Privacy policy (GDPR standard)

Security and protection of personal data

Warnings

This tool is provided free of charge. It draws on the firm’s professional analysis of GDPR compliance. However, compliance is an ongoing process and every situation is different. The information provided must therefore be adapted and must not be considered exhaustive or accurate in all circumstances.

Unless you request a review and approval by the firm, the generated document is provided for information only. You are therefore solely responsible for your interpretation of the information, any advice you derive from it and any adaptations you make for your own business. You use the tool entirely at your own responsibility and risk.

Definitions :

The Publisher : The natural or legal person providing online public communication services.

The Website : All websites, web pages and online services provided by the Publisher.

The User : The person using the Website and its services.

Types of data collected

When you use the Websites, the Publisher may collect the following categories of data about its Users:

Civil status, identity and identification data…

Disclosure of personal data to third parties

Disclosure for advertising measurement

When you accept advertising cookies, certain measurement data is sent to Google to assess purchases and training enquiries resulting from our ads. The data involved and your choices are explained in the “Measuring purchases and CPF enquiries with Google Ads” section below. Data may also be disclosed where required by law, regulation or a decision of a competent regulatory or judicial authority.

Advance notice of disclosure to third parties in a merger or takeover

Obtaining prior opt-in consent to data transfers following a merger or acquisition

If we take part in a merger, acquisition or any other transfer of assets, we undertake to obtain your prior consent before transferring your

personal data and to maintain the level of confidentiality of your personal data to which you consented.

Collection of identity data

Customer management activities relating to

• contracts; orders; deliveries; invoices; accounting, particularly the management of customer accounts

• a loyalty programme within one or more legal entities;

• customer relationship management, including satisfaction surveys, complaints and after-sales service
• selecting customers for research, surveys and product testing (unless the individuals concerned have consented under the conditions set out in Article 6, these activities must not create profiles that could reveal sensitive data, such as racial or ethnic origin, philosophical, political, trade-union or religious views, sex life or health)

Compiling business statistics

Organising competitions, lotteries or other promotions, excluding online gambling and games of chance subject to approval by the French Online Gambling Regulatory Authority

Managing people’s reviews of products, services or content

Data aggregation

Aggregation with non-personal data

We may publish, disclose and use aggregated information (information about all our Users or specific groups or categories of Users, combined so that an individual User can no longer be identified or singled out) and non-personal information for industry and market analysis, demographic profiling, promotional and advertising activities, and other commercial purposes.

Combining data with personal information available on the User’s social media accounts.

If you link your account to an account with another service for cross-posting, that service may share your profile and login information with us, together with any other information you have authorised it to disclose. We may combine information about our other Users, groups and accounts with the personal data available about you.

Collection of identity data

Browsing without registration

You can browse the Website without registering or identifying yourself, and without providing identifying personal details such as your surname, first name or address. We do not record identifying personal data merely because you browse the Website.

Collection of identification data

Identifiers required for services and consent-based measurement

Login identifiers are used to access services and manage the contractual relationship. When you consent to advertising measurement, click, browser and conversion identifiers may also be used to link a purchase or CPF enquiry to an ad, as explained below.

Collection of device data

Technical data related to advertising measurement

With your consent, the Google Ads tag may send Google technical information such as your IP address, browser details, the page viewed, and advertising or click identifiers. This information is used to measure the effectiveness of our ads. Ad personalisation is disabled in this integration.

Cookies

How long preferences and cookies are retained

The cookies used by the website to remember whether you accept or reject advertising measurement expire after 30 days. You can change your choice at any time. The lifetimes of Google cookies and technologies are described in Google’s documentation on cookies. A conversion identifier is retained in the browser tab’s storage to prevent double-counting during the session; our system stops using it after 24 hours.

Purpose of cookies

Cookies may be used for statistical purposes, particularly to improve services provided to Users, by processing information about visit frequency, page personalisation, actions taken and information viewed.

The Publisher may place cookies on your device. A cookie records information about your use of the service, such as the pages you view and the date and time of your visit, which we may read on subsequent visits.

Advertising cookie preferences

The website uses cookies necessary for its operation and, only with your consent, the Google Ads measurement described below. You can select “Accept” or “Reject” in the banner. The “Change my preferences” button lets you change your choice. Rejecting advertising cookies does not prevent you from placing an order or submitting a training enquiry.

Measuring purchases and CPF enquiries with Google Ads

With your consent, Beauty By Emma uses Google Ads to identify which ads lead to purchases or CPF funding enquiries. The advertising measurement tag loads only after you accept.

When an order is paid, the tag may send its amount and currency, the IDs of the products purchased, their quantities and unit prices after discounts, excluding tax and delivery charges, together with an order identifier. For new orders linked to an ad click and your consent, our server also retains technical evidence of that choice, the click identifier, order reference, payment date, amount and currency. This information is made available to Google through a secure feed imported periodically, without requiring another visit to the order confirmation page. The same order identifier is used to prevent double-counting. When a CPF enquiry is successfully submitted through the form, we send the success event and a unique identifier. Opening the page or simply clicking the submit button does not count as a successful enquiry.

This system does not send Google the names, email addresses, telephone numbers, postal addresses or answers entered in forms. Enhanced conversions and ad personalisation are disabled in this integration. Google may nevertheless receive technical information and advertising identifiers, as explained above.

The linking cookie used by this system expires after 30 days. Measurement data retained on our server is regularly purged after this period. Withdrawing consent in the same browser blocks future exports associated with that choice; it cannot undo a transfer that has already taken place. You can contact us to exercise your rights regarding data already transferred.

For more information, see how Google uses data from partner websites. You can reject this measurement or withdraw your consent using “Change my preferences”.

Retention of technical data

Retention period for technical data

Technical data is retained only for as long as strictly necessary to fulfil the purposes described above.

Personal data retention and anonymisation periods

Retention of data for the duration of the contractual relationship

Under Article 6-5° of French Law No. 78-17 of 6 January 1978 on information technology, files and civil liberties, personal data undergoing processing is not retained beyond the time needed to fulfil the obligations defined when the contract was concluded or beyond the predefined term of the contractual relationship.

Retention of anonymised data after the contractual relationship ends or the account is deleted

We retain personal data only for as long as strictly necessary to fulfil the purposes described in these Terms of Use. After that period, it will be anonymised and retained for statistical purposes only, with no other use of any kind.

Deletion of data after deletion of account

Data deletion procedures are in place to ensure that data is effectively erased once the retention or archiving period needed for the specified or legally required purposes has expired. Under French Law No. 78-17 of 6 January 1978 on information technology, files and civil liberties, you also have a right to request deletion of your data at any time by contacting the Publisher.

Deletion of data after 3 years of inactivity

For security reasons, if you have not logged in to the Website for three years, you will receive an email asking you to log in promptly. Otherwise, your data will be deleted from our databases.

Account deletion

Account deletion on request

Users may delete their account at any time by requesting this from the Publisher OR, where available, using the account deletion option in their account settings.

Account deletion for a breach of the Terms of Use

If you breach any provision of these Terms of Use or any document incorporated into them by reference, the Publisher reserves the right, at its sole discretion and without prior notice, to terminate or restrict your use of and access to the services, your account and all Websites.

Procedure if the Publisher discovers a security breach

Notifying Users of a security breach

We undertake to implement appropriate technical and organisational measures to ensure a level of security suited to the risks of accidental, unauthorised or unlawful access to, disclosure, alteration, loss or destruction of your personal data. If we become aware of unlawful access to your personal data stored on our servers or those of our service providers, or unauthorised access resulting in any of these risks, we undertake to:

• Notify you of the incident as promptly as possible;

• Investigate the causes of the incident and inform you;

• Take reasonable and necessary measures to reduce any adverse effects and harm resulting from the incident

Limitation of liability

The commitments above concerning notification of a security breach do not, under any circumstances, constitute an admission of fault or liability for the incident.

Transfer of personal data abroad

Data processing by Google

Google may process measurement data on servers outside the European Union. Its processing and transfer arrangements, and the applicable safeguards, are described in Google’s Privacy Policy, particularly the “Data transfers” section.

Changes to the Terms of Use and privacy policy

When these Terms of Use change, we undertake not to substantially reduce the level of confidentiality without first informing the individuals concerned

We undertake to inform you of substantial changes to these Terms of Use and not to substantially reduce the confidentiality of your data without informing you and obtaining your consent.

Applicable law and dispute resolution

Arbitration clause

You expressly agree that any dispute arising from these Terms of Use, particularly their interpretation or performance, will be referred to arbitration under the rules of an arbitration platform chosen by mutual agreement, which you accept without reservation.

Data portability

The Publisher undertakes to return all data concerning you on request. This gives Users greater control of their data and enables them to reuse it. The data must be provided in an open, readily reusable format.