Privacy Policy

The brand NARS is part of the Shiseido Group’s brand portfolio.

Beauté Prestige International, Shiseido’s European headquarters based in Paris, France, whose trade name is Shiseido EMEA, is the controller of the processing of your Data, jointly with SHISEIDO UK.

This means that Shiseido EMEA determines for what reasons (i.e. the purposes) your Data is processed as well as the resources (i.e. the means) allocated to such processing and is responsible for the processing of your Data.

Shiseido EMEA is in charge of leading our ecommerce, customer relations and marketing efforts for Europe, the UK and Switzerland. The related Data processing is carried out by or on behalf of Shiseido EMEA.

Shiseido EMEA may further share information with the whole Shiseido Group in accordance with the safeguards foreseen in this policy (see Section 7).

Shiseido EMEA, as well as all companies of the Shiseido Group, are hereafter designated or referred to as “We”, “Our” or “Us”.

Depending on how you interact with Us (online, offline, by phone, etc.), we may collect from you various categories of Data, which are described in more details below.

We generally use your Data on the basis of the following grounds:

• The performance of the contract we have with you: in certain circumstances, We need your Data to execute Our contractual obligations. For example, if you buy products through Our Site, We need your name and contact details so We can communicate with you and deliver the products you ordered. If you do not provide your Data, We will not be able to provide you with the requested products and services. We generally indicate the mandatory fields with asterisks;
• Your prior consent: in certain cases,We may ask for your consent before using your Data. For instance, We will always ask for non customer’s permission to send promotional communications;
• Compliance with a legal obligation applicable to us: sometimes We have to collect and use your Data in order to comply with Our own legal obligations. For example, tax laws require Ws to keep trace of invoices related to your purchases;
• Our legitimate interests: this is a legal term in data protection law which means We have a good and fair reason to use your Data and We do so in ways which does not hurt your interests and rights. For instance, We do analyse how you and other users interact with Our Site so We can better understand what elements of the design are working well and which are not working so well. This allows Us to improve and develop the quality of the online experience We offer all Our users.

We may collect, use and disclose your Data for the main following purposes:

For what purpose do we use your Data?	What Data do we use?	On which ground?
Manage your online activities
1. Create and manage your online account	· Identification and contact information · Order and product information · Habits and preferences · Connection data	Your prior consent
2. Manage your online product orders	· Identification and contact information · Order and product information · Payment and transaction-related information · Connection data	The execution of pre-contractual and contractual measures.
3. Send you customized communication based on your profile	· Habits and preferences	Our legitimate interest
4. Only for Our Italian websites: commercial profiling purposes carried out by the Data Controller, both with human intervention and in automated mode	· Habits and preferences	Your prior consent for Our Italian Websites
5. Manage your participation in one of Our promotional operations (game-contests, sample operations, promotional offers, etc.)	· Identification and contact information · Order and product information · User-generated content	Your prior consent
Offer you quality services in store
6. Create and manage your personal profile to offer you personalised services and advices in store, according to your preferences	· Identification and contact information · Order and product information · Habits and preferences (might include information related to your allergies)	Your prior consent
7. Manage your appointments with Us (with your beauty consultants, make-up sessions, tutorials and events, etc.)	· Identification and contact information · Habits and preferences	Performance of the service contract with you
8. Manage cabin treatments	· Identification and contact information · Order and product information · Habits and preferences (might include health related data)	Performance of the service contract with you Your prior consent
9. Manage your registration to our loyalty programs	· Identification and contact information · Order and product information	The execution of pre-contractual and contractual measures
10. Manage distance selling (click & collect, orders by phone, etc.)	· Identification and contact information · Order and product information · Payment and transaction-related information	Performance of the sales contract with you
Website analysis
11. Offering you online content adapted to your preferences and online behaviour	· Habits and preferences · Connection data · Data related to your use of Our Sites and applications · Technical information	Our legitimate interest Your prior consent
12. Managing and following traffic, navigation and use of Our Sites	· Connection data · Data related to your use of Our Sites and applications · Interaction with social networks and external platforms · Technical information	Our legitimate interest Your prior consent
Interacting with you
13. Manage promotional communications (via email, SMS or phone), either because you consented to receive Our promotional offers or to exchange with your beauty consultants in store	· Identification and contact information · Order and product information · Habits and preferences · Technical information · Connection data · Data relating to your use of our Sites and applications	Our legitimate interest Your prior consent
14. Interact with you when you contact us via our customer service or via any other channel(online chat, email, text message, telephone help line for any reason, compliments, feedback or a request, etc.)	· Identification and contact information · Order and product information · User-generated content · Technical information · Connection data	The execution of pre-contractual and contractual measures Our legitimate interest
15. Manage your comments and reviews on our products	· Identification and contact information · Order and product information · User-generated content	Our legitimate interest
16. Assess your satisfaction	· Identification and contact information · Order and product information · Habits and preferences · User-generated content	Our legitimate interest
17. Carry out market surveys	· Identification and contact information · Order and product information · Habits and preferences · User-generated content	Our legitimate interest
18. Managing back-in stock emails notifications	· Identification and contact information	Performance of the sales contract with you
19. Manage adverse events notifications	· Identification and contact information · Order and product information · Habits and preferences · Information on adverse events including health-related information and pictures of you and those you might send us · User-generated content	Your prior consent Compliance with a legal obligation applicable to us
20. Manage your requests on your Personal Data	· Identification and contact information · User-generated content	The execution of pre-contractual and contractual measures
Others
21. Performing analysis and statistics	· Order and product information · User-generated content · Habits and preferences · Connection data · Data related to your use of our Sites and applications · Technical information	Our legitimate interest
22. Exercise Our legal rights in case of proceedings	· Identification and contact information · Order and product information · Information on adverse events · User-generated content	Legal obligation Legitimate interest
23. Ensuring our Sites security	· Identification and contact information · Technical information · Data related to your use of our Sites and applications · Connection data	Our legitimate interest
24. Managing video surveillance in our shops	· CCTV images	Our legitimate interest

To have a better overall understanding of you as a customer, We may combine information about you gathered across various channels. For example, Data collected in the course of your online activity (e.g. shopping, account creation, etc.) may be combined with Data We collect when you visit one of Our stores.

This Data enrichment may also occur between different brands of our group. For example, if you make an online purchase on of Our brand website and then create an online account with the same email address on another brand website, the Data collected through these two websites may be combined to enrich your customer profile.

This helps Us to propose products and advice that is most relevant to your interests at particular times, by email or when you visit one of Our stores.

You can object to these "profiling" operations at any time by contacting Us. Please refer to section 11.

Depending on the type of Data and purpose of processing, access may be granted to the following authorized persons:

• Other brands of our group: To the extent permitted by law and taking into account the protection of your rights and freedom in respect of the processing of your Data, and the consent you have given (if need be), some of your Data may be shared with the other brands of our group, for example, to enrich your customer profile, to develop other brands Media audience and to update your Data as regularly as possible. Your Data will only be accessible to a limited and defined number of recipients within Our group on a strict need to know basis.
• Other affiliates and group entities: your Data may be shared with the other affiliates of our group who are involved in the processing of your Data.
• Third party vendors and providers: Your Data will generally not be shared with recipients outside Our group. In some cases, however, We may make your Data accessible to selected third parties vendors or providers acting on Our behalf and Our instructions (this may include other affiliates or brands of Our group) or to partners acting as data controller in the course of delivering specific services to You. The sharing of your Data will only take place for the needs of the purposes described in above section 4.

For example:

• The transporters will need to access your Data to deliver the products you ordered
• The marketing campaign providers will need to access your Data to send you Our communications,
• The IT maintenance providers might need to access your Data in case of technical incident
• The Digital and social media partners may have access to some of Your online activities
• The online payment provider will need to process your bank account information in order to finalize online transactions in its capacity as data controller (We will not have access to any such Data)
  
  In any case, We require such third parties to:
  - be subject to strict contractual data protection and confidentiality obligations;
  - undertake to comply with all applicable data protection laws and exclusively for the purposes specified in the contract We have with them;
  - implement appropriate technical and organizational security measures designed to protect the integrity and confidentiality of your Data.
  
• Digital and social media partners: In order to share content on or through social media, Our Sites may use functionalities, links or icons owned by Our digital and social media partners. It may consist, for example, of the like or sharing buttons on social networks such as Facebook or Instagram. Such functionalities allow you to view content or share content, preferences and opinion on or in relation with Our products. We are also using online tools such as Google, Facebook or Instagram (Google Analytics, Facebook Custom Audience or Conversion API) in order for Us to optimize Our ad targeting campaigns and ensure to deliver advertising content that suits to you at best. The providers of these tools, functionalities, links or icons can directly identify you when you use it, or even if you do not use it but (i) you have an account to such social network or platform, or (ii) you are already known and identified by such providers. As soon as you view content or share content, preferences and opinion, Our partners may connect your activities on Our Sites to other information they already own on you in their capacity as Data controller.
  
  We may also use the lookalike functionalities (for example from Facebook) to build audiences similar to your profile in order to allow Us or other brands of Our Group to target prospects that match your profile. You will not be the subject of related prospecting, your data being only used to create profiles similar to yours.
  
  Such above processing is governed by Our partners’ own privacy policies in their capacity as data controller. We invite you to visit and check privacy policies of such online tools and to adapt your choices related to cookies and confidentiality in accordance with your wish.
  
• Public and judicial authorities: We might need to share your Data with public authorities when the law requires Us to do so. For instance, We might be requested to provide invoices to tax or financial authorities, or to provide information related to adverse events linked to the use of Our products to health authorities. We might also need to share your Data with judicial authorities in the event of a litigation. We may also have to transfer your Data to third parties when We receive a request by an authority empowered by law to do so.
• Our professional advisers: We may also share your Data when necessary with Our professional advisers, such as Our accountants, auditors, lawyers, insurers, etc.
• Potential acquirers and other stakeholders involved in Our business transfers: We might share your Data to another legal entity in the event of a collaboration, joint venture, acquisition, merger, sale, corporate restructuring or change of legal form. In this context, the acquirer will act as the new or joint controller of your Data. In case of a merger or sale, your Data will be permanently transferred to the successor company.
  In any case, please rest assured that We only grant access to your Data on a need-to-know basis, and that such access is limited to the Data that is strictly necessary to perform the purpose for which such access is granted to recipients in their capacity as Data controller or Data processor. We will never rent, trade or sell your Data to third party companies.

We ARE a multinational organization with affiliates, vendors and partners located in many countries around the world. For that reason, We may need to share your Data with entities located in other jurisdictions, in countries which may not be regarded as providing the same level of data protection as the jurisdiction you are based in.

Our European headquarters which is in charge of leading Our ecommerce, customer relations and marketing efforts in Europe, is located in France. As a consequence, your Data may be transferred to France.

Your Data may also be shared with Our American affiliate Shiseido Americas, which is notably in charge of the overall management of Our group customer relationship management system.

In any cases We ensure that adequate safeguards, as required under the applicable data protection legislation, are in place. Such safeguards may include:

• Adequacy decisions released by the European Commission or
• The European Commission’s Standard Contractual Clauses or
• Our providers’ Binding Corporate Rules (“BCR”)

For more information about the transfer of your Data, you can contact Our Data Protection Officer (please refer to section 11).

We know how much data security matters to all Our customers and take all appropriate steps to protect your Data from unauthorized access, alteration, disclosure, or destruction. We pay particular attention to sensitive data, especially payment card data, allergy or intolerance data, etc.

Please note, however, that any information you choose to share in public areas such as Our website community features, or other social areas is by definition considered as public and can be seen by anyone accessing the related platform.

We will retain your Data for the period necessary to fulfil the purposes outlined in this Policy (see section 4).

The criteria used to determine such retention periods include:

(i) the length of time We have an ongoing relationship with you;
(ii) whether there is a legal obligation to which We are subject;
(iii) whether a longer retention period is required or permitted by law.

We are committed to improving our Data Protection program and.integrating new rules, such as data retention rules, into our systems to always better protect Your privacy.

Our Sites are not directed to anyone under 16 years of age even if they have permission from their parents or guardians. We do not solicit or collect any type of information from a person known to be under the age of 16.

We are not able to verify whether a website user is a minor and therefore We recommend parents or guardians to be involved in the online activities of their children in order to prevent data about minors from being processed by Us.

However, if We become aware that We have accidentally collected information from a child under the age of 16, We will remove that information from Our records as soon as feasibly possible.

In accordance with the applicable data protection law, you have the right to request:

• Access to the Data We hold about you. You also have the right to obtain confirmation as to whether Data concerning you is being processed or not ;
• The correction of your Data if they are incomplete or inaccurate;
• The erasure of your Data, in the cases provided by law. Please note that in some cases, We may be obliged to retain your Data anyway, for legal or legitimate reasons;
• The interruption of the use of your Data, by objecting to the use of your Data where Our “lawful basis” is Our legitimate interests and that We have no legitimate overriding interest. You also have the right to object at any time to the processing of your Data for marketing purposes. You may unsubscribe from Our marketing communications simply by clicking on the “unsubscribe” link at the bottom of each communication;
• The restriction of the use of your Data, if provided by applicable law;
• To obtain a copy of the Data you provided Us, in a structured, commonly used and machine-readable format, to transmit it to another data controller, if provided by applicable law. This right only applies when the processing of your Data is based on your consent or on a contract and such processing is carried out by automated means.

To exercise your rights or for any further questions related to the use of your Data, please contact Our Data Protection Officer:

• Via Our online contact form here.
• Via Our postal address:
  Data Protection Officer
  Shiseido EMEA
  56 A, rue du Faubourg St Honoré
  75008 Paris
  France

Please note that to process your request, We may ask you for proof of identity.

If you feel that your Data has not been handled correctly, or you are unhappy with Our response, you have the right to lodge a complaint with your local data protection authority.

We may update this Privacy Policy from time to time in order to improve Our transparency towards You and to reflect any change in the way We are processing your Data. Please visit this page frequently so that you may have updated information thereabout.