage-cookies/
  • Mobile Cookies:  http://www.allaboutcookies.org/mobile/index.html

6. How to manage Cookies from the browsers?

Delete cookies from your device

Cookies that are already on a device can be deleted by deleting the browsing history, thus deleting cookies from all visited websites. However, some of the saved information (for example, login data or website preferences) may also be lost.

Manage site-specific cookie

To have more precise control of the specific cookies of each site, users can adjust their privacy and cookie settings in the browser.
Block cookies

While most modern browsers allow users to block cookies, doing so often requires manually adjusting settings for each website or page visited. Additionally, this may cause certain services or features to function improperly.

7. Security

The website uses information security technologies which are accepted throughout the industry, such as FireWalls, methods to control access and antivirus mechanisms. All of these have the objective of preventing unauthorised access to the data that we may collect via this website.

8. Right to amend this Cookies policy

We reserve the right to amend this Cookies Policy from time to time to ensure our business operation, market changes and compliance to the Vietnamese laws. Material changes made to this policy will be updated and published on our website and notify by pop-up windows and/ or via the communication method that you have provided to us. 

We encourage you to review this policy periodically in order for you to stay updated and notified of any changes.

9 - CONTACT US

If you have any question about personal data protection or privacy policy of data, or other complaints about this Privacy Policy or about how we process your personal data, please contact us at the following details:

DATA PROTECTION DEPARTMENT - MAROU CHOCOLATE JOINT STOCK COMPANY

Address: Marou Chocolate JSC, 152-154-156-158-160 B2 Street, An Khanh Ward, Ho Chi Minh City, Vietnam

Email: we@maisonmarou.com

Phone number: 1900636996