Latest version: September 22, 2026
This Privacy Policy explains how personal data is collected and processed when you visit the SABA website accessible at https://www.mysaba.eu (the “Site”), and describes your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable data protection laws.
This policy applies to the Site only. The global privacy policy of Established. is available at https://established.inc/privacy-policy/.
Data controller
The data controller is Talisman Brands, Inc. d/b/a Established. (“Established.”, “we”), 1013 Centre Road, Suite 403-B, Wilmington, New Castle County, Delaware 19805, United States of America, registered with the Paris Trade and Companies Register under number 913 357 174. Contact: contact@established.inc.
Personal data we collect
- Contact form: first name, last name, e-mail address, country, subject and content of your message, and any other information you choose to provide.
- Newsletter: e-mail address and, where applicable, your subscription preferences.
- Browsing data: technical data (IP address, browser type, pages visited, date and time of visit) collected through cookies and similar technologies, subject to your consent where required. See our Cookies page.
We do not collect sensitive data through the Site. Fields marked as mandatory in forms are necessary to process your request; without them, we will not be able to respond.
Purposes and legal bases
- Answering your requests sent through the contact form — legal basis: our legitimate interest in responding to your enquiries, or steps taken at your request before entering into a contract.
- Sending the SABA newsletter — legal basis: your consent, which you may withdraw at any time using the unsubscribe link included in each e-mail.
- Measuring audience and improving the Site — legal basis: your consent to analytics cookies.
- Ensuring the security and proper functioning of the Site — legal basis: our legitimate interest.
- Complying with our legal obligations and defending our rights — legal basis: legal obligation and legitimate interest.
We do not sell your personal data and do not use it for automated decision-making or profiling producing legal effects.
Recipients
Your data is accessible only to the authorized Established. teams that need it for the purposes above. Where your request concerns products sold in a specific country, it may be forwarded to the relevant SABA licensee so that it can answer you. We also rely on service providers acting on our behalf, in particular:
- Webflow, Inc. (website hosting and form handling), with infrastructure provided by Amazon Web Services and Cloudflare, Inc.;
- Google LLC / Google Ireland Limited (Google Tag Manager and audience measurement tools, subject to your consent);
- our e-mailing provider for the newsletter.
These providers are bound by data processing agreements and may only process your data on our instructions.
International transfers
Some of our providers are located in the United States. Transfers of personal data outside the European Economic Area are governed by the EU-U.S. Data Privacy Framework, for certified providers, and/or by the Standard Contractual Clauses adopted by the European Commission.
Retention periods
- Contact requests: 3 years from our last exchange with you.
- Newsletter: until you unsubscribe, or 3 years after your last interaction with our e-mails.
- Cookies and your consent choices: 13 months maximum.
Data may be kept longer, in archived form, where required by law or to establish, exercise or defend legal claims.
Security
We implement appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, disclosure or alteration, including encrypted connections (HTTPS) and restricted access.
Your rights
Under the GDPR, you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20) and to object to its processing (Art. 21). Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7). You may also give instructions on the fate of your data after your death.
To exercise your rights, write to contact@established.inc, specifying your request and providing information allowing us to verify your identity. We will answer within one month of receipt of your request.
If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or with the supervisory authority of your country of residence.
Cookies
For information on the cookies used on the Site and how to manage your preferences, please see our Cookies page.
Changes to this policy
We may update this Privacy Policy at any time, in particular to reflect legal or technical changes. The date of the latest version is indicated at the top of this page.
Contact
For any question about this policy or the processing of your personal data: contact@established.inc.
