TRIMEX PTY LTD (“Clarins”, “we”, “us”, “our”), with registered office n° ACN 001 198 787, located at Level 15, 77 King Street, 2000 Sydney NSW, Australia is the data controller unless otherwise stated.

We may mainly collect the following personal data that could identify you directly or indirectly:

• information about your identity, in particular your gender, last name, first names, address, telephone numbers, email address, username and password, date of birth or age;
• information about your payment method, in particular your credit card number and the expiration date;
• information about our commercial transactions, in particular transaction numbers, history of your purchases, your request or your communications with our Customer Service team, your preferences and interests or information about one of our loyalty programs;
• content information such as photos, videos, ratings, reviews, comments;
• information about wellness or health (beauty concern, skin type, skin sensitivity, contraindications, undesirable effects reports, etc.) subject when applicable to your prior and explicit consent, in particular for cosmetovigilance or when asking for a beauty prescription Clarins or a treatment Clarins in one of our Spas
• information about your social media accounts (username, sex, profile picture, caption information, location, etc.), uploads and posts when you share content or use the tag @clarinsanz, use the hashtag #clarins or other hashtags we offer or when you interact with our chatbot;
• recordings of telephone conversations to offer the best quality of service;
• technical information, in particular your IP address or information about how your device navigates through our website or metadata when you interact with our chatbot including the date and time of visits;
• other information you provide when you contact us, or we have received from external providers.

In most cases we collect this personal data directly from you, such as when you make a purchase from us, visit one of our Services or contact us for any purpose. We may also collect personal data (e.g., email address or telephone number) from third parties to whom you have given your consent to share personal information about you with us.

The provision of the personal data indicated in this Policy is mandatory, unless otherwise stated. If you do not provide us with such personal data, we may not be able to provide you with some or all of our products or Services or enter into a contract with you.

We might collect your personal data for the following purposes:

We never sell nor rent your personal data to other companies for marketing or other purposes. For the purpose listed above and, on a need-to-know basis, we can share your personal data with:

• Authorised employees: Our employees might have access to your personal data on a need-to-know basis as part of their job.
• Other Clarins group companies: Clarins is an international group that operates in many countries. The personal data we are collecting about you will be used by us and might be communicated for the purposes stated in this Privacy Policy to other Clarins group companies on a case-by-case basis and as necessary and in particular to our parent company in France and to Clarins Pte Ltd in Singapore. This may involve your personal data being communicated outside of your jurisdiction of residence where it may be subject to access by local authorities in accordance with the laws of that jurisdiction. Each of those companies may also process and use your personal data for the purposes stated in this Privacy Policy independently and on their own behalf. To learn more about the Clarins group and its locations, visit our corporate website.
• Service providers: We may use service providers chosen for their expertise and reliability and acting as data processors, separate data controllers or joint controllers with us, to assist us notably with processing and fulfilment, secure payment, donations, customer service management, maintenance and technical development operations, ratings and reviews, virtual try on, beauty consultations, analytics, spam prevention, management of digital campaigns and affiliation, fraud prevention, etc. These service providers use your personal data only to the extent necessary to perform their services or on our behalf or to comply with legal requirements and we strive to ensure that your personal data is always protected.
• External advisors: We share your data with our external advisors such as lawyers and auditors if necessary for the purposes of our legitimate interest or for compliance with our legal obligations.
• Public authorities: We may also transmit your personal data to local authorities if required by law or as part of an investigation and in accordance with applicable regulations
• Other third parties: In case of a sale, merger, consolidation, liquidation, reorganization or acquisition.

Some of our service providers or Clarins group companies may be located outside of Australia or otherwise outside of the European Economic Area (EEA), including in countries that do not provide the same level of data protection as in your country of residence (e.g., the United States) and your personal information may be subject to access by local authorities in accordance with the law of the local jurisdiction. In such a case, we ensured that:

- we entered into appropriate data transfer agreements conforming to the Standard Contractual Clauses adopted by the European Commission;
- we rely on the Binding Corporate Rules (BCR) of our service providers approved by competent authorities, where applicable;
- such transfer is necessary for the purposes and based on the legal basis described in section 4 of this Privacy Policy;
- we have otherwise complied with other applicable legal requirements relating to the transfer.

In addition, where required, we have implemented supplementary measures (contractual, technical or organisational) to ensure the validity of the transfer.
To the extent provided by applicable law, you have a right to contact us for more information about the safeguards we have put in place to ensure an adequate protection of your personal data when it is transferred as mentioned above.

In most cases, personal data is stored electronically in a range of systems which are managed by us or third parties acting on our behalf. Clarins takes appropriate technical and organisational measures, in relation to the nature of data and risks, to preserve the security and confidentiality of your personal data and, in particular, to prevent them from being altered, disclosed or transmitted to any unauthorised parties.

This may include practices such as limited access by members of staff who, by virtue of their duties, are authorised to access data, contractual guarantees from third-party providers, privacy impact assessments when required, internal reviews of our practices and privacy policies and/or implementation of physical and/or systematic security measures (secure access, authentication process, backup, antivirus, firewall, pseudonymization, encryption, etc.).

We do not knowingly collect nor process personal data from minors.

If we are aware of such collection and processing, we will take immediately appropriate measures to contact the person and delete this personal data from our servers and/or those of our service providers.

Cookies or other trackers (e.g. pixel tags, unique identifier or fingerprint, etc.) designate all mechanisms aimed at storing information on your device, or accessing information already stored on your device.

When you visit our site for the first time, we notify you of the purpose of the trackers used as well as the identity of our partners so that you can make an informed decision in this regard.

We ask for your express consent before storing and/or reading trackers on your device. You are not required to consent to our use of cookies or trackers, however if you refuse to give your consent to the use of certain cookies or trackers which, except when their sole purpose is to allow or facilitate the use of our site or when they are strictly necessary to provide access to our website or to a service expressly requested by you, we may be unable to provide you with such access or services.

The trackers are mainly used on our site to:

- analyse your navigation, measure the perfomance of our site and improve the quality of our services;
- display personalized advertising according to your browsing and your profile;
- personalize the editorial content of our site according to your use or personalize the display of our products and services based on the browsing habits associated with your device;
- enable additional features on our site;
- monitor and prevent fraudulent activity, correct errors and ensure the security of our site.

You can change your preferences at any time:

- you can find out how to change your tracking preferences in the help menu of your browser;

- the platform Youronlinechoices allows you to refuse or accept the cookies used by our partners.

Please note that deactivating the cookies will not prevent the display of ads on your device but will only block technologies that allow us to tailor ads to your browsing habits and interests.

The consideration of your choices is based on a tracker. If you delete all cookies stored on your device (via your browser), we - or our partners - will no longer be able to retain your preferences.

By default, we retain your choices (both consent and opt-out) for a period of 6 months.

We may also use trackers in the e-mails we send to track certain of your behaviors such as opening the e-mail or clicking on a URL link to a page on our site in order to determine the date of our last interaction, measure the performance of marketing campaigns and provide you with personalized content. You can unsubscribe from our e-mails if you do not wish your browsing to be tracked in this way.

You can choose to use our hashtags to tag your content on social networks such as Instagram, Facebook or TikTok.

By using these hashtags, please note that your content may appear on our website and be used to refer to our products or Services.

We remind you that the information you share on social networks can be consulted, used and saved by others around the world, in particular in countries without legislation guaranteeing an adequate level of protection of your personal data as defined in your country of residence.

We also draw your attention to the fact that when you submit content using one of our hashtags, your use of social networks is exclusively governed by the general conditions of these social networks. We invite you to read it and to refer to it regularly.

If you no longer want your content to appear on our site, please remove it from the social network or stop using hashtags.

We strive to keep your personal data only for the time necessary for the purposes set out in this Privacy Policy and in accordance with the legal provisions in force.

As a general rule, we will keep your personal data for as long as is strictly necessary to manage our relationship with you and for the duration of the contract with you, and thereafter for a period of 6 years from the end of the contract or such other period as permitted by applicable law.

We may also keep some of your personal data for a shorter or longer period in the following cases:

- With respect to data processed in connection with the use of the Chat available on our website, your conversation data and metadata are deleted after you end your use of the Chat, unless the exchanges have been on topics that require the retention of such data as set out below.

- When you use the Virtual Try On feature on our Site, the photos you send us are kept for up to 24 hours and are deleted then after. If you wish to use the Virtual Try On again, you will have to take new photographs.

- Customer / prospect data will be kept for 3 years from the date of collection or after the last contact or the end of the commercial relationship, unless it is opposed or requested to be deleted by you. At the end of this 3-year period, we may contact you again in order to find out whether or not you wish to continue to receive marketing information. If no clear positive answer is given by you, your data will be deleted or archived in accordance with the provisions in force.

- Data on credit cards will be deleted after the transaction or archived for evidence purposes to the extent permitted by applicable law. Subject to your express consent, banking data may be kept until the expiration date of the credit card. We never store your visual cryptogram.

- Data necessary for carrying out analyses and business statistics can be kept for up to 5 years.

- Data to prove a right or a contract or kept under compliance with a legal obligation can be archived in accordance with the relevant statute of limitation provided by the applicable law.

Your personal data will be irreversibly erased or anonymised once the purposes has been fulfilled or the retention period has expired.

As a data subject and to the extent provided by applicable law, you may be entitled to:

• Right to access: You have the right to ask us to confirm whether we are processing your personal data and, if so, inform you of the characteristics of the processing(s) of your personal data, access them and obtain a copy.
• Right to rectification: You can ask us to correct or complete your personal data if they are incorrect or incomplete.
• Right to object: With respect to direct marketing, you can object to the processing activity by changing your preferences at any time in your account, by contacting us at the address below or by the following means:
  • For emails: by following the link "unsubscribe" contained in each of our emails
  • For calls: by indicating to the contacting person that you object to the processing of your personal data.

To exercise these rights, you must send us a request. In case of doubt, we may ask you to justify your identity by any appropriate mean:

- E-mailing a request to the Customer Service

- By writing to the following address:


TRIMEX PTY LTD

Level 15, 77 King St

2000 Sydney NSW

Australia

You will be informed of the actions to be taken as soon as possible and in any case no later than one month after your request. However, we reserve the right not to respond to unfounded or vexatious requests.

• Right to lodge a complaint: In accordance with the provisions in force, you can also file a complaint with the competent authority responsible for data protection or lodge an appeal if your data are misused. To identify the competent authority, please refer to Section 12 below. You may also contact us directly if you have any privacy-related concerns, using the contact details set out below. We will consider your complaint and determine whether it requires further investigation within a reasonable time. We will notify you of the outcome of this investigation and any subsequent internal investigation.

Please contact our contact point for data protection in Australia or in France should you have any questions, comments or concerns in connection with this Privacy Policy:

Appendix 1. Competent national Data Protection Supervisory Authority