Personal data is any information about an identified physical person or a physical person that may be directly or indirectly identified via an identification number or one or more elements particular to them, such as their last name, first name, date of birth, customer number, order number, photo, etc.

We can collect your personal data when you:

• create a customer account on our website, apps, or in our stores;
• order goods from our website;
• make purchases in stores;
• join our loyalty program;
• use our online services, such as the chat service;
• agree to receive personalised communications from us by email, telephone, SMS or post, depending on your selection;
• answer surveys or satisfaction questionnaires based on your customer experience;
• interact with our Company via its official page on social networks or when we suggest re-use of content that you have published on a social network;
• contact our customer service;
• send requests for information to our Company;
• take part in an event we organise;
• when using digital experiences such as virtual beauty technology: the Virtual Try-On tool (if you choose to use this technology);
• browse on the Internet using cookies or similar technology or when you click on advertisements for our products.

(i) As part of the services we provide, we may need to collect certain data directly from you using electronic forms on our website, mobile apps or in selected stores, or in paper form, for a range of purposes (see IV for a list of processing purposes).

Information we might collect includes:

• Your identity
• Your contact details (e.g. email address)
• Your personal preferences in relation to the products we market or to our website (language);
• Information relating to your orders, their tracking and your purchase invoices;
• Information you may provide for our customer service;/li>
• Specific health data if you notify us of any undesirable side-effects concerning any of our products;
• Your bank details if you place an order via our website;
• Your photos/images seen by Guerlain while using your experiments via the Virtual Try-On tool. (In particular, no photos or images are kept in connection with the Virtual Try-On tool when you conclude the session);
• Your publications/mentions relating to our products on social networks.

Please note that your bank details are not transmitted in clear text on Guerlain's servers. Payments are made via a secure payment platform, supplemented by control measures, in order to guarantee the security of purchases made on www.cybersource.com and to fight against fraud. The details of your payment card communicated at the time of your order are never transmitted in clear text on the network.

Personal data essential to Guerlain is marked with an asterisk on all personal data collection forms on our website, in electronic form at some of our counters and stores, as well as off-line in paper form. If you do not fill in these compulsory fields, Guerlain will probably be unable to respond to your request and/or provide you with the requested services. Other information is optional and enables us to get to know you better and improve our communications and services with respect to you.

(ii) We may also collect certain data generated by your purchases of products or services, online or in stores, particularly information regarding the amount and type of your purchases.

(iii) Lastly, we may collect information regarding the use of our website, especially with respect to your browsing (pages visited, links clicked, etc.). Some of this information may be collected using cookies placed in your web browser when you browse our website. For more information about cookies, read point 'Information on Cookie Management' at the end of this policy.

Guerlain processes your data to:

• enable you to create a customer account on our website, applications and at our counters and in our stores;
• manage your access to your customer account on the Internet or our applications;
• process and manage your online orders and their delivery;
• record purchases made at our counters or in our stores;
• secure online transactions, prevent fraud, payment incidents and manage debt collection (see our terms and conditions for more details);
• manage customer relations with respect to any requests for information or complaints you may send us via our website, customer service or social network pages;
• manage our loyalty program;
• trace and manage any alerts you may send us as part of our cosmetic vigilance obligations;
• manage and optimize your customer experience by improving our knowledge of our customers;
• propose appropriate, tailored services, particularly when we enhance our products and services;
• conduct statistical analyses to develop management, measuring and reporting tools in order to adjust and improve our sales, marketing and product manufacturing;
• to make it easier for you to see what the product you have chosen would look like on you (when using the Virtual Try-On tool);
• send a generic newsletter: you have the right to object if you no longer wish to receive it;
• analyse your preferences and habits, anticipate your needs based on your consumer profile and your posts/ remarks about our products on social networks;
• to analyse the performance of our brand on social networks in order to produce statistical analyses (studies of results by market, brand influence and analysis of campaigns implemented);
• to promote our brand on social networks;
• manage your participation in any events to which you have signed up;
• send you information on our offers, news and events on your chosen communication media;
• subject to your free, specific, informed and unambiguous consent: to send you personalized communication according to the communication preferences you have indicated to us and to use third party services to personalise your profile.

Guerlain processes your personal information:

• to perform the contract agreed between yourself and Guerlain, to manage your access to your customer account, your subscription to our loyalty program and to process and track your orders;
• within the framework of its legitimate interest for the purposes of marketing management, securing its digital media (websites, applications, etc.) and combating fraud ;
• when you have given your consent for the processing of your data, especially for the purposes of managing our personalised information, and of your browsing data via cookies, etc.
• within the framework of compliance with our legal obligations, particularly fiscal obligations (conserving purchase invoices) and cosmetic vigilance with regard to Regulation (EU) 1223/2009 of 30 November 2009 on cosmetic products.

Your personal data is processed by the personnel of Guerlain. We ensure that only authorised persons within Guerlain have access to your personal data when this is necessary for the purpose of managing our commercial relations or meeting our legal obligations.

We may also share your personal data with;

• other affiliates of Guerlain in France or abroad;
• other entities of the LVMH Group, with some of these entities acting as data processors;
• subcontractors, such as:
  • site hosting and maintenance service providers and the providers of our electronic personal data collection solutions at counters and in stores;
  • payment service providers;
  • anti-fraud service providers;
  • logistic service providers;
  • marketing solution service providers;
  • sales prospection and social network communication service providers;
  • customer service providers
  • service providers for managing cosmetic vigilance alerts;
  • event organisation service providers;
  • third parties wishing to know your interests so that they can build up similar audiences and target prospects corresponding to your profile. In the context of this specific processing, we are not the data controller for the canvassing and you will not be the subject of the canvassing, as your data will only be used to create profiles similar to yours.

Please note that these partners may act as data controllers, in which case they have their own privacy policies. We illustrate some examples in the table below:

• Facebook (Privacy Policy accessible here)
• Google (Privacy Policy accessible here)
• Instagram (Privacy Policy accessible here)
• third parties who carry out statistics on our performance on social networks on our behalf.

Lastly, GUERLAIN may need to share your personal data with third parties to meet its legal, regulatory or treaty obligations, or to respond to requests from authorised legal authorities.

Some recipients of your personal data may be located abroad, including outside Hong Kong SAR.

All data transfers outside your country of residence are subject to appropriate guarantees, especially contractual, technical and organizational guarantees, that comply with applicable regulations relating to the protection of personal data.

The legal retention periods defined by Guerlain respect the recommendations of the CNIL and the legal obligations to which Guerlain is subject.

Customer (i.e.: with a Guerlain customer account)

Duration: 5 years from the date of the first purchase or account creation

Specificity: This period will be renewed each time you interact with Guerlain (for example a purchase or an update of your profile) or your consent to continue to interact at the end of this period.

Prospect

Duration: 3 years from the date of data collection

Specificity: This period will be renewed each time you interact with Guerlain (e.g. participation in an event) or your consent to continue to interact at the end of this period.

Guest' customer (i.e.: not having a customer profile)

Duration: 5 years from the date of first purchase

Specificity: This period will be renewed each time you interact with Guerlain (e.g. a purchase).

Customer Service (i.e.: complaints or information)

Duration: duration of the processing of the request plus 5 years

As stated above, when you choose to use our Virtual Try-On tool, no photos or images are retained or stored beyond the conclusion of the session.

Under current regulations, particularly the GDPR, you have the right to access and correct your personal data, request erasure, object to processing on legitimate grounds and obtain limitation or portability, insofar as this is applicable.

You also have the right to formulate specific or general directives concerning the conservation, deletion and communication of your post-mortem data.

You can exercise these rights directly with Guerlain by sending an email to dpo@guerlain.fr or by Whatsapp at 9010 6890.

If, at any time, you no longer wish to receive details of our offers, news and events, you can unsubscribe using the hypertext link provided for this purpose in each mail we send you. You can also contact us by email to dpo@guerlain.fr or by Whatsapp at 9010 6890.

You may also lodge a complaint with the Commission Nationale Informatique et Libertés (CNIL) at the following address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

For all questions relating to the collection and processing of your data by Guerlain, you can contact the Guerlain Data Protection Officer at dpo@guerlain.fr or via our contact form for computer or mobile.