Data controller
B.D.D.R., 9 B route de Saint-Cézaire, 06530 Spéracèdes, France. Contact: contact@malistedenoel.fr.
Data, purposes and retention periods
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Christmas lists | Chosen name or first name, message, cover image, gifts (title, link, price, photo, note, options) | Performance of the service | Until the list or account is deleted |
| Reservations and group gifts | Technical browser identifier (hashed), first name and optional email of participants | Performance of the service | Until the list is cancelled or deleted |
| List link and 'empty list' reminder | Email address optionally provided when creating a list without an account, or to receive its link | Consent | Deleted after the reminder is sent, and at the latest 15 days after the list is created |
| Contact messages | First name, email address, subject and message sent from the contact page | Legitimate interest (responding to your request) | 2 years after sending |
| Account | Name and email address; irreversibly encrypted password (PBKDF2) for an email account, or profile photo and identifier provided by Google or Facebook; notification preferences | Performance of the service | Until the account is deleted; sessions: 90 days |
| Reminders before Christmas | Confirmed email address of a loved one subscribed to a list | Consent (double confirmation) | Until unsubscribed; unconfirmed requests deleted after 30 days |
| Secret Santa draw | First names, optional emails, exclusions, results, list link | Performance of the service | 12 months after the event date, or deletion by the organiser |
| List co-management | Co-manager accounts, invitations (email optional) | Performance of the service | Invitations: 14 days; access: until withdrawn |
| Blog: comments and ratings | First name, optional email (not published), comment; hashed IP address fingerprint against spam | Legitimate interest (moderation, anti-spam) | Comment: until deleted; IP fingerprint: 12 months |
| Genie (gift ideas) | Description entered, sent to the AI service to generate ideas; not stored by the site | Performance of the service | Not stored |
| Security and anti-abuse | Hashed IP address fingerprints, Turnstile verification, technical error logs | Legitimate interest (security) | Rate limits: 24 hours; errors: 90 days with the provider |
| Statistics | Daily totals without personal data | Legitimate interest | Unlimited (anonymous data) |
Who sees what?
Anyone with the sharing link to a list can view it: only share it with your loved ones. Lists are not indexed by search engines. The list owner can see which gifts are reserved, unless they turn on surprise mode. They do not know by whom, unless they turn on the “See who reserved” option: the first name given when reserving is then shown to them, which the reservation form points out. The organiser of a group gift sees the first names and emails of participants to help coordinate. Do not include sensitive information in your lists. The Ma Liste de Noël team may view a list only for support, moderating reported content, or a deletion request.
Processors and transfers outside the European Union
- Hostinger (European Union) : Hosting of the website, database and images
- Cloudflare (United States) : Turnstile anti-bot protection on certain forms
- Google, Meta (Facebook) : Account login, if you choose it
- Twilio SendGrid (United States) : Sending emails (notifications, reminders, invitations, draw)
- Anthropic (United States) : Artificial intelligence for the Genie and blog writing assistance
- OpenAI, Tavily (United States) : Illustrations and sources for blog articles (back-office only)
- Amazon : Product search and affiliate links
- Sentry (United States) : Technical error tracking
Transfers to the United States are governed by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
E-mails
You only receive emails linked to an action: reservation notification (account, can be disabled in "My account"), reservation confirmation, reminders before Christmas if you have confirmed them, invitations and draws. Each reminder contains an unsubscribe link.
Browser extension
The "Ma Liste de Noël - Add to my list" extension (Chrome, Edge, Firefox) only works when you click its icon or "Add to my Christmas list" in the right-click menu. It then reads, on the displayed page only, the name, price, image and address of the product, then opens our site's add window, pre-filled. Nothing is saved until you confirm the addition; the data saved is then that of the gift, in your list. The extension does not read your browsing history, does not run in the background, contains no trackers and does not send any data to third parties.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You can delete a list yourself ("Customise" then "Delete this list") or your account and all its lists ("My account"). For any other request: contact@malistedenoel.fr. If you encounter any difficulty, you can contact the CNIL (cnil.fr).
Cookies
Only cookies necessary for the service are used: see the cookies page.
Security
Encrypted connection (HTTPS), private links and random sessions stored in hashed form, protection against bots and abuse, daily backups encrypted at rest, sanitised article content.
Last updated: 20 octobre 2026.
Manage my lists