AESOP PRIVACY POLICY

Updated version as of 01/05/2026

We place great importance on the principles of honesty and transparency and are committed to building a strong and lasting relationship with our consumers based on trust and mutual interest. Part of this commitment involves protecting and respecting your privacy and your choices. Respecting your privacy is essential to us. This is why you will find below "Our Commitment to Privacy" as well as our full Privacy Policy.

OUR COMMITMENT TO PRIVACY

1. We respect your privacy and your choices.
2. We make sure that privacy and security are embedded in everything we do.
3. We do not send you marketing communications unless you have asked us to. You can change your mind at any time.
4. We never offer or sell your data.
5. We are committed to keeping your data safe and secure. This includes only working with trusted partners.
6. We are committed to being open and transparent about how we use your data.
7. We do not use your data in ways that we have not told you about.
8. We respect your rights and always try to accommodate your requests as far as possible, in line with our legal and operational responsibilities.

To provide you with comprehensive information about how we handle data, we explain below what personal information we collect directly from you or through your interactions with us. We explain how we use and protect this information, with whom we share it, and what rights you have.

This Privacy Policy applies to all processing of personal data carried out by the Aesop brand in relation to customers in Switzerland. This includes data processing in the context of our business relationships in our boutiques (offline retail) and, in particular, on our websites and external online platforms, such as our social media profiles (hereinafter collectively referred to as “web services”).

When you share personal data with us or when we collect personal data about you, we use it in line with this Policy. Please read this information carefully.

Note regarding the applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy notice serves to provide information in accordance with both the Swiss Federal Act on Data Protection (Swiss FADP) and the General Data Protection Regulation (GDPR). For this reason, please note that, due to the GDPR’s broader geographical scope and greater clarity, the terms used in the Swiss FADP have been replaced by those of the GDPR. In particular, instead of the terms “processing” of “personal data”, “overriding interest” and “particularly sensitive personal data” used in the Swiss Data Protection Act, the terms “processing” of “personal data”, “legitimate interest” and “special categories of data” used in the GDPR are employed. However, the legal meaning of the terms continues to be determined in accordance with the Swiss FADP within the scope of its application.

If you have any questions or concerns about your personal data, please contact us at [email protected].

Please note that you must be at least 16 years old to use our website. To access additional online services, such as our boutique services, digital services, and registration for our loyalty programme or newsletter (online and offline), you must be 18 years old.

WHAT WILL YOU FIND IN THIS PRIVACY POLICY?

WHO WE ARE

WHAT IS PERSONAL DATA?

WHAT PERSONAL DATA DO WE COLLECT FROM YOU AND HOW DO WE USE IT?

CONSENTS TO DATA PROCESSING

PROFILING AND ADVERTISING TARGETING

WHO CAN ACCESS YOUR PERSONAL DATA?

WHERE DO WE STORE YOUR PERSONAL DATA?

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

IS THE SECURITY OF YOUR PERSONAL DATA ENSURED?

YOUR RIGHTS AND CHOICES

CONTACT

SPECIFIC LOCAL PROVISIONS

1. WHO WE ARE

L’Oréal France, a general partnership (société en nom collectif), with its registered office at 30 rue d’Alsace 92300 Levallois-Perret, registered with the Nanterre Trade and Companies Register under number 919 434 894 (hereinafter "L’Oréal France"), operates the website https://www.aesop.ch/ and may collect personal data about you when you consult or use its features.

L’Oréal Suisse SA, Chemin de Blandonnet 10, 1214 Vernier (GE), hereinafter "L’Oréal Suisse", operates Aesop stores in Switzerland and may collect personal data about you during your visit to a store.

In addition, L'Oréal France and L’Oréal Suisse work closely with L’Oréal Deutschland GmbH, Johannstr. 1, 40476 Düsseldorf, Germany (hereinafter “L’Oréal Deutschland”) regarding the use of your personal data for advertising purposes. L’Oréal France, L’Oréal Suisse and L’Oréal Deutschland have jointly determined the manner in which data is processed in this area. They are jointly responsible for the protection of your personal data in relation to the processing operations described below (Article 26 of the GDPR).

The terms "we," "us," or "our" used herein refer to L’Oréal France and L’Oréal Suisse jointly (except when processing activities specifically falling under only one of these entities are mentioned, in which case the term "we" refers to the concerned entity). Situations in which L’Oréal France or L’Oréal Suisse operates data processing alone as a sole data controller (hereinafter "L’Oréal France Processing" or "L’Oréal Suisse Processing"), as well as situations in which L’Oréal France and L’Oréal Suisse potentially together with L’Oréal Deutschland jointly operate data processing (hereinafter "Joint Processing") as joint controllers, are governed by this Personal Data Protection Policy.

• The list of L’Oréal France Processing is indicated below in the L’Oréal France Processing overview table available in Section 3 of this Privacy Policy.
• The list of L’Oréal Suisse Processing is indicated below in the L’Oréal Deutschland Processing overview table available in Section 3 of this Privacy Policy.
• The list of Joint Processing is indicated below in the Joint Processing overview table available in Section 3 of this Privacy Policy.

Both L’Oréal France, L’Oréal Suisse and L’Oréal Deutschland have appointed a Data Protection Officer whom you may consult on all matters relating to the processing of your personal data under the GDPR and local data protection regulations. The Data Protection Officers can be reached at the following contact details

• L’Oréal France: Email: [email protected] | By post: L’Oréal France | à l'attention du délégué à la protection des données | 30, rue d’Alsace | 92300 Levallois-Perret | France
• L’Oréal Suisse: E-Mail to [email protected] or by post to L’Oréal Suisse SA | Data Privacy | Chemin de Blandonnet 10 | 1214 Vernier (GE) | Suisse
• L’Oréal Deutschland: Email: [email protected] | By post: L’Oréal Deutschland GmbH | z. Hd. des Datenschutzbeauftragten | Johannstr. 1 | 40476 Düsseldorf | Germany

For more information on the distribution of responsibilities within the framework of joint processing and to obtain the main outlines of the contract between these entities, you can contact the Data Protection Officers.

2. WHAT IS PERSONAL DATA?

By “personal data”, we mean any information that can be used to identify you either directly (e.g. via your name) or indirectly (e.g. via pseudonymised data such as a unique identification number). This means that personal data includes information such as postal and email addresses, mobile phone numbers, usernames, profile pictures, personal preferences and shopping habits, user-generated content, financial data, and information relating to beauty and well-being. Personal data may also include unique digital identifiers, such as your computer’s IP address or your mobile device’s MAC address.

3. WHAT PERSONAL DATA DO WE COLLECT FROM YOU AND HOW DO WE USE IT?

We believe that as a consumer, you are at the heart of everything we do. We love receiving information from you, getting to know you, and creating and providing products and services you enjoy. And we know many of you love communicating with us. For all these reasons, there are many ways you can provide your personal data to us, and how we can collect it.

3.1 HOW DO WE COLLECT OR RECEIVE YOUR PERSONAL DATA?

L’Oréal France and/or L’Oréal Suisse may collect personal data from you, or receive it from you, particularly when you make purchases, when you visit an AESOP store or the website https://www.aesop.ch/, or via questionnaires, applications, devices, product or brand pages on social networks, or by any other means. In some cases, you provide personal data directly to us (e.g., when creating an account, contacting us, or making a purchase on our website/apps or in-store/beauty salon). In other cases, we collect this data (e.g., using cookies to understand how you use our website/apps) or the data is sent to us by third parties.

When we collect data, we indicate mandatory fields with an asterisk. Failure to fill in the fields marked with an asterisk may impact our ability to offer you products and services.

You will find in the tables below more detailed information providing explanations on:

1. In what situations may your personal data be provided or collected?

This column lists the activities you engage in, or the situations you are in, when we use or collect your personal data. For example, if you are making a purchase, signing up for a newsletter, or browsing a website/apps.

2. What personal data can we obtain directly from you or following your interaction with us?

This column specifies which types of data concerning you we are likely to collect, depending on the situation.

3. How and why can we use it?

This column details how we may use your data and the purposes for which it is collected.

4. What is the legal basis for our use of your personal data? (Consent, Legitimate Interest, Contract Performance, Legal Obligation).

This column explains the reason why we may use your data. Depending on the purpose for which the data is used, the legal basis on which the processing of your data relies may be:

• Consent (Article 6(1)(a) GDPR): You have given your consent to the processing of your personal data for a specific purpose or for several specific purposes.
• Legitimate Interest (Article 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. For example
• Improving our products and services, and more specifically our commercial interests, to help us better understand your needs and expectations and thus improve our services, websites / applications / devices, products, and brands in the interest of our customers.
• Fraud prevention, to ensure that payments are completed and have not been subject to any fraud or misappropriation.
• Securing our tools, to ensure the protection and security of the tools you use (our websites/applications/devices) and to ensure they function properly and are constantly improved.
• Performance of a contract, and more specifically the provision of the services you request from us.
• Performance of a Contract (Article 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject’s request prior to entering into a contract
• Legal Obligations (Article 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. due to commercial or tax law requirements).

3.1.1 Overview of L’Oréal France Processing (as sole controller)

In which situations may your personal data be provided or collected?	What personal data may L’Oréal France obtain directly from you or following your interaction with L’Oréal France?	How and why may L’Oréal France use your personal data?	On which legal basis is the processing of your personal data carried out?
Online purchasing and order management Data collected during the purchase process on L’Oréal France’s website, mobile applications, and social media pages.	Depending on the frequency of your interactions with L’Oréal France, such personal data may include: First and last name; Email address; Postal address (delivery and billing); Phone number; Personal presentation or preferences; Social media profile (if you use social networks to log in or if you communicate such personal data to us); Information relating to any transaction, including purchased products; Payment-related information or purchase history.	L’Oréal France uses such data in order to: Contact you to finalise your order if you have saved your shopping cart or added products to your cart without completing the payment; Inform you of the availability of a product you wish to purchase; Process and monitor your order, including delivery of the product to the address you have provided; Manage payment for your order. It is specified that payment-related information (credit card number / PayPal details / bank details) is not collected by L’Oréal France, but directly by payment service providers; Manage any contact you may have with L’Oréal France regarding your order;	Performance of a contract To provide you with the service you have requested (purchase).
		Protect transactions against fraud (including through profiling techniques). L’Oréal France uses a solution provided by a third-party service provider to detect fraud and ensure that payment is carried out by you or by any person duly authorised by you; Enrich your profile if you make a purchase using your account details; Send you satisfaction surveys following interactions with us (e.g. after a purchase or contact with customer service); Assess consumer satisfaction; Manage any dispute relating to an online purchase; Produce statistics;	Legitimate interest To ensure your protection and our protection against fraudulent transactions, to ensure that payments are duly carried out and not subject to fraud or misappropriation, and to help us better understand your needs and expectations in order to improve our services, products and brands.
		Send you commercial advertising communications while you browse third-party websites; Enrich your profile in order to personalise such communications based on your interests – for further details, please refer to the profiling section following this table.	Consent To send you commercial prospecting messages tailored to your interests.
Use of applications and devices Data collected in connection with your use of L’Oréal France applications and/or devices within our Webservices.	Depending on the frequency of your interactions with L’Oréal France, such personal data may include: First and last name; Email address; Phone number; Location; Date of birth; Personal presentation or preferences; Geolocation data.	L’Oréal France uses such data in order to: Provide you with the requested service (e.g. virtual try-on of our products, purchase of products via the application or on associated e-commerce websites, advice and notifications relating to your sun exposure or your hair-care routine); Analyse your beauty/well-being characteristics and recommend appropriate routines and products (including customised care); Provide you with recommendations relating to products and routines;	Performance of a contract To provide you with the requested service (including, where necessary, the performance of an analysis by the research and innovation team of the algorithm required to deliver the service).
		Promote research and innovation carried out by L’Oréal Group researchers; Monitor and improve our applications and devices; Produce statistics;	Legitimate interest To continuously improve L’Oréal France products and services in order to meet your needs and expectations and to advance research and innovation.
		Send you commercial communications through advertising displays while you browse third-party websites; Enrich your profile in order to personalise such communications based on your interests – for further details, please refer to the profiling section following this table.	Consent To send you commercial prospecting messages tailored to your interests.

3.1.2 Overview of L’Oréal Suisse processing (as sole controller)

In which situations may your personal data be provided or collected?	What personal data may L’OREAL COUNTRY obtain directly from you or following your interaction with L’OREAL COUNTRY?	How and why does L’OREAL COUNTRY use such data?	On which legal basis is the processing of your personal data carried out?
Purchases in AESOP stores Data collected during the purchase process carried out in an AESOP store.	Depending on the frequency of your interactions with us, such personal data may include: Identification data / Civil status; Title; First and last name; Phone number; Email address; Date of birth; Postal address. Other categories of data relating to the transaction: Products purchased; Purchase history; Payment data.	L’Oréal Suisse uses such data in order to: Provision of contractual services and customer services; Security measures; Management and response to inquiries; Fulfillment of legal documentation and retention obligations.	Performance of a contract To provide you with the products and services you have requested (purchase). Legal Obligation To store transactional information.
Existing Customer Marketing	First and last name; Title; Phone number; Email address; Date of birth; Postal address; Personal presentation or preferences; Information relating to any transaction, including purchased products.	L'Oréal Suisse processes this data for the following purposes: To send information about products/services similar to those already purchased; To request customer feedback and ensure satisfaction; To invite to events AESOP in Switzerland; To optimize our services through direct marketing.	Legitimate Interest Our legitimate interests lie in the enhancement and optimization of our services, the sending of direct advertising, and ensuring customer satisfaction.
CCTV Data collected during your visit to one of the AESOP stores.	Video recordings	Ensuring the safety and security of people and property Intrusion detection and prevention Processing of data resulting from alert and/or alarm triggers (photo, video)	Legitimate interest To ensure protection against burglary, theft, vandalism and assaults.

3.1.3 Overview of Joint Processing Activities

In which situations may your personal data be provided or collected?	What personal data may we obtain directly from you or following your interaction with us?	How and why may we use your personal data?	On which legal basis is the processing of your personal data carried out?
Creation and management of an account Personal data collected when creating an account and/or joining a loyalty programme on our websites or apps, or in our Aesop boutiques.	Depending on the frequency of your interactions with us, such personal data may include: First and last name; Title; Email address; Postal address; Telephone number; Photograph; Date of birth or age range; Identifier, username and password; Personal presentation or preferences; Information relating to orders;	We use such data in order to: Create your user account and enable you to manage your personal settings. Providing and managing a loyalty programme; Storing information about your online orders.	Contract To provide the service you have requested (e.g. creating an account, taking part in a survey or purchasing a product).
		Provide personalised services based on your beauty profile; Carry out target group analyses; Ensure the accuracy and consistency of the information collected by L'Oréal Suisse in its boutiques with the data collected online by L'Oréal France; Assess customer satisfaction; Manage any disputes.	Legitimate interest To better understand your needs and expectations, and consequently to improve our services, products and brands, as well as to enable a cross-channel view of the customer relationship.
		Send you commercial communications by direct means (email, SMS); Enrich your profile in order to personalise such communications based on your interests. For further details, please refer to the profiling section following this table.	Consent To send you commercial prospecting messages tailored to your interests.
Online browsing Data collected through cookies or similar technologies like tags (“Cookies”) when you browse L’Oréal France websites/applications or third-party websites/applications. For any information relating to specific Cookies placed through a given website/application, please refer to the Cookies table available on the relevant website/application.	Depending on the frequency of your interactions with us, such personal data may include: Data relating to your use of our websites/applications; Last website visited; Connection data; Pages viewed; Videos viewed; Advertisements you clicked on; Products searched for; Your location; Duration of your visit; Products selected to build your shopping cart. Technical information : IP Address; Browser-related data; Device-related data (unique identifier assigned to each visitor and expiry date of such identifier)	We use Cookies, where applicable, in combination with other personal data you have already provided to us (e.g. previous purchases or subscription to online newsletters), for the following purposes: Ensure the proper functioning of our websites/applications, including: Appropriate display of content; Creation and storage of a shopping cart; Creation and storage of login data; Interface personalisation (such as language); Device settings (including screen resolution, etc.); Improve L’Oréal France websites/applications, for example by testing new ideas. Ensure the protection and security of websites/applications and protect you against fraud or fraudulent use, including by performing login operations. Carry out statistical analyses in order to: Avoid double-counting visitors; Understand users’ reactions to advertising campaigns; Improve L’Oréal France offers; Understand how you discovered L’Oréal France websites/applications. Deliver online behavioural advertising : To identify you when you browse one of our websites and display advertising on third-party websites for products and services of L’Oréal Group brands; To enrich your profile and personalise advertising based on your interests inferred from your browsing activity (pages viewed, abandoned shopping carts, etc.) (For further details, please refer to the profiling section following this table). Adapt services to you, including: Sending you recommendations, commercial communications or content tailored to your profile and centres of interest; Offering personalised websites/applications (e.g. remembering your shopping cart, login details, language preferences, interface customization Cookies, device settings, font preferences, etc.). Enable the sharing of L’Oréal France content on social networks (sharing buttons increasing website visibility).	Legitimate interest To ensure that websites/applications, advertising and communications function properly, and to continuously improve cookies that are (i) essential for the operation of our website; and (ii) used to ensure the protection and security of our website. Consent For all other Cookies.
User-generated content Data collected when you post content on one of our social media platforms or when you agree that we reuse content that you have published on social networks.	Depending on the frequency of your interactions with us, such personal data may include: First and last name or alias; Email address; Photograph; Personal presentation or preferences; Social media profile (if you use social networks to log in or if you communicate such personal data to us); Any other information you have provided to us concerning you (for example, via your “My Account” page, by contacting us, or by providing your own content such as photographs or comments, including through the “conversation/chat” feature available on certain websites/applications).	In accordance with the specific terms and conditions you have accepted: Publish your comments or content online; Ensure the promotion of our products.	Consent To reuse content that you have published online.
Promotional activities Data collected when you take part in a game, a competition, a promotional offer, request a sample, or participate in a survey.	Depending on the type of interaction with us, such personal data may include: First and last name; Email address; Phone number; Date of birth; Gender; Title; Postal address; Personal presentation or preferences; Any other information that you have communicated to us concerning you (for example, via your “My Account” page, by contacting us, by providing your own content such as photographs or comments, or by participating in a competition, a game or a survey).	We use such data in order to: Carry out the tasks you have requested us to perform, for example managing your participation in competitions, games and surveys, including taking into account your feedback and suggestions; Carry out audience analyses.	Consent To provide you with the service you have requested if combined with the subscription to commercial communication. Performance of a contract To provide you with the service you have requested. Legitimate interest To help us better understand and anticipate your needs and expectations and, as a result, improve our services, products and brands.
Requests for information Data collected when you submit questions (e.g. via customer service) regarding our brands or products and their use.	Depending on the type of your interaction with us, such personal data may include: Identification data / Civil status First and last name; Title; Phone number; Email address; Date of birth; Postal address. Other categories of data relating to the transaction: Other information that you have provided to us about yourself in connection with your request (which may include, for example, information relating to your well-being and health),	We use such data in order to: Respond to your requests; Refer you to the appropriate service where necessary. For statistical purposes For cosmetovigilance* purposes in order to: Monitor and prevent any undesirable effects linked to the use of our products; Collect reports of undesirable effects; Implement and ensure the follow-up of corrective actions, where necessary; * Cosmetovigilance is the ongoing and systematic monitoring of the safety of cosmetic products with regard to human health.	Performance of a Contract To process your request related to your purchase. Legitimate Interest To work on your request and answer your questions and help us better understand the needs and expectations of our customers and, consequently, to improve our services, products, and brands. Legal obligation To comply with the legal obligation to monitor undesirable effects of its products
Subscription to newsletters and commercial communications	Depending on the frequency of your interactions with us, such personal data may include: First and last name; Email address; Postal address (delivery and billing); Phone number; Personal presentation or preferences; Social media profile (if you use social networks to log in or if you communicate such personal data to us). Information relating to any transaction, including purchased products; Payment-related information or purchase history.	We use this data for the following purposes: Sending you promotional messages tailored to your profile via direct channels (email, text message); Enriching your profile to personalise these messages based on your interests; Online marketing. Further details can be found in the section on profiling following this table. We use such data in order to: Send you satisfaction surveys following interactions with us (e.g. after a purchase or contact with customer service); Produce statistics; Carry out target group analyses.	Consent to receive marketing communications tailored to your personal interests. Legitimate interest to tailor our marketing communications and assess their effectiveness, ensuring that you benefit from an experience that is perfectly tailored to you. This also helps us to better understand and anticipate your needs and expectations, thereby enabling us to improve our services, products and brands.
Rewards Program	Depending on the type of interaction with us, such personal data may include: First and last name; Title Gender Email address; Postal address; Phone number; Photograph; Date of birth or age range; Identifier, username and password; Presentation or personal preferences; Name of the Aesop store at the origin of the data onboarding; Total cumulative amount of purchases; Average basket.	Manage the Rewards Program Send personalised offers and rewards relating to our products by email, based on your purchase history; For other commercial communications please, refer to Subscription to newsletters and commercial communications section above For further details, please refer to the profiling section following this table.	Contract To manage your program membership.

3.1.4 CONSENTS TO DATA PROCESSING

Consent to receive marketing communications

Where the sending of marketing communications is based on your consent in accordance with Article 6(1)(a) of the GDPR, this consent is as follows:

• [ ] Email and personalised adverts on partner websites and social media
• [ ] Mobile via SMS/other direct digital messaging platforms
• I would like to receive personalised offers for Aesop products and services, as well as adverts from L’Oréal brands tailored to my interests on partner websites and social media.
• The data you provide to us will be used to complete your interest profile and to send you personalised offers via the channels mentioned above.
• You can unsubscribe at any time via the link in any of our communications and manage your settings. You can find out more about your right to withdraw consent here.
• Further information on how we use your personal data and how we use personal data on social platforms can be found in our Privacy Policy.
• Aesop is part of the L'Oréal Group; the processing of customer data in Switzerland is carried out jointly by L'Oréal France, L’Oréal Suisse SA and L’Oréal Deutschland GmbH (together “L’Oréal”).

The registration process is logged on the basis of our legitimate interests within the meaning of Article 6(1)(f) of the GDPR for the purpose of providing evidence that the registration process was carried out correctly. This includes storing the time of registration and confirmation, as well as the IP address. Any changes to your data stored with the email service provider are also logged. Where we engage a service provider to send emails, this is based on our legitimate interests in an efficient and secure email delivery system.

Right to withdraw consent (opt-out): You may stop receiving our promotional communications at any time, i.e. withdraw your consent. You may withdraw your consent at any time with future effect by contacting L'Oréal Suisse SA via the relevant “unsubscribe link” in every email you receive, by email to [email protected] or by post to L’Oréal Suisse SA, Aesop, Chemin de Blandonnet 10, 1214 Vernier (GE), Suisse.

If you withdraw your consent, your data will be deleted from our direct marketing database; where deletion is not possible, processing will be restricted instead. We will then no longer be able to send you our newsletter, and when you visit our advertising partners’ websites, you may see adverts that are less relevant to your interests. You may object separately to the creation of a profile containing details of your brand and product interests and/or the display of information tailored to your interests within our advertising partners’ web services using the contact details provided above, without having to forego our information via email in future.

Double opt-in procedure: Where registration for our promotional communications is based on consent, this is generally carried out via a so-called double opt-in procedure. This means that, after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary to ensure that no one can register using someone else’s email address. You must confirm your subscription promptly after receiving the confirmation email; otherwise, your data will be automatically deleted from our direct marketing database after 21 days.

You can unsubscribe at any time via the link in any of our communications and manage your settings.

Consent for cookies

Where consent is required for the use of cookies and similar technologies, we employ a cookie consent management procedure through which users’ consent to the use of cookies, or to the processing activities and providers specified within the cookie consent management procedure, is obtained and can be managed and withdrawn by users. In this context, the declaration of consent is stored so that the request does not need to be repeated and so that consent can be demonstrated in accordance with the legal obligation. Storage may take place on the server and/or in a cookie (a so-called opt-in cookie, or using comparable technologies) in order to be able to associate the consent with a user or their device. Further information on the specific types of cookies we use can be found in our Cookie Settings

Users may withdraw their consent to cookies at any time. To do so, users may, amongst other things, restrict the use of cookies in their browser settings (although this may also limit the functionality of our web services). You will also find a link in the footer of our website that allows you to change your cookie settings.

3.2 AUTOMATED INDIVIDUAL DECISION-MAKING FOR SECURING TRANSACTIONS

To secure transactions on L’Oréal France’s web services and protect them from fraud and misuse, L’Oréal France uses solutions developed by third-party providers. In particular, our partner Forter Solutions UK Ltd (30 Old Bailey, London EC4M 7AU, England) may process your identification data and your online browsing data to assist us in preventing online fraud – specifically to combat the resale of our products via unauthorised distribution networks. For further information on how Forter uses and processes your personal data, please refer to their privacy policy: https://www.forter.com/privacy-policy/.

These fraud detection solutions are based in particular on profiling and the following methods: simple comparisons, association rules, clustering, predictive models and outlier detection using intelligent agents, data fusion techniques and various data mining methods.

This fraud detection process may be fully automated or involve human intervention, with the final decision being made by a person. In any case, L’Oréal France takes all reasonable precautions and security measures to restrict access to your personal data.

Due to automated fraud detection, it may happen that: (i) the processing of your order or enquiry is delayed whilst L’Oréal France reviews your transaction; and (ii) you are excluded from receiving a service or your access to the service is restricted if a risk of fraud is detected. You have the right to be informed of the information on which L’Oréal France’s decision is based. Further details on this can be found in the section ‘Your rights and choices’ below.

3.3 PROFILING AND ADVERTISING TARGETING

When L’Oréal France sends or displays personalized communications or content, certain techniques qualified as "profiling" may be used (defined as any form of automated processing of personal data consisting of using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict elements concerning personal preferences, interests, financial situation, behavior, location, health, reliability, or movements of that natural person).

In order to carry out such profiling, L’Oréal France (where applicable, jointly with L’Oréal Suisse and L’Oréal Deutschland) uses personal data about you that has been collected in the various scenarios mentioned above (see the list of processing activities carried out by L’Oréal France and the list of joint processing activities – e.g. when you create an account online, purchase one of our products, subscribe to our newsletter, visit the website, etc.). As indicated in the first table above, L’Oréal France also uses personal data about you that has been transferred by its business partners, provided that you have given your consent to such a transfer.

L’Oréal France (together with L’Oréal Suisse and L’Oréal Deutschland where applicable) then centralises this data – following any necessary pseudonymisation (i.e. the replacement of your name or contact details with a unique identifier) – and analyses it to assess and predict your personal preferences and/or interests. On this basis, we identify products and services that you are likely to enjoy.

Based on this analysis, L’Oréal France, L’Oréal Suisse and/or L’Oréal Deutschland will send you communications and/or display content on third-party websites (i.e. on the websites and other communication services of our business partners and/or on social media platforms and/or on search engines with which we have contracts) content tailored to your preferences and interests in relation to any of the brands operated by L’Oréal France (including brands of which you are not yet a customer). L’Oréal France may also use your data to identify, within its own database or those of its partners, social networks or search engines, individuals with the same socio-demographic characteristics and/or preferences as you, who are therefore likely to be interested in the same advertising content as you.

As indicated in the lists above, L’Oréal France acts as the sole data controller for the profiling carried out for the purpose of displaying personalised advertising during your visit to third-party websites. Conversely, L’Oréal France and L’Oréal Suisse act as joint data controllers for the profiling carried out for the purpose of sending personalised communications via email/SMS.

Please note: In order to display personalised advertising on third-party websites, L’Oréal France must transmit your identification and/or contact details – namely your surname, first name and email address, telephone number or postal address – to the operators of these websites. This enables the operators in question (further information on the operators concerned can be found in the following section on the recipients of your data) to identify you among their customers/users and to display advertising for our products and services to you (as well as to people with a similar profile/interests to yours). These organisations also provide L’Oréal France with reports on the results of advertising campaigns (number of clicks, conversion rate, target audience profile, etc.) so that L’Oréal France can optimise its future campaigns. In the context of these activities, L’Oréal France acts as a joint controller with the relevant organisation. Such profiling and the exchange of data for advertising purposes will only take place with your prior consent.

3.4 WHO CAN ACCESS YOUR PERSONAL DATA?

We may share your personal data within the L’Oréal Group, to comply with our legal obligations, prevent fraud and/or secure our tools, improve our products and services, or after obtaining your consent.

Depending on the purposes for which your data was collected, and only if necessary, some of your personal data may be accessible to L’Oréal Group entities worldwide, if it is pseudonymized (not allowing direct identification) and if necessary to provide you with the requested services.

L’Oréal France may also share your personal data in pseudonymized form (not allowing direct identification) with scientists in the L’Oréal France Research & Innovation division, including those located outside your country, for research and innovation purposes.

If permitted, for L’Oréal France Processing, we may also share some of your personal data, including that collected through Cookies, between our brands to harmonize and update the information you provide us, enrich our customer knowledge, perform statistics based on your characteristics, and tailor our communications and the targeted advertising we may display on third-party sites.

For more information, we invite you to consult the websites of the L’Oréal Group.

We may communicate your personal data for commercial prospecting purposes (including advertising targeting) to third parties.

In doing so, we only provide these third parties with the information they need to provide the relevant service, and require them not to use your personal data for any other purpose. We always do our utmost to ensure that all third parties with whom we work maintain the confidentiality and security of your data.

If you have consented to receiving direct marketing (email, SMS) from one of our partners via a specific registration or opt-in process, your data will be transferred to the partner in question. This partner processes the data as an independent data controller in accordance with its own terms and conditions and its own privacy policy. We recommend that you carefully review their information before consenting to the transfer of your data to these third parties.

We may also transfer your personal data to our partners and/or search engines and/or social networks of which you are a member and with whom we have entered into agreements for the purposes of targeted advertising.

As already explained in the section on profiling, it is likely that we will pass on the personal data you provide (surname, first name, contact details – in particular email address, telephone number, postal address) to the following organisations. This is done so that they can identify you among their customers/users and display targeted advertising for our products and services on their websites (including other communication services) to you and to people with a similar profile.

These are:

• Amazon EU S.à r.l., 38 avenue John F. Kennedy, 1855 Luxemburg, Luxemburg (Amazon Audience Match); Privacy Policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Google Customer Match); Privacy Policy: https://support.google.com/googleads/answer/6379332?hl=de.
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, DO4 X2K5, Ireland (Custom Audiences auf Meta-Plattformen); Privacy Policy: https://www.facebook.com/ads/about und https://www.facebook.com/legal/terms/customaudience

Please note that some of these partners (namely Meta – further information on the data collected by Meta can be found in the following section – and Google) may also collect data directly from you during your visit to our web services, provided you consent (in particular via cookies and similar technologies).

In this context, the aforementioned companies and we act as joint controllers. Upon request to the contact address provided at the end of this privacy policy, we will be happy to provide you with the key provisions of the data processing agreements concluded with these organisations.

Your personal data may also be processed on our behalf (L’Oréal France and L’Oréal Suisse) by trusted service providers.

We use trusted third parties to perform a range of business operations and tasks on our behalf. We only provide them with the information they need to perform the service and request that they do not use your personal data for other purposes. We always make every effort to ensure that all these third parties we work with maintain the confidentiality and security of your data. We may, for example, ask to provide services that require processing your personal data to:

• Third parties who assist and help us provide digital and e-commerce services, such as social listening, store location, loyalty programs, identity management, rating and review management, customer relationship management (CRM), web analytics, and search engines, user-generated content creation tools;
• Advertising agencies, marketing agencies, social and digital agencies to help us carry out advertising, marketing, and commercial campaigns, analyze their effectiveness, and manage your contacts and questions;
• Third parties we need to provide and deliver a product to you and invoice you, for example, for postal/delivery or billing services;
• Third parties who assist and help us provide IT services, such as platform providers, hosting services, maintenance, and technical support services for our databases as well as for our software and applications that may contain data about you (these services may sometimes require access to your data to perform the requested tasks);
• Payment service providers and credit reporting agencies for the purpose of assessing your creditworthiness and verifying your information when required to enter into a contract with you;
• Third parties who help us with customer service and cosmetovigilance.

We may also communicate your personal data to third parties:

• If we sell a business or assets, in which case we may communicate your personal data to the potential buyer of that business or those assets. If L’Oréal France or L’Oréal Suisse in the context of joint processing, or any part of their assets are acquired by a third party, personal data held about their customers and related to those assets may be one of the transferred assets. If applicable, in the latter case, the buyer acting as the new data controller processes your data and its personal data protection policy governs the processing of your personal data.
• If we are forced to disclose or share your personal data to comply with a legal obligation, or to enforce or apply our terms of use/sale or any other conditions you have accepted; or to protect the rights, property, or safety of L’Oréal France or L’Oréal Suisse, their customers or employees.
• If we have your consent.
• Or if the law allows us to.

L’Oréal France may communicate your personal data to its partners (applicable only for L’Oréal France Processing):

• If the service you join was created by L’Oréal France in collaboration with a partner (e.g., a co-branded application). In this case, L’Oréal France and the concerned partner each process your personal data to fulfill their own purposes. Thus, your data is processed:
• by L’Oréal France in accordance with this Personal Data Protection Policy;
• by the partner also acting as a data controller according to its own terms and conditions and in accordance with its own personal data protection policy.
• L’Oréal France may publish content from social networks on its media. If you consult content from social networks on the L’Oréal France website/apps, a Cookie from the concerned social network may be placed on your device. For any additional information, L’Oréal France invites you to read the cookie policy of these social networks.

We do not offer or sell your personal data.

3.5 WHERE DO WE STORE YOUR PERSONAL DATA?

The data we collect from you may be transferred to, accessed from, and stored in a country located outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our service providers. We transfer personal data outside the EEA only in a secure manner and in compliance with applicable legislation.

Since some countries may not have laws governing the use and transfer of personal data, we undertake to take all necessary measures to ensure that the third parties concerned comply with the conditions set out in this Policy. These measures may include checking the standards applied by these third parties in terms of personal data protection and security and/or signing appropriate contracts (based on the model adopted by the European Commission, available here). For any further information, please contact us according to the instructions in the "Contact" section below.

3.6 HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We keep your personal data only as long as necessary to achieve the purpose for which we hold this data, to meet your needs, or to fulfill our legal obligations. To determine the retention period of your data, we apply the following criteria:

• If you buy products and services, we keep your personal data for the duration of our contractual relationship;
• If you join a rewards program, we keep your personal data for the duration of your participation in the program;
• If you participate in a competition, we keep your personal data for 12 months from the end of the competition concerned;
• If you wish to be informed of the availability of a product, we keep your personal data for 3 months from the notification sent to you for this purpose;
• If you create a beauty profile (for example, to receive information on a suitable skincare routine), we keep your personal data for 3 months from the sending of this information;
• If you participate in a promotional offer, we keep your personal data for the duration of the promotional offer concerned;
• If you contact us regarding a question or complaint, we keep your personal data for the duration necessary to process your request;
• If you create an account, we keep your personal data until you ask us to delete it or after a period of inactivity (no active interaction with brands) defined in accordance with local regulations and currently up to 2 years of inactivity;
• If you have consented to receive commercial prospecting messages and to benefit from advertisements adapted to your interests during your browsing on third-party sites, we keep your personal data until you unsubscribe and/or withdraw your consent or until you ask us to delete it or after a period of inactivity (no active interaction with brands) of 2 years;
• If Cookies are placed on your computer, we keep your data only as long as necessary to achieve their purpose (e.g., for the duration of a session for cookies linked to the shopping cart or session identification cookies) and for any period defined in accordance with local regulations and instructions.
• When visiting an Aesop boutique: We retain CCTV footage for a period of 72 hours from the end of the day on which you visited our boutique.
• To comply with legal obligations: We may retain certain data in order to comply with our legal or regulatory obligations, to exercise our rights (e.g. to bring claims before a court) or for statistical or historical purposes.
• For purchases (statutory retention period): We retain your personal data (in particular invoices, contracts and payment details) for a period of up to 10 years after the purchase has been completed in order to comply with our statutory retention obligations under applicable local laws (e.g. the German Commercial Code/Tax Code).

Maximum Period: If there are multiple different retention or erasure periods for the same data, the longest period shall always prevail.

Commencement of Period: Unless a period of at least one year expressly begins on a specific date, it shall start automatically at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships, this is the point in time at which the termination becomes effective or the legal relationship otherwise ends

Purpose Limitation during Retention: Data that we no longer keep for the originally intended purpose, but rather due to legal requirements (e.g., tax law), will be processed exclusively for those legally justified reasons and blocked for other processing.

When we no longer need to use your personal data, we delete it from our systems and files or anonymize it so that it no longer identifies you.

3.7 IS THE SECURITY OF YOUR PERSONAL DATA ENSURED?

We place great importance on the protection of your personal data and take all reasonable precautions for this purpose. We require trusted third parties who manage your personal data on our behalf to do the same via contract. We constantly do our best to protect your personal data.

Upon receipt of your data, we apply strict procedures and security measures to try to prevent unauthorized access. As data transmission over the Internet is not completely secure, we cannot guarantee the security of your data transmitted to our site. Therefore, any transmission is at your own risk.

3.8 LINKS TO THIRD-PARTY SITES AND SOCIAL MEDIA LOGIN

L’Oréal France websites and applications may occasionally contain links to websites belonging to our networks, advertisers, and partner affiliates. If you follow a link to any of these websites, please note that these sites have their own personal data protection policies and that L’Oréal France is not responsible for these policies. L’Oréal France invites you to review these policies before sending any personal data to these websites.

L’Oréal France may also offer you the possibility of logging in using your social media accounts. If you decide to do so, L’Oréal France draws your attention to the fact that you provide us with your profile information based on the settings of the social networks you use. L’Oréal France invites you to visit the concerned social network and consult its personal data protection policy to understand how your data is shared and used in this context.

Information Meta collects and shares with L’Oréal France:

All Facebook features and services available on L’Oréal France websites/applications are governed by Facebook's Privacy Policy, where you can find more information about your rights and setting options.

By using one of L’Oréal France's websites/applications, you can:

• Register with your Facebook account. In this case, you consent to share certain information from your public profile with L’Oréal France;
• Use Facebook social plug-ins, such as "like" or "share" our content on the Facebook platform;
• Accept cookies from this website/application (also known as "Facebook pixel"), which help us understand your activities, including information from your device, how you use L’Oréal France services, purchases you make, and advertisements you watch, whether or not you have a Facebook account or are logged in to Facebook.

When you use these Facebook features, L’Oréal France collects data that helps us:

• Display advertisements that might interest you on Facebook (or Instagram, Messenger, or any other Facebook service);
• Measure and analyze the effectiveness of L’Oréal France websites/applications and its advertisements.

3.9 SOCIAL NETWORKS AND USER-GENERATED CONTENT

Some of L’Oréal France's websites and applications allow users to upload their own content. L’Oréal France reminds you that any content transmitted to one of the social networks it uses may be accessible to the public. Thus, L’Oréal France invites you to be cautious regarding the communication of certain personal data such as financial data or an address. L’Oréal France declines all responsibility regarding any measures taken by third parties in the event that you post personal data on one of its social networks and recommends that you do not share this information.

4. YOUR RIGHTS AND CHOICES We respect your right to privacy

It is important that you have control over your personal data. You have the following rights:

Your rights	What it means
Right to be informed	In accordance with Articles 12–14 of the GDPR, you have the right to receive accurate, transparent, understandable and easily accessible information about how we process your personal data and what rights you have in relation to your personal data. That is why we are providing you with this privacy notice.
Right of access	In accordance with Article 15 of the GDPR, you have the right to request, in writing, confirmation from us as to whether we are processing your personal data and, if so, to receive the further information set out in Article 15 of the GDPR regarding the processing of that data, as well as a copy of your personal data (subject to certain restrictions).
Right to rectification	In accordance with Article 16 of the GDPR, you have the right to request that your data be rectified if it is no longer accurate. If your data is incomplete, you may request that it be completed.
Right to erasure / Right to be forgotten	In accordance with Article 17 of the GDPR, you have the right to request that we erase your personal data and, if the personal data has been made public, to request that we inform other controllers of your request for erasure. Please note that this is not an absolute right, as there may be legal or legitimate grounds for retaining your personal data.
Right to restriction of processing	In accordance with Article 18 of the GDPR, you have the right to request that we restrict the processing of your personal data.
Right to data portability	You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal provisions of Article 20 of the GDPR (‘data portability’), or to request that it be transferred to another controller.
Right to object to processing, including direct marketing and profiling	You have the right to object, at any time, to the processing of your personal data carried out on the basis of Article 6(1)(e) or (f) of the GDPR, on grounds relating to your particular situation, in accordance with Article 21(1) of the GDPR. In this case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. Furthermore, processing may continue if it serves to establish, exercise or defend legal claims (Article 21(1) of the GDPR). Furthermore, pursuant to Article 21(2) of the GDPR, you have the right to object at any time to the processing of your personal data for the purposes of direct marketing; this also applies to any profiling insofar as it is related to such direct marketing. We draw your attention to the right to object in this privacy policy in connection with the respective processing.
Right to withdraw consent	Where you have given your consent to the processing of your data, you have the right to withdraw this consent at any time in accordance with Article 7(3) of the GDPR. The lawfulness of the processing carried out prior to the withdrawal remains unaffected. You can easily withdraw your consent to receive marketing emails, for example, by clicking the “Unsubscribe” link in an email or message from us; otherwise, please use the CONTACT details below. Please refer to our comments above regarding the individual processing activities to determine the cases in which our processing is based on your consent.
Right to activate/deactivate Cookies	You can adjust your browser settings at any time to restrict or block cookies. Many cookies are designed to enhance the user-friendliness and/or functionality of websites and apps, so you may no longer be able to use these websites and apps if you disable cookies, as explained in the Cookie Policy. Furthermore, our web services do not store any cookies that do not serve purely technical purposes and are necessary for the proper functioning of our web services unless you have previously accepted them. To do this, you must consent to the storage of cookies by clicking ‘Accept’ on the banner containing the notice regarding the storage of cookies. Further information on the specific types of cookies we use and how you can disable, consent to or object to the use of individual types of cookies can be found in our Cookie Settings. If you wish to restrict or block all cookies set by our websites/apps (which may prevent you from using certain parts of the sites), you can also do so via your browser settings; your browser’s help function should provide instructions. Further information can be found at the following link: http://www.aboutcookies.org/

You may exercise your rights by contacting us via the “CONTACT” section or by contacting the data protection officers we have appointed. Please note that we may need to request proof of identity (e.g. a copy of your ID card, with any unnecessary information redacted) and, where necessary, further details in order to verify your identity beyond doubt and process your request in a legally compliant manner.

Complaint to a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you habitually reside, the supervisory authority for your place of work or the location of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

The data protection supervisory authority responsible for L’Oréal Suisse is: Federal Data Protection and information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Suisse, https://www.edoeb.admin.ch

The data protection supervisory authority responsible for L’Oréal France is: Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, France, https://www.cnil.fr/

The data protection supervisory authority responsible for L'Oréal Deutschland is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), PO Box 20 04 44, 40102 Düsseldorf, Germany, https://www.ldi.nrw.de/

5. CONTACT

If you have questions or remarks about how we process and use your personal data, or if you wish to exercise any of your rights mentioned above, you can contact the single point of contact established for this purpose:

L’Oréal Suisse SA
Aesop – Data Privacy
Chemin de Blandonnet 10
1214 Vernier (GE)
Suisse
E-Mail: [email protected]

If you have any questions or comments regarding data protection within our organisation or regarding this privacy notice, please contact our data protection officers directly (see point 1 above).

6. SPECIFIC LOCAL PROVISIONS

For France

We remind you that in accordance with the provisions of Article 85 of Law 78-17 of January 6, 1978, you have the right to formulate general directives (with a digital trust third party certified by the CNIL) or specific directives (with the data controller) regarding the conservation, erasure, and communication of your personal data after your death.

For Switzerland

In addition to the data protection provisions of the GDPR, national data protection regulations apply in Switzerland. These include the Federal Data Protection Act (BDSG), which contains specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, data protection laws of the individual federal states may apply.

If you are located in Switzerland, we process your data in accordance with the Federal Act on Data Protection (the “Swiss FADP” for short). Unlike the GDPR, for example, the Swiss FADP does not generally require a legal basis for the processing of personal data to be specified. We process personal data only if the processing is lawful, carried out in good faith and proportionate (Art. 6(1) and (2) of the Swiss DPA). Furthermore, we collect personal data only for specific purposes that are recognisable to the data subject and process it only in a manner compatible with those purposes (Art. 6(3) of the Swiss DPA).