Legal
Privacy Policy
Who we are
MAXM BRANDS LLC ("Maxm Brands", "we", "us") is the data controller responsible for the personal data described in this policy. We are a limited liability company registered in the State of Wyoming, United States.
- Legal entity
- MAXM BRANDS LLC
- Registered office
- 30 N Gould St Ste N, Sheridan, WY 82801, USA
- Privacy contact
- contact@maxmbrands.com
This policy covers every storefront we own and operate. It explains what we collect, why, on what legal basis, who we share it with, how long we keep it, and the rights you can exercise.
Personal data we collect
Data you provide
- Identity and contact data — name, email address, telephone number, billing address, shipping address.
- Order data — items purchased, order value, currency, order history, delivery instructions.
- Correspondence — the content of support inquiries, returns requests and any related attachments.
- Account data — username and hashed password, where the storefront offers accounts.
Data collected automatically
- Technical data — IP address, device type, operating system, browser type and version, referring URL.
- Usage data — pages viewed, time on page, and interactions, collected in aggregate for analytics.
- Fraud-prevention signals — device and transaction indicators used by our payment processors to score risk.
Data we do not collect
We do not collect or store full payment card numbers, CVV codes, or bank credentials on our systems at any time. See Payment data.
We do not knowingly collect special categories of personal data (such as health, biometric or political data), and ask that you do not send such data to us.
Why we use it, and our legal basis
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:
- Performance of a contract
- To process orders, take payment, deliver goods and services, handle returns and refunds, and provide customer support.
- Legal obligation
- To meet tax, accounting, customs and anti-money-laundering record-keeping requirements, and to respond to lawful requests from authorities.
- Legitimate interests
- To prevent fraud and abuse, secure our systems, understand aggregate site usage, and improve our products — balanced against your rights and freedoms.
- Consent
- To send marketing communications and to set non-essential cookies. Consent may be withdrawn at any time without affecting prior processing.
Payment data
All card payments are processed by PCI-DSS Level 1 certified third-party payment processors. Card details are entered directly into the processor's hosted fields or redirect pages and are transmitted to the processor over TLS-encrypted connections.
Maxm Brands never receives, processes or stores raw card numbers, expiry dates, CVV codes or bank account credentials. We retain only the information needed to reconcile and support a transaction: the processor's transaction reference, the card brand, the last four digits, the authorization result, the amount and the currency.
Our payment processors act as independent controllers for fraud prevention and regulatory compliance purposes, and process data under their own privacy notices.
International transfers
We are based in the United States and our service providers may process data in the United States and other countries. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary technical measures including encryption in transit and at rest.
A copy of the safeguards applied to a specific transfer is available on request from contact@maxmbrands.com.
How long we keep it
- Order and transaction records
- Seven years from the date of the transaction, to satisfy United States tax and accounting requirements.
- Customer support correspondence
- Three years from the date the matter is closed.
- Account data
- For as long as the account remains open, then 12 months after closure.
- Marketing consents
- Until consent is withdrawn, plus a suppression record kept indefinitely so that we honour the opt-out.
- Analytics data
- 26 months, in aggregated or pseudonymized form.
Where data must be kept for a statutory period, we restrict processing to that purpose alone rather than deleting records we are legally required to retain.
Your rights
If you are in the EEA or the United Kingdom
You have the right to access your personal data; to rectify inaccurate data; to erasure; to restrict processing; to data portability; to object to processing carried out on the basis of legitimate interests or for direct marketing; and to withdraw consent at any time.
If you are a California resident
Under the CCPA as amended by the CPRA you have the right to know what personal information is collected, used and disclosed; to delete personal information; to correct inaccurate information; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we do not collect it); and not to receive discriminatory treatment for exercising these rights.
How to exercise a right
Email contact@maxmbrands.com with the words "Privacy Request" in the subject line. We respond within 30 days and may ask for information to verify your identity before acting, so that we do not disclose your data to someone else. Exercising these rights is free of charge.
You may also authorize an agent to submit a request on your behalf, subject to verification.
Complaints
If you believe we have handled your data improperly, please contact us first so that we can put it right. You also have the right to lodge a complaint with your national data protection supervisory authority, or with the UK Information Commissioner's Office.
How we protect data
We apply technical and organizational measures appropriate to the risk, including TLS encryption for all data in transit, encryption at rest for stored records, role-based access control on a least-privilege basis, multi-factor authentication for administrative accounts, and regular review of vendor security posture.
No method of transmission or storage is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals without undue delay, and in any event within 72 hours of becoming aware of it where legally required.
Children
Our storefronts are intended for customers aged 18 or over and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
Changes and contact
We review this policy at least annually and will update it when our practices change. Material changes will be notified by updating the date at the top of this page and, where the change is significant, by email to registered customers.
- Privacy inquiries
- contact@maxmbrands.com
- Response time
- Within one business day for acknowledgement; 30 days for formal requests
- Postal address
- MAXM BRANDS LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA