CLARINS PRIVACY POLICY

This Privacy Policy was updated on 12/03/2021

1 - Introduction

Clarins places great importance on the protection of user’s privacy and its obligations in accordance with the legal provisions in force. This Privacy Policy allows you to better understand the principles of data protection applied by Clarins. We invite you to read it before submitting your personal data. Trimex Pty Ltd. whose registered office is Level 2/230 Clarence St, Sydney, NSW, 2000, Australia (ACN 001 198 787) is data controller for the website clarinsnewzealand.co.nz. This Privacy Policy may be updated at any time by us. The date of the most recent revision will appear on this page. We suggest that you refer back to it on a regular basis.

2 - When do we collect your information?

We collect personal information from you when:

• you visit our website;
• you create an account on our website;
• you make a purchase or a reservation on our website or in certain approved points of sale of our distribution network ;
• you subscribe to one of our newsletters;
• you sign up for one of our loyalty programs;
• you participate in special operations, in particular games, competitions, product tests, customers surveys or market researches;
• you share content on social networks such as Instagram, Facebook, Pinterest or Twitter using the hashtag #clarins or other hashtags we offer;
• you are visiting one of our Spa or some approved points of sale of our distribution network ;
• you contact us, in particular when you call or submit a request or a complaint to our Customer Service teams, when you rate or review our products and/or services or when you chat with other visitors in real time;
• you have given your consent to third parties to send us personal information about you.

3 - What information do we collect about you?

We consider that all information that could identify you directly or indirectly are "personal information". We may mainly collect the following personal information:

• information about your identity, in particular your gender, last name, first names, address, telephone numbers, email address, username and password, date of birth or age;
• information about your payment method, in particular your credit card number and the expiration date;
• information about our commercial transactions, in particular transaction numbers, history of your purchases, your request or your communications with our Customer Service team, your preferences and interests or information about one of our loyalty program;
• content information such as photos, videos, ratings, reviews, comments ;
• information about wellness or health (beauty concern, skin type, skin sensitivity, contraindications, etc.) subject to your prior and explicit consent, in particular for cosmetovigilance or when asking for a beauty prescription Clarins or a treatment Clarins in one of our Spa;
• information about your social media accounts (username, caption information, location, etc.), uploads and posts when you share content or use the hashtag #clarins or other hashtags we offer;
• recordings of telephone conversations to offer the best quality of service, in particular for the purpose of staff training and appraisal;
• technical information, in particular your IP address or information about how your device navigates through our website;
• other information you provide when you contact us or we have received from external providers.

4 - Why is your personal information collected?

Personal information may be collected mainly for the following purposes:

• Website administration and improvement of the quality of service. (Legitimate interest);
• Processing of your orders (orders, deliveries, invoices, after sales service, etc.). (Performance of a contract);
• Customer Relationship Management (CRM), in particular to help us get to know you better and to provide you with personalized offers about our products and services (in particular by email, by SMS, on social networks or any other medium and by displaying targeted ads on websites and on social networks), to manage your membership to our Loyalty program (Consent). For these purposes, we may perform segmentation operations based on your preferences, interests and purchases behavior, analyse your browsing and requests on our website or perform any other actions to better qualify our database. For example, we may import certain encrypted data (email or phone number) on third-party platforms to check if you already had an interaction with our brands and/or are likely to be interested by our products and services and to provide you with personalized advertising on social networks using retargeting features. Creating an account allows us to personalize your customer experience but you can also place an order using the Guest Check Out option. This processing is made with your consent or is necessary for the purposes of the legitimate interest referred to above;
• Carrying out analyzes and business statistics (business intelligence, data visualization, etc.), measuring your satisfaction and R&D (Legitimate interest);
• Measurement of the performance of affiliate campaigns (Consent) ; Social interaction (Consent);
• When appropriate, prevention and fraud detection, crime and litigation management. The fraud detection solutions we use can be completely automated or involve human intervention. When we use automated fraud detection solutions, we engage in processing of your personal information for the purpose of identifying fraudulent activity or securing payment and making automated decisions in this respect. The logic of this automated decision-making relies on applying fraud analysis rules and models to our business processes to determine if an action is potentially fraudulent. This processing can produce legal effects that concern you or similarly significantly affect you, and specifically we may refuse to enter into a contract with you. We inform you that we may also use reCAPTCHA, a service provided by Google to protect our site from spam and abuse. For information on how Google uses the data collected through reCAPTCHA, you may review Google Privacy Policy and Terms of Service (Legitimate interest);
• Processing your requests and complaints (Consent);
• Managing undesirable effects related to the use of our products (Cosmetovigilance), carrying out studies concerning the safety of use of our products and exercise of your rights(keeping an opt-out list) (Legal obligation),.
• As otherwise permitted by law and/or notified to you from time to time.

5 – Do we disclose your personal information?

We never sell nor rent your personal information to other companies for marketing purposes.

Clarins is an international group that operates in many countries. The personal information we are collecting about you will be used by us and is likely to be communicated to other Clarins group companies if necessary and in particular to our parent company in France and/or our subsidiaries in France, South Africa, Germany, Australia, Austria, Benelux, Canada, China, South Korea, Dubai, Spain, Hong Kong, Ireland, Italy, Japan, Malaysia, Mexico, Portugal, Russia, Singapore, Switzerland, United Kingdom and Taiwan.

It may also be shared with service providers chosen for their expertise and reliability and acting on our behalf and at our direction (order processing and fulfilment, secure payment, customer service management, maintenance and technical development operations, rate and reviews, analytics, spam prevention, management of digital campaigns and affiliation, etc.). We authorize these service providers to use your personal information only to the extent necessary to perform services on our behalf or to comply with legal requirements and we strive to ensure that your personal information is always protected.

These third parties may be located in or out of the European Economic Area (EEA), including in countries that do not provide the same level of data protection as in your country of residence. In such a case, we will ensure that:

- we obtain your unambiguous consent to share your personal information with these third parties,
- we enter into appropriate data transfer agreements conforming to the Standard Model
Clauses established by the European Commission,
- we comply with Binding Corporate Rules (BCR) approved by competent authorities.

Finally, we may also transmit your personal information to local authorities if required by law or as part of an investigation and in accordance with applicable regulations.

6 - How will we protect the information about you?

Clarins takes appropriate technical and organizational measures, in relation to the nature of data and risks, to preserve the security and confidentiality of your personal information and, in particular, to prevent them from being altered, disclosed or transmitted to any unauthorized parties.

This may include practices such as limited access by members of staff who, by virtue of their duties, are authorized to access data, contractual guarantees in case of third-party provider, privacy impact assessments, internal reviews of our practices and privacy policies and/or implementation of physical and/or systematic security measures (secure access, authentication process, backup, antivirus, firewall, etc.).

7 – What is our policy on minors?

This website clarinsnewzealand.co.nz is not aimed at minors.

We do not knowingly collect nor process personal information from minors. Assuming we would have knowledge of the collection of personal information from minors without prior authorization from the holder of the parental responsibility, we will take appropriate measures to contact the person and, if necessary, to delete this personal data from our servers and/or those of our service providers.

8 – How is the contents you share on social networks using our hashtags managed?

You can choose to use our hashtags to tag your content on social networks such as Instagram, Facebook, Pinterest or Twitter.

By using these hashtags, you acknowledge and agree that your content may appear on our website and be used to refer to our products or services.

We remind you that the information you share on social networks can be consulted, used and saved by others around the world, in particular in countries without legislation guaranteeing an adequate level of protection of your personal information as defined in your country of residence.

We also draw your attention to the fact that when you submit content using one of our hashtags, your use of social networks is exclusively governed by the general conditions of these social networks. We invite you to read it and to refer to it regularly. If you no longer want your content to appear on our site, please remove it from the social network or stop using hashtags.

9 - For how long is your personal data kept?

We strive to keep your personal information only for the time necessary for the purposes set out in this privacy policy and in accordance with the provisions in force.

As a general rule:

- Customer / prospect data will be kept for three years from the date of collection or after the last contact or the end of the commercial relationship, unless it is opposed or requested to be deleted by you. At the end of this three-year period, we may make contact with you again in order to find out whether or not you wish to continue to receive marketing approaches. If no clear positive answer is given by you, your data will be deleted or archived in accordance with the provisions in force.

- Data relating to identity documents may be kept for one year in the event of exercise of your rights.

- Data on credit cards will be deleted after the transaction or archived for evidence purposes in accordance with the provisions in force. Subject to your express consent, banking data may be kept until the expiration date of the credit card. We never store your visual cryptogram.

- Data to prove a right or a contract, or kept under compliance with a legal obligation can be archived in accordance with the provisions in force.

- Recordings of telephone conversations may be kept for up to six months.

11 – What are your rights regarding your personal information and how do you contact us?

If you give us your email address, phone number or mailing address, you may receive emails, calls or periodic messages from us about our products, services or upcoming events. You can unsubscribe at any time from our mailing lists by contacting us at the address below,by following the link "unsubscribe" contained in each of our emails or by replying "STOP" to one of our SMS. You can also change your preferences at any time in your account. In accordance with the provisions in force, you have a right to access, rectification, erasure and data portability of your personal data as well as a right to object and restriction of processing. You can also withdraw your consent at any time. To exercise these rights, you must send us a request by justifying your identity:

-E-mailing a request to the Customer Service; customercare@nz.clarins.com

-By writing to the following address: Trimex Pty Ltd, Level 2/230 Clarence St, Sydney, NSW, 2000, Australia

You will be informed of the actions to be taken as soon as possible and in any case no later than one month after your request. However we reserve the right not to respond to unfounded or vexatious requests. In accordance with the provisions in force, you can also file a complaint with the competent authority responsible for data protection or lodge an appeal if your data are misused. Please contact our contact point for data protection in New Zealand or in France should you have any questions or comments in connection with this Privacy Policy:

Trimex Pty Ltd Level 2/230 Clarence St, Sydney, NSW, 2000 Australia

Clarins Direction Juridique / Délégué à la Protection des Données 12 avenue de la Porte des Ternes 75017 Paris France