CLARINS SDN BHD (“Clarins”, “we”, “us”, “our”), with registered office n° 199201010182, located at 3A, Mezzanine Floor, Jalan Ipoh Kecil, 50350 Kuala Lumpur, Malaysia, is the data controller unless otherwise stated.

We may mainly collect the following personal data that could identify you directly or indirectly:

• information about your identity, in particular your gender, last name, first names, address, telephone numbers, email address, username and password, date of birth or age;
• information about your payment method, in particular your credit card number and the expiration date;
• information about our commercial transactions, in particular transaction numbers, history of your purchases, your request or your communications with our Customer Service team, your preferences and interests or information about one of our loyalty programs;
• content information such as photos, videos, ratings, reviews, comments;
• information about wellness or health (beauty concern, skin type, skin sensitivity, contraindications, undesirable effects reports, etc.) subject when applicable to your prior and explicit consent, in particular for cosmetovigilance or when asking for a beauty prescription Clarins or a treatment Clarins in one of our Spas;
• information about your social media accounts (username, sex, profile picture, caption information, location, etc.), uploads and posts when you share content or use the hashtag #clarins or other hashtags we offer or when you interact with our chatbot;
• recordings of telephone conversations to offer the best quality of service;
• technical information, in particular your IP address or information about how your device navigates through our website or metadata when you interact with our chatbot;
• other information you provide when you contact us, or we have received from external providers.

In most cases we collect this personal data directly from you, such as when you make a purchase from us, visit one of our Services or contact us for any purpose. We may also collect personal data (e.g., email address or telephone number) from third parties to whom you have given your consent to share personal information about you with us.

The provision of the personal data indicated in this Policy is mandatory, unless otherwise stated. If you do not provide us with such personal data, we may not be able to provide you with some or all of our products or Services or enter into a contract with you.

We might collect your personal data for the following purposes:

We never sell nor rent your personal data to other companies for marketing or other purposes. For the purpose listed above and, on a need-to-know basis, we can share your personal data with:

• Authorized employees: Our employees might have access to your personal data on a need-to-know basis as part of their job.
• Other Clarins group companies: Clarins is an international group that operates in many countries. The personal data we are collecting about you will be used by us and might be communicated for the purposes stated in this Privacy Policy to other Clarins group companies on a case-by-case basis and as necessary and in particular to our parent company in France and to Clarins Pte Ltd in Singapore. This may involve your personal data being communicated outside of your jurisdiction of residence where it may be subject to access by local authorities in accordance with the laws of that jurisdiction. Each of those companies may also process and use your personal data for the purposes stated in this Privacy Policy independently and on their own behalf. To learn more about the Clarins group and its locations, visit our corporate website.
• Service providers: We may use service providers chosen for their expertise and reliability and acting as data processors, separate data controllers or joint controllers with us, to assist us notably with processing and fulfilment, secure payment, donations, customer service management, maintenance and technical development operations, ratings and reviews, virtual try on, beauty consultations, analytics, spam prevention, management of digital campaigns and affiliation, fraud prevention, etc. These service providers use your personal data only to the extent necessary to perform their services or on our behalf or to comply with legal requirements and we strive to ensure that your personal data is always protected.
• External advisors: We share your data with our external advisors such as lawyers and auditors if necessary for the purposes of our legitimate interest or for compliance with our legal obligations.
• Public authorities: We may also transmit your personal data to local authorities if required by law or as part of an investigation and in accordance with applicable regulations.
• Other third parties: In case of a sale, merger, consolidation, liquidation, reorganization or acquisition.

Some of our service providers or Clarins group companies may be located outside of Malaysia and your personal data may be transferred to, stored, used and processed in a jurisdiction other than Malaysia for the purposes described in section 4 of this Privacy Policy.

You understand and consent to the transfer of your personal data out of Malaysia as described herein.

Clarins takes appropriate technical and organizational measures, in relation to the nature of data and risks, to preserve the security and confidentiality of your personal data and, in particular, to prevent them from being altered, disclosed or transmitted to any unauthorized parties.

This may include practices such as limited access by members of staff who, by virtue of their duties, are authorized to access data, contractual guarantees from third-party providers, privacy impact assessments when required, internal reviews of our practices and privacy policies and/or implementation of physical and/or systematic security measures (secure access, authentication process, backup, antivirus, firewall, pseudonymization, encryption, etc.).

We do not knowingly collect nor process personal data from minors.

If we are aware of such collection and processing, we will take immediately appropriate measures to contact the person and delete this personal data from our servers and/or those of our service providers.

Cookies or other trackers (e.g. pixel tags, unique identifier or fingerprint, etc.) designate all mechanisms aimed at storing information on your device, or accessing information already stored on your device.

When you visit our site for the first time, we notify you of the purpose of the trackers used as well as the identity of our partners so that you can make an informed decision in this regard.

We ask for your express consent before storing and/or reading trackers on your device. You are not required to consent to our use of cookies or trackers, however if you refuse to give your consent to the use of certain cookies or trackers which, except when their sole purpose is to allow or facilitate the use of our site or when they are strictly necessary to provide access to our website or to a service expressly requested by you, we may be unable to provide you with such access or services.

The trackers are mainly used on our site to:

- analyse your navigation, measure the perfomance of our site and improve the quality of our services;
- display personalized advertising according to your browsing and your profile;
- personalize the editorial content of our site according to your use or personalize the display of our products and services based on the browsing habits associated with your device;
- enable additional features on our site;
- monitor and prevent fraudulent activity, correct errors and ensure the security of our site.

You can change your preferences at any time:

- you can find out how to change your tracking preferences in the help menu of your browser;

- the platform Youronlinechoices allows you to refuse or accept the cookies used by our partners.

Please note that deactivating the cookies will not prevent the display of ads on your device but will only block technologies that allow us to tailor ads to your browsing habits and interests.

The consideration of your choices is based on a tracker. If you delete all cookies stored on your device (via your browser), we - or our partners - will no longer be able to retain your preferences.

By default, we retain your choices (both consent and opt-out) for a period of 6 months.

We may also use trackers in the e-mails we send to track certain of your behaviors such as opening the e-mail or clicking on a URL link to a page on our site in order to determine the date of our last interaction, measure the performance of marketing campaigns and provide you with personalized content. You can unsubscribe from our e-mails if you do not wish your browsing to be tracked in this way.

You can choose to use our hashtags to tag your content on social networks such as Instagram, Facebook or TikTok.

By using these hashtags, please note that your content may appear on our website and be used to refer to our products or Services.

We remind you that the information you share on social networks can be consulted, used and saved by others around the world, in particular in countries without legislation guaranteeing an adequate level of protection of your personal data as defined in your country of residence.

We also draw your attention to the fact that when you submit content using one of our hashtags, your use of social networks is exclusively governed by the general conditions of these social networks. We invite you to read it and to refer to it regularly.

If you no longer want your content to appear on our site, please remove it from the social network or stop using hashtags.

We strive to keep your personal data only for the time necessary for the purposes set out in this Privacy Policy and in accordance with the legal provisions in force.

As a general rule, we will keep your personal data for as long as is strictly necessary to manage our relationship with you and for the duration of the contract with you, and thereafter for a period of 7 years after the term of the contract or such other period as permitted by applicable law.

We may also keep some of your personal data for a shorter or longer period in the following cases:

- With respect to data processed in connection with the use of the Chat available on our website, your conversation data and metadata are deleted after you end your use of the Chat or for the duration of the replay if applicable, unless the exchanges have been on topics that require the retention of such data as set out below.

- When you use the Virtual Try On feature on our Site, the photos you send us are kept for up to 24 hours and are immediately deleted then after. If you wish to use the Virtual Try On again, you will have to take new photographs.

- Customer / prospect data will be kept for 3 years from the date of collection or after the last contact or the end of the commercial relationship, unless it is opposed or requested to be deleted by you. At the end of this 3-year period, we may contact you again in order to find out whether or not you wish to continue to receive marketing information. If no clear positive answer is given by you, your data will be deleted or archived in accordance with the provisions in force.

- Data on credit cards will be deleted after the transaction or archived for evidence purposes to the extent permitted by applicable law. Subject to your express consent, banking data may be kept until the expiration date of the credit card. We never store your visual cryptogram.

- Data necessary for carrying out analyzes and business statistics can be kept for up to 5 years.

- Recordings of telephone conversations may be kept for up to 6 months.

- Data to prove a right or a contract or kept under compliance with a legal obligation can be archived in accordance with the relevant statute of limitation provided by the applicable law.

Your personal data will be irreversibly erased or anonymized once the purposes has been fulfilled or the retention period has expired.

As a data subject and to the extent provided by applicable law, you may be entitled to:

• Right to access: You have the right to ask us to confirm whether we are processing your personal data and, if so, inform you of the characteristics of the processing(s) of your personal data, access them and obtain a copy.
• Right to rectification / correction: You can ask us to correct or complete your personal data if they are incorrect or incomplete.
• Right to erasure: You can ask us to delete your personal data in the following cases:
• when they are no longer necessary for the purposes for which they were collected;
• you have revoked your consent;
• following the exercise of your right to object;
• your personal data has been processed unlawfully; or
• to comply with a legal obligation.

We are not obliged to comply with your request for the deletion of your personal data, in particular if their processing is necessary for compliance with a legal obligation or for the establishment, exercise or defense of legal claims.

• Right to withdraw your consent: You can withdraw your consent to process data at any time, if the processing is based on consent, without affecting the lawfulness of the processing based on your consent and carried out prior to your withdrawal of consent.
• Right to object to such processing where we are relying upon legitimate interest to process data. In case of such objection, we must stop that processing unless we can either demonstrate legitimate grounds for the processing that override your interests, rights, and freedoms or where we need to process the data for the establishment, exercise, or defense of legal claims.

With respect to direct marketing, you can object to the processing activity by changing your preferences at any time in your account, by contacting us at the address below or by the following means:

• For emails: by following the link "unsubscribe" contained in each of our emails.
• For calls: by indicating to the contacting person that you object to the processing of your personal data.
• For SMS: by replying "STOP" to one of our SMS.

To exercise these rights, you must send us a request. In case of doubt, we may ask you to justify your identity by any appropriate mean:

- E-mailing a request to the Customer Service;

- By writing to the following address:


CLARINS SDN BHD

3A, Mezzanine Floor, Jalan Ipoh Kecil

50350 Kuala Lumpur

Malaysia

You will be informed of the actions to be taken as soon as possible and in any case no later than one month after your request. However, we reserve the right not to respond to unfounded or vexatious requests.

• Right to lodge a complaint: In accordance with the provisions in force, you can also file a complaint with the competent authority responsible for data protection or lodge an appeal if your data are misused. To identify the competent authority, please refer to Section 12 below.

Please contact our contact point for data protection in Malaysia or in France should you have any questions, comments or concerns in connection with this Privacy Policy:

Appendix 1. Competent national Data Protection Supervisory Authority