PRIVACY NOTICE

1. Who collects your personal data?

Nuxe Group is comprised of the companies listed below, who may use and store your personal information independently or jointly. Where any of our companies act as joint data controllers, Laboratoire Nuxe will be responsible for any decisions made about how to use your information, keeping it secure, and responding to any requests you may make in relation to your information. When we refer to “us” or “we” in this notice, we are referring to any and all of the companies which form the Nuxe Group:

LABORATOIRE NUXE (our French head office)
Registered office: 127 rue d’Aguesseau, 92100 Boulogne Billancourt, France
Paris Corporate Register number: 642.060.123

NUXE SPA (who operate our spa locations)
Registered office: 127 rue d’Aguesseau, 92100 Boulogne Billancourt, France
Paris Corporate Register number: 497.883.587

NUXE UK LIMITED (our UK office)
Registered office: 46 New Broad Street, London, EC2M 1JH
UK Corporate Register number: 0800805

2. When do we collect your data?

We collect, directly or indirectly through our service providers, personal data from you in particular when:

You browse our Site or use our Services on our Site,
You create an account on our Site,
You connect to your account on our Site,
You use your account on our Site,
You subscribe to our newsletter,
You place and pay for an order on our Site,
You use our loyalty programme,
You provide an opinion or comment through social media or our Site,
You contact us through various channels including, in particular, our contact forms, by post or by telephone,
You contact us via our tchat or webcallback,
You participate in a game or competition, product tests, satisfaction surveys and polls,
You visit us in the Institute/Spa,
You share content on social networks by using a hashtag #Nuxe or hashtags that we propose to you,
You have given your agreement to third parties so that they can send us personal data concerning you,
You share your content with us,

We only collect your personal data when this is strictly necessary and legal. We undertake only to collect the minimum of personal information necessary for the purposes covered by this notice.

We will only use your personal information for the purposes for which we collected it as set out in this notice, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so or (if necessary) seek your consent.

3. How do we collect your data?

We may collect personal information about you from various sources, notably:

information collected directly, that you voluntarily provide to us, in particular through collection forms (for example: last name, first name and contact details)
information collected indirectly, automatically or with your express consent at the time of use of our Site
information that you provide to a third party where you give them consent to share it with us
information concerning you coming from other legitimate sources, including sources available commercially, such as public databases, data aggregators, etc.

4. What personal data do we collect?

In this notice, “your personal data” means information or items of information which allow you to be identified directly or indirectly. This generally includes information such as your name, address, profile photo, e-mail address and telephone number, but can also include other information such as your IP address, your buying habits, and information about your lifestyle or your preferences.

Even if the precise details of the personal data that we collect vary according to specific needs, we generally collect the following data:

When?	What data?
When you browse on our Site and/or login to your account	your last name, first name, e-mail address, connection data, technical data including your IP address, browsing information concerning your terminal
When you create an account on our Site	your last name, first name, e-mail address, date of birth, type of skin (e.g. oily, combination, dry or sensitive), Facebook ID (if connection linked to Facebook)
When you register for our newsletter	your e-mail address
When you order a product or service offered on our Site	your last name, first name, e-mail address, the content of your order, invoicing address (the type of address: home, work, etc), delivery address, mobile/fixed telephone number
When you pay for the products and/or services ordered on our Site	your last name, first names, order number, the value of the order as well as the number of your credit card and its expiry date
When you sign up for and use our loyalty programme “My club Nuxe&moi”	your last name, first name, date of birth, e-mail address, postal address, telephone number, sms registration, preferred point of sale, Facebook ID, till receipts sent, e-mail addresses of sponsors
When you provide an opinion about a product and/or service offered on our Site or our social networks	the content of your opinion
When you provide content on our UGC and our social networks	Content provided (image, photograph, video, opinion, etc)
When you contact our Customer Services	your last name, first name, e-mail address, postal address, date of birth, telephone number, order number, the content of your request, and a recording of your call (if you telephone us)..
When you take part in games/competitions, product tests, satisfaction surveys and polls	your last name, first name, e-mail address, date of birth, your content connected to the participation (photographs, videos, opinions, comments etc), Facebook ID.
When you visit the Institute/Spa	your last name, first names, telephone number, e-mail address, postal address, date of birth, data contained in the health questionnaire
When you authorise third parties to send us data	the content of the data that you provide to them

We don’t collect secret data about you, and almost all of the data we hold about you will be voluntarily provided by you, except where we’ve indicated above that it’s collected automatically

5. For what purposes do we collect your data?

The processing that we carry out must have an explicit, legitimate and specific purpose.

We use your personal information as necessary to allow us to provide the Site and the services included in it, ensure their improvement and the maintaining of a secure environment and, in particular, to:

Manage the functioning and the optimisation of our Site and our services and products
Help accelerate your future activities and experiences on our Site
Assess the use of our Site, of our products and services and to analyse the effectiveness of our communication campaigns and promotions
Personalise your experience on our Site and other platforms and to asses anonymously and globally the activity on our Site and other platforms (in particular, we take into account the time when you visited it, if you have already visited it and what site referred you to it)
Make our Site easier to use and to better adapt our Site, our products and services to your interests and needs
Administer our business relationship (orders, payment, deliveries, invoices, accounting, satisfaction survey, customer service, etc)
Manage our loyalty programme and allow you to benefit from its advantages. This processing is conducted subject to your consent
Manage our customer relationship through our CRM, in order to get to know you better, personalise our products and services and contact you concerning the products and services capable of interesting you (launching of new products, promotional offers, promotional events, beauty lessons and/or demonstrations, PR event, VIP meetings, store opening events, announcements/events, events with shopping centres, department stores, celebrities, magazines, television, Web sites, joint promotions, etc.), on condition that you have given your consent or that you have previously requested a product or service from us and that the communication is relevant or connected to this prior request and made within the times stipulated by the applicable laws.
Provide you with the products or services that you request from us (requests for information, replying to your questions/comments)
Provide a customer service accessible by telephone or instant messaging
Provide sharing tools on our Site and/or social networks
Provide you with mobile messaging services by which you can receive text or other types of messages from NUXE such as SMS or MMS on your mobile telephone, on condition that you have previously accepted to receive these messages on the mobile number that you have provided to us for this purpose
Proceed with the verification, identification and authentication of the personal data that you have sent us
Prevent and detect fraud and malware (malicious software) and manage security incidents
Manage disputes.

We try to minimise the data collected, to keep it accurate and up to date by facilitating the rights of the persons concerned.

Where we have a contract with you, we may need certain information to carry out that contract with you (such as contact and payment details) and you must provide this in order to enter into a contract with us (or as required under that contract), if you do not, we may not be able to carry out our contract with you. Information fields which are required in those circumstances will be marked as mandatory.

6. For how long to we keep your data?

In accordance with data protection law, we do not keep your data beyond the time strictly necessary for the purposes pursued above

THE TYPE OF DATA	RETENTION PERIOD
>Data that you have provided in your profile. >Data concerning your browsing and your use of the Site,	Three (3) years from your last activity on the Site
>Data concerning an order	Three (3) years from your order
>Audience measurement statistics and aggregated data regarding use of our Site	Thirteen (13) months
>Prospects/customer data	Three (3) years from its collection or the last contact or the end of the business relationship.
>Payment data	Deleted following the transaction. Subject to your express agreement, this data can be kept until the expiry date of the bank card.
>Data showing proof of a right or a contract to be established or kept to comply with a statutory obligation	Archiving in accordance with the relevant law.
>Call records and transcripts in order to improve our customer service	Six (6) months following the call.

As required under our administrative, legal, accounting and tax obligations, your data may be archived and kept beyond these periods in accordance with applicable law.

7. How does our Site use cookies?

For more details, please consult our policy concerning cookies

8. Who are the recipients of your data?

We do not sell your information to third parties.

We may share your information with third parties as set out below. Third parties are required to respect the security of your personal information and to treat it in accordance with the law.

• employees of Nuxe Group,

• our advertising, marketing and promotion agencies to help us execute and analyse the effectiveness of our advertising campaigns and promotions,

• third parties required to deliver a product or service to you, such as delivery or a postal service delivering a product that you have ordered,

• third party suppliers of services, such as the suppliers of hosting services for Web sites,

• suppliers of Web analysis tools such as Google,

• our service providers and/or business partners when sharing is necessary to achieve the purposes stated above,

• administrative or judicial authorities when they request us to disclose your information to them,

9. Where is your data stored?

We may need to transfer your personal data for the purposes set out above to another company of the Nuxe Group or trusted partners located outside of the European Economic Area, whose legislation concerning the protection of personal data differs from that of the European Union.

When these partners are located outside of the European Union, we will ensure that one of the following appropriate safeguards is in place where required (or we will obtain your consent for that transfer):

A contract for the transfer of data using standard clauses approved by the European Commission,
Internal company rules approved by the competent authorities,
Ensuring that these third parties are companies that are registered with the US Privacy Shield Scheme or are in a country which has an “adequacy decision” in place from the European Commission.

We require of our partners that they take all the technical and organisational measures to ensure the confidentiality and the security of your data.

10. How do we protect your data?

In our capacity as controller, we take all reasonable precautions to protect the security and the confidentiality of your personal data by deploying organisational, technical, software and physical measures and we require from our partners that they do the same.

Access to your personal data is restricted to prevent any unauthorised access, any modification, interference, loss and/or abuse. However, despite our efforts, we cannot guarantee the perfect security of the transmission or storage of your personal data on the Internet to the extent that the Internet is not an environment sufficiently safe and secure.

11. How can you exercise your rights?

Data protection law gives you a number of rights when it comes to personal information we hold about you. The key rights are set out below. More information about your rights can be obtained from the Information Commissioner’s Office (ICO). Under certain circumstances, by law you have the right to:

Be informed in a clear, transparent and easily understandable way about how we use your personal information and about your rights. This is why we are providing you with the information in this notice. If you require any further information about how we use your personal information, please let us know.

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it (for instance, we may need to continue using your personal data to comply with our legal obligations). You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to us using your information on this basis and we do not have a compelling legitimate basis for doing so which overrides your rights, interests and freedoms (for instance, we may need it to defend a legal claim). You also have the right to object where we are processing your personal information for direct marketing purposes.

Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

Request transfer of your personal information to another party where you provided it to us and we are using it based on your consent, or to carry out a contract with you, and we process it using automated means.

Withdraw consent. In the limited circumstances where we are relying on your consent (as opposed to the other bases set out above) to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate interest in doing so.

Lodge a complaint. If you think that we are using your information in a way which breaches data protection law, you have the right to lodge a complaint with your national data protection supervisory authority (if you are in the UK, this will be the ICO).

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal information, withdraw your consent to the processing of your personal information or request that we transfer a copy of your personal information to another party, please send a request to the Consumer Department by the contact form, under "Privacy policy / GDPR" accompanied by an identity document.
A reply will be sent to you within one (1) month from the date de receipt of your request. Nevertheless, we reserve the right not to answer request that are clearly unjustified.
However, you can exercise your right of access to and of rectification of your personal data at any time from your Account, excluding the data collected indirectly.

No fee usually required. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you. We may need to request specific information from you to help us understand the nature of your request, to confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Please consider your request responsibly before submitting it. We will respond to your request as soon as we can. Generally, this will be within one month from when we receive your request but, if the request is going to take longer to deal with, we will let you know.

You can exercise your right of access to and of rectification of your personal data at any time from your Account in relation to information about your Account which was not indirectly collected..

How do you unsubscribe from our newsletter lists?

You can unsubscribe from our newsletter list by using the link at the bottom of all our newsletters or under the heading My profile and My addresses of your account.

How to do you unsubscribe from our SMS distribution lists?
You can unsubscribe from receiving NUXE SMS in the section
My profile and My addresses of your account or by sending an SMS “STOP” to the number stated in the SMS received.

12. How do we deal with information about children?

Our Site is intended for adults or children who are 16 or over, or have the authorisation of their legal representative allowing them to make an order on the Site.

Except as set out above, we do not knowingly collect or process personal data concerning children.

13. Social networks/Links

We are not responsible for any use of personal data by social networks that we use such as Facebook, Instagram and Twitter.

As a service provided to our visitors, our Site may contain hypertext links referring to other web sites which are neither operated nor controlled by us.

We are not responsible for the content of such web sites or for the measures of protection of data of third parties who operate them. Please note that their data protection statements, and data protection measures, will be different from ours. When you leave our website, we encourage you to read the privacy notice of every website you visit.