PRIVACY POLICY - ERBORIAN UK

Personal Data Protection Policy

The entity responsible for processing your personal data from our Internet site (“https://uk.erborian.com”) and under the conditions described in this Privacy Policy is M&L Distribution (France) SARL, the registered office of which is Zone Industrielle Saint Maurice, 04100 Manosque, France (“Erborian”). The collection of your personal data complies with the provisions of the law applicable to data protection.
This Personal Data Protection Policy, with the Cookies Charter accessible at the following address: Cookie Policy, applies to the data that we collect when you use Our Internet site and our application, it describes the types of personal data that we collect from our consumers and explains how we use, disclose, share and transfer the said data, as well as the choices available to our consumers regarding our use of the said data. It also describes the measures that we take in order to protect the security of these data, and how you can contact us regarding our personal data protection practices. We ask you to please carefully read this Personal Data Protection Policy. If you do not wish for your personal data to be used in the manner described in this Personal Data Protection Policy, it is possible that we may be unable to respond to certain of your requests.

We ask you to regularly review this Personal Data Protection Policy in order to remain up-to-date with any possible modifications of this policy, notably any that relate to the collection and conditions for the processing of your personal data.

TOPICS ADDRESSED

- Collection of your personal data
- Use of the data that we collect
- Information that we share
- Transfer of your personal data
- Information on the retention period
- Protection of your personal data
- Social networks and content generated by users
- Your rights
- Links to third party sites and services
- Modification of the personal data protection policy
- Contact us

COLLECTION OF YOUR PERSONAL DATA

We can collect your personal data in various ways, notably when you visit our stores, take part in events, consult our online content, or use our mobile applications. For example, when you register as a member and/or join our loyalty programme, before you can make a purchase online, when you participate in a contest or promotional game, participate in an activity that we organise by means of surveys via our applications and social media, subscribe for our newsletter, order a catalogue, join a premium site with restricted access, when you register for an event, or when you contact us by e-mail or telephone.
We can also link and/or combine the information regarding you that we collect from the various devices that you use.
The types of personal information that we can collect are the following:
a)      Registration data (name, mailing address, e-mail address, mobile telephone number or other number);

b)      Usernames and passwords;

c)      Personal data (date of birth, sex, preferred language and beauty profile, such as skin and hair types);

d)      Your interest and experience with our products and products of a similar nature;

e)      Payment data (bank card number, expiry date, authorisation number, security code, and invoicing address);

f)      Information on purchases and operations (type and number of products purchased and returned);

g)      Customer service data, surveys and comments from the customer service department and data exchanged with our customer service team;

h)      Photographs, videos and other comments that you provide;

i)       Contact information that you provide to us regarding your friends and other people that you would like for us to contact (name, delivery address, e-mail address, mobile telephone number and/or other telephone number);

j)       Location and geolocation data;

k)       Your social data on social media platforms if you connect to one of our sites using a social login;

l)     Data relating to you and coming from publicly available sources, including publicly available content on social media platforms;

m)      Any other data that you provide to us subsequent to a request to one of our departments; and

n)      Data that we can obtain from suppliers of external services.

Also, as explained in our Cookies Charter, we can collect certain data and trace your activity online, as well as the data linked to your device and to your operating system, your IP address, the web pages or advertisements that you see, the details of your visits to our online content and social media, advertising identifiers or similar identifiers and your online actions collected by automated means, such as our cookies, third party cookies, Web servers, pixels and web tags, and by demographic means, linked to areas of interest and content, when you visualize our content, use our applications, social media, contact us by any means or application, open the e-mails that we send to you or sent by third parties on our behalf, and when you visit the Internet sites and networks of third parties on which our advertisements are displayed. We can establish links between the data that we have collected via automated means, such as your data and your browsing history, and other data that we have obtained relating to you.

The suppliers of third party applications, tools, gadgets and plug-ins on our Internet sites and applications, as well as third party Internet sites and networks on which our advertisements are displayed (such as advertising networks, digital advertising partners and social media platforms) may also use automated means and demographic means linked to areas of interest and context, in order to collect data relating to you, such as your interactions with these functions, while tracing your online activity, constantly and via third party Internet sites. These data are collected directly by these third party suppliers (in addition to the data collected by us) and are subject to their policy. Insofar as allowed by the applicable law, we cannot be held liable for the practices of these third parties and suppliers.
If you do not agree that we can collect the above data relating to you, it is possible that we may not be able to offer you with certain services, including the ones identified in this Personal Data Protection Policy.

USE OF THE DATA THAT WE COLLECT

Why do we process your data?	How do we use your data for these purposes?	What are the legal bases for the processing?
To provide you with products and services	We use your personal data in order to provide products and services suited to your needs.	We use these data in order to fulfil the contractual obligations existing between us and you.
To process transactions, including payments, made via Our Internet Site	We use data, including payment data, in order to process transactions, for example when you place an order via our Internet Site.	We use these data in order to fulfil the contractual obligations existing between us and you.
To create, register and manage your account	We use your personal data, including your e-mail address and username, in order to create, register and manage your account, for example by providing you with a password when you ask us for one, and by verifying your identity when necessary.	We use these data in order to fulfil our legal obligations. We use these data in order to fulfil the contractual obligations existing between us and you.
To create and manage in-store accounts	We use your personal data in order to open and manage your in-store account.	We use these data in order to fulfil the contractual obligations existing between us and you.
To manage your customer opinions	We use your personal data, including your e-mail address and username, to manage the opinions that you publish regarding our products on our Internet site as well as with our affiliates, partners and resellers of Erborian products. We may use your contact details to reach out to you after you published an opinion.	This processing is necessary for the legitimate interests of Erborian, namely in order to better communicate with you and improve the quality of our products and services.
To communicate with you and answer any queries that you might have	We use your personal data, including your contact details and video chat data, in order to communicate with you and to respond to your queries.	We use these data in order to fulfil the contractual obligations existing between us and you. While we do not have a contract with you, this processing is necessary so as to meet the legitimate interests of Erborian, namely better communicating with you.
To manage your participation in promotions, special events (such as contests, games, random draws, offers, surveys and market studies) and your participation in our loyalty programme	We use your personal data, including purchase and operation information, to manage your participation in various promotions or special events, as well as the loyalty programme.	We use these data in order to fulfil the contractual obligations existing between us and you (when you accept the regulations of the contests, games or random draws, and when you accept the conditions for using the loyalty programme). This processing is necessary for the legitimate interests of Erborian, namely in order to better prepare offers, surveys and market studies.
To make deliveries or provide you with our services (such as newsletters by e-mail, resupply service, Express Payment)	We use your personal data, including your contact details and e-mail address, to make deliveries to you and to ensure that you can access our other services.	We use these data in order to fulfil the contractual obligations existing between us and you.
To market, assess and improve our products and services (notably developing new products and services, analysing our customer database, performing data analyses, accounting and auditing)	We combine personal data, notably provided by customer service, to assess and improve the products and services that we offer to you.	This processing is necessary for the legitimate interests of Erborian.
To send promotional offers and other communications and information that we believe may be useful to you (including special offers) by means of e-mails, postal letters, telephone messages, SMS and push notifications, and to develop and carry out targeted marketing campaigns as well as behavioural advertising, including by means of displays on third party applications installed in your telephone	We use personal data, including contact details, information on purchases and your beauty profile, in order to provide you with communications that may be of interest to you.	We obtain your consent before any processing of your data for these purposes. With regard to postal correspondence, this processing is necessary for the legitimate interests of Erborian.
To provide you with store addresses as well as advertisements based on your geographical location.	We use personal data, including geolocation data, in order to provide you with the contact details of the stores closest to your location, and to adjust the marketing communications on the basis of your location.	We obtain your consent before any processing of your data for these purposes.
To document your preferences and habits regarding our products and services	We use your personal data, including your interest in our products and your experience with them, in order to understand how you make the most of our products and services.	This processing is necessary for the legitimate interests of Erborian, namely to know you better.
To analyse surveys or statistics in order to improve Our Internet Site and our services	We use your personal data, including customer service data, surveys and comments from the customer service department and data exchanged with our customer service team, in order to improve Our Internet Site and our services.	This processing is necessary for the legitimate interests of Erborian, namely to know you better.
To fulfil our obligations resulting from contracts or agreements existing between us and you	We use your personal data so as to better meet your expectations, resulting from contracts or agreements existing between us and you.	We use these data in order to fulfil the contractual obligations existing between us and you.
To ensure that the content of Our Internet Site, our pages on social networks and our e-mail messages are presented in the most efficient possible manner for you, and to customise your experience on Our Internet Site by providing you with information and products that suit your needs	We use personal data, notably related to your online activity, your browser and your operating system, to ensure that Our Internet Site is properly displayed on your computer.	This processing is necessary for the legitimate interests of Erborian, namely providing you with access adapted to Our Internet Site while improving your experience when you visit Our Internet Site.
To add to Our Internet Site and our advertising	We compile data notably relative to the web pages that you view, in order to provide you with advertising content that meets your expectations.	This processing is necessary for the legitimate interests of Erborian, namely in order to make Our Internet Site attractive and to improve its content.
To manage Our Internet Site and combat fraud	We use personal data, including cookies, in order to update and enhance Our Internet Site, and to combat fraud over the Internet.	This processing is necessary for the legitimate interests of Erborian, namely managing Our Internet Site such as to prevent fraud and combat any risk of fraud, while also ensuring the security of Our Internet Site during your visits.
To conduct research and analyses of the efficiency of our marketing and advertising efforts	We use personal data, including data that we may obtain from suppliers of external services, in order to understand the efficiency of our communication efforts.	This processing is necessary for the legitimate interests of Erborian, namely analysing the efficiency of our communication efforts so as to provide you with a more pleasant user experience that better meets your expectations.
To analyse how and how often you visit Our Internet Site	We use personal data, including cookies, to understand your use of Our Internet Site.	This processing is necessary for the legitimate interests of Erborian, namely to analyse your visits to Our Internet Site so as to better respond to your expectations during your future visits.
To target the advertising and messages that we send to you, via third party advertising networks, including search engines such as Google, and social media such as Facebook	We use data from social networks and third party networks that notably relate to demographic means linked to areas of interest and context as well as your online activities, in an isolated or combined manner. After compiling these data with other information that we have provided to them, you will receive advertising messages suited to your interests.	This processing is necessary for the legitimate interests of Erborian, namely so as to know you better and to provide you with a more pleasant user experience that better meets your expectations.

INFORMATION THAT WE SHARE

We do not disclose the personal data that we collect regarding you, except in the following cases:

a) within the L’Occitane group worldwide, meaning with our subsidiaries and the company that ultimately controls us (“L’Occitane Group”);

b) with service providers that provide services in our name or that help us with the maintenance and/or improvement of our Internet sites, the management of our loyalty programme, as well as with the distribution, improvement and/or marketing of the products and services that we offer to you, including the entities that process orders and provide the web hosting, information storage, suppliers of e-mail services, marketing services including direct marketing, research and analysis services as well as tag management services such as Google Analytics and Adobe Analytics. For more information on these analysis services and regarding your opposition rights, please visit the sites:
https://support.google.com/analytics/answer/6004245
Google Analytics: https://support.google.com/analytics/answer/6004245
Adobe Analytics: https://www.adobe.com/privacy.html

c)with our network of franchisees in connection with the sale of our products in UK, notably to manage the collection points for products ordered via Our Internet Site;

d) with our professional partners for co-branding of products, joint promotions, common communications and programmes;

e)with our professional partners for their own purposes, including in order to provide you with information regarding third party products and services that may be of interest to you, if you have formally expressed this possibility and have given your consent;

f)if we are required to do so by the law;

g)with the police authorities, representatives of the government or other parties in response to a legal decision, judicial procedure or writ of summons;

h)when we consider that this disclosure is necessary or appropriate in order to prevent physical damage or a financial loss or fraud possibly affecting you or us; to prevent or report illegal activity; to protect the property rights of any person, or the security of any person, including our own, or in application of our Terms and Conditions or of any other agreement between us;

i)as part of the sale of all or part of our company and its assets to a third party, or as part of a business reorganisation or restructuring (including dissolution or liquidation); and

j)when you provide your consent for this in another manner, or ask us to share your information with third parties.

We can share aggregated and/or anonymous information that does not identify you, for our own commercial purposes or those of our partners, which notably includes the number of visitors to Our Internet Site and the number of clicks on our advertising and/or e-mails.

TRANSFER OF YOUR PERSONAL DATA

The information regarding you and collected by us can be transferred, stored and processed in any country or territory in which one or more subsidiaries of our group or a service-providing third party, agent or business partner is located, including other countries of the European Economic Area (EEA), Switzerland and the United States for the aforesaid purposes. Processing is also possible by personnel members outside of the EEA and outside of your country.
When we transfer your information to a country that does not offer a satisfactory degree of protection, we take the following measures in order to ensure the security of your personal data:
- for exchanges of personal data with the United States, the protection of your personal data is assured by the EU-US Privacy Shield self-certification mechanism; and
- for exchanges of personal data with [Pakistan, India, Russia, Australia and Asia], through the use of the Standard Contractual Clauses prepared by the European Commission.
You can obtain more information on these guarantees by contacting us by e-mail or postal mail, at the addresses shown in the “Contact us” section below.

INFORMATION ON THE RETENTION PERIOD

Unless indicated otherwise, we will store your personal data for the time strictly needed in order to carry out the aforementioned purposes, in accordance with the applicable law. In some cases, we are required to retain data in order to fulfil our legal and administrative obligations. When we have no further need of the information, it is deleted from our systems or anonymized.

PROTECTION OF YOUR PERSONAL DATA

We undertake to implement appropriate technical and organisational measures in order to protect your personal data against accidental or involuntary destruction, accidental loss, alteration, or any unauthorised disclosure, access or usage.

SOCIAL NETWORKS AND CONTENT GENERATED BY USERS

Some of our sites and applications enable users to post their own content. Please note that any content posted on our social platforms can be seen by the public. You should therefore be vigilant with regard to posting certain personal data on these platforms, such as any financial data, your address or any health problems. We cannot be held liable for actions taken by other persons if you post personal data on one of our social network platforms.

YOUR RIGHTS

You have the right and possibility to correct, update and delete the information in your online account as well as your preferences at any time, by signing in to your account and looking under “My Account”, or by contacting us as shown in the “Contact us” section of this Personal Data Protection Policy.
You can also ask us to delete your data from our distribution lists, and exercise your right to withdraw so as not to receive any direct marketing communications from us, as indicated in the “Contact us” section of this Personal Data Protection Policy or by following the “Unsubscribe” link or the withdrawal instructions provided in our communications.
It can take a few days to process your withdrawal request, and it is possible that you may continue receiving promotional or marketing e-mails or postal letters during this time. Your refusal to receive direct marketing messages does not prevent us from providing you with other types of non-promotional messages, such as e-mail confirmations of transactions.

If you wish to prevent the collection of your location and/or geolocation data, you can do so by changing the parameters of your device and/or using the following options:
a.      deactivate the localization services of specific applications for which you have accepted the collection of location or geolocation data for the purposes of targeted direct marketing;
b.      deactivate the localization services for all applications;
c.      turn off Bluetooth;
d.      Android: https://support.google.com/googleplay/answer/3405269; or
e.      IOS: https://support.apple.com/en-us/HT202074

Within the limits of the applicable law, you can:
-       request access to the personal data that we have regarding you, and obtain a copy thereof,
-       ask us to correct, update, limit or block any data,
-       ask us to provide the personal data relating to you in a structured, commonly used and machine-readable format, by contacting us by e-mail or by postal letter at the addresses shown in the “Contact us” section below.
When allowed by law, you can withdraw any consent that you had previously given or, at any time and for legitimate reasons, object to the processing of your personal data. We will then apply your preferences.
You can also provide instructions on the management of your personal data after your death. These instructions can be left directly with Erborian or with a third party instructed to provide them to us at the appropriate time.
You also have the right to submit a complaint to the French Data Protection Authorities (CNIL).

LINKS TO THIRD PARTY SITES AND SERVICES

Our websites and applications can provide links to sites, applications and services other than the ones provided by Erborian, and that may be operated by third party companies. Please note that we do not approve and are not responsible for the processing of your personal data by these third party sites, even if we provide a link to these sites. These companies may have their own personal data protection declarations or policies, and we strongly recommend that you read and examine them. Our products and services can also be offered to you through third party platforms or other third party channels. We decline any liability regarding the personal data protection practices of the sites, applications or services that are not provided by Erborian.

MODIFICATION OF THE PERSONAL DATA PROTECTION POLICY

This Personal Data Protection Policy can be updated periodically in order to reflect changes to our practices relative to the processing of personal data. We will inform you of these changes, including their effective date. If you continue using Our Internet Site once these changes have taken effect, your continued usage of Our Internet Site will indicate that you have accepted these changes.

CONTACT US

If you would like for us to update the information that we have regarding you or your preferences, notably if you wish to be removed from our distribution lists, to withdraw your consent, to object to the processing of your data, or if you have questions regarding the protection of your personal data, please contact us by e-mail at the following address: ukcustomerservices@erborian.com or by post at the following address : L'Occitane Ltd - Erborian - Capital House 25 Chapel St, London NW1 5DH United Kingdom

You can also contact our Data Protection Officer (DPO) by e-mail at the following address: dpo@loccitane.com

Last updated : March 1st, 2022