Introduction

LA BOUCHE ROUGE, a limited company incorporated under the laws of France, registered at the Commerce and Company Register of Paris under the number 825 073 091, having its registered office at 10, rue de la Paix, 75002 Paris (“La Bouche Rouge” or “us” or “we”), offers cosmetics and makeup for sale (the “Services”).  La Bouche Rouge sells its products on its online store accessible at this URL: https://www.laboucherougeparis.com/ and in various retail stores.

1.  Why have a data protection policy?

2. Who is responsible for processing your data?

3. Who will have access to your data?

4. You are a visitor to the website

5. You are an online customer

6. You are an in-store customer

7. You are an applicant for a job with us

8. You are a partner of ours

9. What is our cookies policy?

10. What are your rights?

11. Do we transfer your data outside the European Economic Area?

12.  How are we protecting your data?

13. Who do you contact as regards the processing of your data or the exercise of your rights in respect thereof?

14. Updating of the privacy policy

1. Why have a data protection policy?  

It is paramount for us that personal data is protected. This policy sets out the way we process your data as well as the rights you have in respect of such data pursuant to the legislation relating to data protection and in particular, those provisions set out in French Law No. 78-17 known as the “IT and Freedom Law” (Loi informatique et libertés) and the General Data Protection Regulation No. 2016/679, known as the “GDPR”. 

2. Who is responsible for processing your data?

La Bouche Rouge is the data controller for all processing described in this privacy policy. This privacy policy only applies to the processing for which we are responsible.

3. Who will have access to your data?

As part of all processing of your data as mentioned in this privacy policy, we may make your data available to the following categories of recipients on a need-to-know basis only:

. La Bouche Rouge’s employees

. Hosting provider

. IT providers

. IT solutions for data processing

. External consultants

. Recruitments firms

. Accounting firms

. Partners

In accordance with Article 28 of the GDPR, the relationship between La Bouche Rouge and its data processor is governed by agreements, which bind the data processor to the data controller, define the purpose and duration of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects, and the obligations and rights of the data controller and the data processor.

4. You are a visitor to the website

We process your personal data when:

· You are browsing La Bouche Rouge’s website; in which case our cookies policy will be applicable to you (see section “8. What is our cookies policy?).

· You subscribe to La Bouche Rouge’s newsletter on its website.

We process the following categories of data:

· Email address

· Browsing data (see section “8. What is our cookies policy?)

We process your personal data issued from your subscription to the newsletter for the purpose of sending you news on La Bouche Rouge’s products and/or services. This processing is established on the legal basis of your consent.

La Bouche Rouge does not share your email address to any third party.

We will retain your data until you withdraw your consent or the processing changes significantly and we are required by applicable law to seek your consent again

5. You are an online customer

You either can use our Services by checking out as a guest or by creating a personal account.

a) You are checking out as a guest

We are processing your personal data when you choose to check out as a guest on La Bouche Rouge's online shop.

We process the following categories of data:

· Email address

· Identification data (name and surname)

· Physical address for delivery

· Billing address

· Phone number

· Payment data

We are processing your personal data to provide you with our Services, in accordance with La Bouche Rouge’s General Terms and Conditions of Sale. The performance of the contract is the legal ground for this processing.

In addition, we are processing your email address to send you targeted campaigns in relation with our products. This processing is based on the legitimate interest of La Bouche Rouge to keep you inform of our products and services.

We will keep your personal data for a period of five years after the end of the contractual relationship between you and La Bouche Rouge, except when we are under a legal obligation to retain them for a longer period.

La Bouche Rouge might transfer your personal data to its partners only after you give your express consent for said transfer.

b) You are creating a personal account

We are processing your personal data when you choose to create a personal account on La Bouche Rouge’s online shop.

We process the following categories of data:

· Email address

· Identification data (name and surname)

· Physical address for delivery

· Billing address

· Phone number

· Payment data

· Birthday

We are processing your personal data to provide you with a personalized account that allows you to access your order history. This processing is legally based on your consent.

In addition, we are processing your email address to send you targeted campaigns in relation with our products. This processing is based on the legitimate interest of La Bouche Rouge to keep you informed of our products and services.

La Bouche Rouge might transfer your personal data to its partners only after you give your express consent for said transfer.

We archive all your personal data for the period during which your personal account remains active. You can close your personal account by contacting customer services.

If you close your personal account, La Bouche Rouge will store some of your personal data for a duration of five years on the basis of its legitimate interest to demonstrate that it has executed its contractual obligations with you. La Bouche Rouge will delete all other personal data, except data which we are under a legal obligation to retain.

Should your personal account remain inactive for more than three years, La Bouche Rouge will close your account and delete all remaining personal data except data we are under legal obligation to retain.

6. You are an in-store customer

We process your personal data when you fill in a form at any of our retail locations.

We process the following categories of data:

· Identification data 

· Email address and phone number

· Birthday

We process your personal data for the purpose of sending you personal invitations and personalized newsletters and/or La Bouche Rouge’s ads.

This processing is established on the legal basis of your consent.

La Bouche Rouge might transfer your personal data to its partners only after you give your express consent for said transfer.

We will retain your data until you withdraw your consent or the processing changes significantly and we are required by applicable law to seek your consent again.

7. You are an applicant for a job with us

We process your personal data when:

· you apply for a job directly with La Bouche Rouge

· you apply for a job offer via one of the recruitment agencies we use, and which are co-processors of your data

· you send us an unsolicited application

The purpose of this processing is to manage and follow up applications, whether for salaried positions, temporary employees, work-study students or interns.

We process the following categories of data:

· Identification data

· Personal life data

· Data on professional life

· Economic and financial information

The processing is based on the legitimate interest of La Bouche Rouge to use this personal data to implement the recruitment process of employees, temporary workers, work-study students and interns.

As part of the processing of your data, it may be transferred to the following categories of recipients:

· La Bouche Rouge's human resources department, personnel and consultants interested in the recruitment, such as managers and directors relevant to the position concerned

· Recruitments firms

We will retain your data for a period of two years from the last time we interact with you following your application unless you provide us with a duly notified objection. 

8. You are a partner of ours

We process your data as part of your contractual relationship with La Bouche Rouge, for the purposes of managing and monitoring the services you provide and/or the conditions of our partnership.

We process the following data:

· Identification data

· Economic and financial information

We process your data on the legal basis of the agreement between you and La Bouche Rouge.

As part of the processing of your data, it may be transferred to the following categories of recipients:

· The involved managers and employees of La Bouche Rouge

· Some other La Bouche Rouge’s external consultants or providers which are concerned by the partnership with you

· The accounting firms

We will keep your personal data for a period of five years after the end of the contractual relationship between you and La Bouche Rouge.

9. What is our cookies policy?

Each time you visit La Bouche Rouge’s website, we collect data about your visit and navigation in the conditions described below. Various technologies may be used to collect this data. We refer to them generically as "cookies".

The cookies are as follow:

· Essential trackers: Essential trackers are required for our site to operate. They allow you to navigate our site and use its services and features.

· Preference trackers: Preference trackers allow us to store information about your choices, settings, and preferences. They are not essential to the functioning of our site.

· Analytics trackers: Analytics trackers collect or use information about your site use, which helps us improve our site.

We process your data from essential trackers on the legal basis of the legitimate interest of La Bouche Rouge to operate its website.

We process data from preference trackers and analytics trackers with the consent of the concerned users of our website.

We process your personal data issued from the cookies for the following purpose:

· To optimize browsing La Bouche Rouge’s website by studying your browsing habits and adapting the technical characteristics of our website to your device

· To operate our website

We will retain the data derived from the cookies for a maximum of 18 months. After this deadline, the data are automatically deleted.

You can administrate your consent or objection to the collect of your data by the cookies at any time here.

10. What are your rights?

In accordance with the applicable legislation, you have rights when your personal data is processed. Subject to the conditions applicable to the exercise of these rights, you have a:

· Right of access: you have the right to obtain confirmation from the data controller as to whether personal data is being processed and, if so, to receive a copy of all the data that the data controller holds about you.

· Right to the portability of personal data: you can receive from the data controller, personal data concerning you in a structured format commonly used and readable by machine, for the purpose of transmission to a third party. Where technically possible, you also have the right to have your personal data transmitted directly to that third party.

· Right to rectification: you have the right to request rectification of personal data from the data controller as promptly as possible if the data is incomplete or incorrect.

· Right to restrict processing: you have the right to request the data controller to restrict the processing of your personal data.

· Right to erasure: subject to certain conditions detailed in Article 17 of the GDPR, you have the right to request the data controller to erase personal data about you.

You are hereby informed that when exercising your rights, you may be asked to prove your identity. You may be asked to provide proof of identity or any other document that would make it possible to verify the truthfulness of your request, to guard against any fraudulent request.

11. Do we transfer your data outside the European Economic Area?

In the pursuit of its activities, La Bouche Rouge may transfer your data outside the European Economic Area (EEA).

If we transfer your data out of the European Economic Area, we implement at least one of the two following safeguards:

· We transfer your information to countries that have been recognized by the European Commission as providing an adequate level of data protection according to EEA standards.

· We take steps to ensure that the recipient is bound by E.U. Standard Contractual Clauses to protect your personal data.

12. How are we protecting your data?

We implement appropriate technical and organisational measure to ensure security, integrity, confidentiality and authenticity of your personal data.

13. Who do you contact as regards the processing of your data or the exercise of your rights in respect thereof?

For all questions relating to the processing of your data, or to exercise any rights in respect thereof, please contact our data protection officer at the following email address: privacy@laboucherougeparis.com

Finally, you have the right to file a complaint with the Supervisory Authority in your country of residence, for France, the CNIL: https://www.cnil.fr/

14. Updating of the privacy policy

To ensure compliance with the regulations in force, La Bouche Rouge reserves the right to modify at any time the present policy of personal data protection.

La bouche rouge stands for "red lips" in French but also for having a voice, striking a message.