Privacy and Cookie Policy

Effective Date: June 10th, 2020

We respect your concerns about privacy and value the relationship we have with you. This Privacy Policy describes the types of personal data we collect about our customers, how we use this information, with whom we share it, and the rights of our customers regarding our use of the information. We also describe the measures we take to protect the security of the information, how long we retain it and how our customers can contact us about our privacy practices and how to exercise their rights.

For the purposes of applicable data protection laws, the data controller is the legal entity located in the country where you live (i.e., where your billing address is). The details of the legal entities acting as data controller for the purposes of this Privacy Policy are indicated below in the section “How to Contact Us”. Click on one of the links below to jump to the listed section:

• Information We Collect
  • Information You Provide
    • How We Use the Information
    • Legal Basis for Our Use of the Information
  • Information We Collect by Automated Means
    • Technologies We Use
      • Internal Cookies Essential for the Site to Work
      • Third Party Web Analytics Cookies
      • Third Party Targeted Advertising Cookies
      • Third Party Cookies Intended to Improve the Interactivity of the Site
      • How can you manage your cookies?
• Targeted Advertising
• Information We Share
• Your Rights And Choices
• Data Transfers
• Processing of personal data of Child
• Data Retention
• How We Protect Personal Data
• Links To Other Websites
• Updates To Our Privacy Policy
• Data Subject’s rights
• How To Contact Us

Information We Collect

We may obtain personal data about you from various sources. We collect this information when you provide it at one of our stores, or on our website, or via our social media pages, or when you download one of our mobile applications (either via Apple iOS or Android) onto your mobile device, or at one of our events. Our products are available for sale at certain third party retailers. Unless otherwise indicated at the time that you provide your personal data, any personal data collected by these retailers is not provided to us. This Privacy Policy does not address any data collection by our retail partners. When you visit this site, our social media pages, or use services or features of one of our mobile applications, we also collect certain information about your device or usage by automated means, including using technologies such as cookies, web server logs and web beacons.

Information You Provide

You may provide personal data to us in a number of ways, such as when you participate in an offer or promotion, or when you make a purchase on our site or in our stores, via our social media pages or through one of our mobile applications. The types of personal data you provide to us may include:

• Contact information (such as name, postal address, email address and mobile or other phone number)
• Age or date of birth
• Gender
• Username and password, nickname/screen name
• Payment information (such as your payment card number, expiration date, and card security code)
• Shipping and billing information (such as delivery address, and billing address)
• Purchase history
• Product preferences
• Your skin type / skin condition
• Your hair type
• Your physical characteristics and your skincare concerns
• Contact information for friends, family or other people you would like us to send a message to on your behalf (please ensure that you only submit contact information of individuals with whom you have a personal or family relationship and who have consented to receive messages from you or us)
• Information or content you provide (such as photographs, videos, reviews, articles, questions, survey responses and comments)
• Information provided to us through social media networks or one of our mobile applications when you visit our social media pages or use one of our mobile applications (such as your name, profile picture, likes, location, friend list and other information described on the social media network or application sign-up page, or your geo-location details when using one of our mobile applications)

How We Use the Information

We will use the information you provide to:

• Send you promotional materials or other communications if you so elect
• Provide the products or services you (or your company) have requested and operate features on our site
• Process your payment card transactions and/or gift card transactions
• Create and manage your online account, including access to your online and in-store purchase history
• Create a profile about you based on the information you provided to us in order to tailor our advertisements to your interests, find your appropriate skin or hair care routine and manage the effectiveness of our marketing efforts
• Assist with product selection and replenishment
• Chat with you or respond to your inquiries
• Post your product reviews
• Tailor ads displayed to you on our site and elsewhere to your interests and history with us
• Communicate with you about, and administer your participation in, special events, contests, sweepstakes, loyalty programs, surveys and other offers
• Operate and communicate with you about our social network pages or mobile applications
• Operate, evaluate and improve our business (including developing new products and services; enhancing and improving our services; managing our communications; analyzing our products; performing data analytics and performing accounting, auditing and other internal functions)
• Comply with applicable legal requirements, relevant industry standards and our policies

We also may use the information in other ways for which we provide specific notice at the time of collection. The information collected is necessary for the purposes set forth above. Without this information, you may not be able to take advantage of some of our products or services.

Legal Basis for Our Use of the Information

We will use the information you provide for the above purposes if:

• it is necessary to perform a contract to which you are party (e.g., to process your payment and deliver the products you have ordered); or
• we have obtained your consent; or if
• we have a legitimate interest to do so (including a legitimate interest in performing marketing activities, research activities, data analytics, and internal administration functions, processing and enforcing legal claims, and conducting our business in compliance with all applicable laws, relevant industry standards and our policies).

Information We Collect by Automated Means

When you visit this site, view or click on our online advertisements (including our advertisements on third party websites), visit our social media pages or download and use one of our mobile applications (if applicable), we also collect certain information about your usage or device by automated means or by using technologies such as cookies, web server logs and web beacons. For example, if you use one of our mobile applications, we may collect your IP address, your unique device identifier (or other device identifier) and/or geo-location data in order to offer you certain features or functionalities within that mobile application. As set forth in more detail below, we may also collect information about your usage and browsing habits using various web-based technologies.

For your convenience, our mobile applications (if applicable) may also include functionality that allows you to remain logged in to the application so that you do not have to reenter a password each time you want to access the application. IF YOU CHOOSE TO REMAIN LOGGED IN, YOU SHOULD BE AWARE THAT ANYONE WITH ACCESS TO YOUR MOBILE DEVICE WILL BE ABLE TO ACCESS AND MAKE CHANGES TO YOUR MOBILE ACCOUNT AND MAY BE ABLE TO MAKE PURCHASES THROUGH YOUR ACCOUNT. For that reason, if you choose to remain logged in to the application on your mobile device, we strongly recommend you enable the Passcode Lock security feature on your mobile device to protect against unauthorized access to and use of your mobile device and your account in the application.

Technologies We Use

Cookies are small text files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings in your browser.

The following types of cookies are set on this site.

Internal Cookies Essential for the Site to Work

We use first-party cookies to help the site work in the best possible manner. You can opt out of receiving these cookies and disable them by adjusting your browser settings. Please note, however, that without these cookies, your user experience may be impacted.

In conjunction with obtaining information through cookies, our web servers may log details such as your operating system type, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone in which your device is located. The web server logs also may record information such as the address of the web page that linked you to our site and the IP address of the device you use to connect to the Internet.

To control which web servers collect this information, we may place tags on our web pages called “web beacons.” These are computer instructions that link web pages to particular web servers and their cookies.

Third Party Web Analytics Cookies

We may use third party web analytics services on this site, such as those of Coremetrics, and/or Adobe Site Catalyst and/or Google Analytics. The service providers that administer these services use technologies such as cookies, web server logs and web beacons to collect information (such as IP address) and use that information to help us analyze how visitors use the site. These vendors may use cookies placed on this site (such as the Google Analytics cookie) and cookies placed on third-party web sites (such as Google advertising cookies), or other third-party identifiers, together, to analyze our site visitors. When you first visit our site, a cookie banner will inform you of the use of these analytics technologies. They will only be used if you accept them or if you continue using this site.

You may deactivate the ability of these analytics services to analyze your browsing activities on this site. Adjusting your cookie preferences may disable certain functionality on this site, as described below. To learn more about web analytics service, and to exercise your choice with respect to their collection of information on this site:

• For Coremetrics, please click here;
• For Adobe Site Catalyst, please click here;
• To disable Google Analytics, please download the browser add-on for the deactivation of Google Analytics provided by Google at http://tools.google.com/dlpage/gaoptout?hl=en . To learn more about privacy and Google Analytics please consult the Google Analytics overview provided by Google at: http://www.google.com/intl/en/analytics/privacyoverview.html.
• We may implement certain Google Analytics Advertising Features (including Remarketing with Google Analytics; Google Display Network Impression Reporting or Google Analytics Demographics and Interest Reporting). You can opt-out of the Google Analytics Advertising Features through Google Ad settings or by visiting https://tools.google.com/dlpage/gaoptout/ . We will use the data provided by these features as described under “How We Use the Information We Collect”.

Third Party Targeted Advertising Cookies

We also may contract with third-party advertising networks that collect IP addresses and other information through the use of cookies, web server logs and web beacons on our websites and emails; on third-party websites and emails; and on our advertising placed on third-party websites. They use this information to create a profile about you and provide advertisements about products and services tailored to your interests (including for companies not affiliated with us). You may see these advertisements on our websites and other websites. This process also helps us manage and track the effectiveness of our marketing efforts. When you first visit our site, a cookie banner will inform you of the use of these marketing technologies. They will only be used if you accept them or if you continue using this site. You may change your cookie settings at any time by clicking here and following the opt-out instructions of these advertising networks.

To learn more about interest-based advertising, visit the Digital Advertising Alliance at www.aboutads.info/choices or the Network Advertising Initiative at www.networkadvertising.org/choices.

Third Party Cookies Intended to Improve the Interactivity of the Site

This site may also support certain third party services, including social sharing buttons facebook, twitter, pinterest and instagram, tweet lists (twitter) and videos posted on the site (Youtube). These features use third party cookies that are directly set on your device by these services. When you first visit our site, a cookie banner will inform you of the use of these cookies. They will only be used if you accept them or if you continue using this site.

Manage Site Cookies

How can you manage your cookies?

You have the right to choose whether or not to accept cookies used for certain purposes on the Site. You can opt out of receiving these cookies and disable them as indicated below. Please note, however, that without these cookies, your user experience may be impacted.

Most browsers accept cookies by default. You may also be able to change the settings to have your browser refuse certain cookies or notify you before accepting cookies. The procedures for changing your settings and cookies differ from browser to browser. If necessary, use the help function on your browser or click on one of the links below to go directly to the user manual for your browser.

• Internet Explorer
• Mozilla Firefox
• Google Chrome
• Safari

To find out more about cookies, visit www.allaboutcookies.org.

Targeted Advertising

We may also use third-party platforms, including platforms operated by social networks, such as Google, Facebook and Pinterest, to show you interest-based ads. We may convert your email address, telephone number or other information into a unique value which can be matched by those third parties with a user on their platform or with other data they may have collected from you. This matching allows interest-based ads to be delivered on those platforms. These platforms may have their own privacy notices or policies, which we strongly suggest you review.

Information We Share

We do not rent lists, sell or otherwise disclose personal data we collect about you, except as described here. We may share your personal data with:

• Our affiliates for the purposes described in this Privacy Policy.
• Service providers who perform services on our behalf based on our instructions. We do not authorize these service providers to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements. Examples of these service providers include entities that process credit card payments, fulfill orders, and provide web hosting and marketing services.
• Other third parties with your consent.

In addition, we and our affiliates and other service providers may disclose information about you (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government officials, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

We also reserve the right to transfer personal data we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use personal data you have provided to us in a manner that is consistent with our Privacy Policy. Following such a sale or transfer, you may contact the entity to which we transferred your personal data with any inquiries concerning the processing of that information.

Push notifications and in-app alerts and updates

When you download one of our mobile applications (if applicable), we may provide you with the option to opt in to receive push notifications from us on your mobile device in connection with that mobile application. These push notifications may include promotional communications regarding our products and services. You may, after downloading the applicable mobile application, opt out of receiving push notifications by adjusting the settings on your mobile device. Opting out of push notifications will not affect other communications you receive from us, such as email communications. You also may receive alerts and updates within our mobile applications regarding our products and services or your accounts with us. To opt out of receiving these alerts and updates, you may uninstall the applicable mobile application from your mobile device.

Your Rights and Choices

You have certain rights and choices in connection with the personal data we collect from you. To update your preferences, ask us to remove your information from our mailing lists or submit a request, please submit a request through our Privacy Request Portal.

• Email Opt-Out

You can at any time tell us not to send you marketing communications by email by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below. You also may opt out of receiving marketing emails from us by submitting a request through our Privacy Request Portal.

• Postal Mail Opt-Out

You can ask us to stop sending you marketing communications by postal mail by following the instructions that may be included in a particular promotion. You also can request that we refrain from sending you promotional postal mail by submitting a request through our Privacy Request Portal.

You can also choose not to receive text messages by submitting a request through our Privacy Request Portal.

• Withdrawing Consent

You may also withdraw any consent you previously provided to us at any time with effect for the future by submitting a request through our Privacy Request Portal. This will not affect the lawfulness of our use of your information based on your consent before its withdrawal.

• Reviewing, Updating or Deleting Personal Data or Restricting or Objecting to their Use

Subject to applicable law, you have the right to request access to and rectification or erasure of the personal data we maintain about you, or to request the restriction of our use of this information, as appropriate. You also have the right to object at any time to the use of your personal data for direct marketing purposes, including profiling related to direct marketing. For all other purposes, you may object at any time to the use of your personal data, on grounds relating to your particular situation, in accordance with applicable law. These rights may be limited in some circumstances under applicable law. We may take reasonable steps to verify your identity before granting access or making corrections. You may exercise these rights by submitting a request through our Privacy Request Portal.

• Other Rights

Subject to applicable law, you have the right to receive, in a structured, commonly used and machine-readable format, the personal data that you have provided to us about you, with your consent or based on a contract to which you are party. You also have the right to have this information transmitted to another data controller, where it is technically feasible. You may exercise this right by submitting a request through our Privacy Request Portal.

• Geo-Location Information

When you use one of our mobile applications, we may ask you for your geo-location. You may choose not to share your geo-location details by adjusting your mobile device’s location services settings. To decline from sharing your geo-location details, follow the instructions on your mobile device on changing the relevant settings; otherwise, please contact your service provider or device manufacturer.

Data Transfers

We may transfer the personal data we collect about you to our affiliates and third party service providers to countries other than the country in which the information was originally collected (including the United States), where necessary to fulfill the purposes described in this Policy and your personal data may be processed and stored outside of your country of residence. Those countries may not have the same data protection laws as your country of residence and your personal data will be subject to applicable foreign laws. When we transfer your information to other countries, we will protect that information in the manner described in this Privacy Policy. We have also implemented appropriate safeguards to ensure such a level of data protection when transferring your personal data, including the conclusion of data transfer agreements incorporating the European Commission’s Standard Contractual Clauses, or other applicable data transfer mechanisms. You may obtain a copy of these data transfer mechanisms by submitting a request through our Privacy Request Portal.

Processing of personal data of Child

If you are under 18, you can visit the website under the supervision of the holder of parental responsibility. Personal Data related to persons under the age of 18 will not be subject to any voluntary processing activity and, for this reason, they are not allowed to perform and/or complete the registration procedure. If personal data of child had been accidentally processed, we will delete these data from our databases.

Data Retention

We keep the information you provide for the duration of our relationships, plus a reasonable period in order to be able to run regular deletion routines or to take into account the applicable statute of limitation period or if required under mandatory applicable law. If you wish to receive marketing communications, we will keep the information necessary to send you these communications following the end of our customer relationship or following their collection, if you are a prospective customer. For additional information about data retention policies, please submit a request through our Privacy Request Portal.

How We Protect Personal Data

We maintain appropriate technical and organizational safeguards to ensure an appropriate level of security of your personal data, in particular to protect your personal data against accidental unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. However, no security system is perfect and we cannot promise that information about you will remain secure in all circumstances, including the security of your data during transmission to us or the security of data on your mobile device.

Links To Other Websites

Our website may provide links to other websites for your convenience and information. These websites may operate independently from us. Linked sites may have their own privacy notices or policies, which we strongly suggest you review if you visit any linked websites. To the extent any linked websites you visit are not owned or controlled by us, we are not responsible for the sites’ content, any use of the sites, or the privacy practices of the sites.

Updates To Our Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in our privacy practices. We will post a prominent notice on our website to notify you of any significant changes to our Privacy Policy and indicate at the top of the Policy when it was most recently updated.

Data Subject’s rights

With reference to your Personal Data, we inform you that you can exercise the following rights provided by articles from 15 to 22 of the EU Regulation 2016/679:

1. Access to the following information:

   a. Purpose of the processing operations,

   b. Categories of personal data in hand;

   c. Recipients or categories of recipients to which such personal data have been or will be communicated, in particular, if destined to third countries or international organizations;

   d. The existence of the Data Subject’s right to ask the Data Controller the rectification or cancellation of the personal data or the limitation of the processing of his/her personal data or of opposing their processing;

2. Rectification, that means:

   a. Correction of wrong personal data without unjustified delay;

   b. Integration of incomplete personal data, even providing an additional declaration;

3. Cancellation of personal data without unjustified delay, if:

   a. The data are no more necessary for the purposes for which they have been collected or processed;

   b. A revocation of the consent is submitted and there is no further legal foundation for the processing;

   c. You oppose the processing and there’s no prevailing legitimate reason to carry out the processing;

   d. The personal data have been processed illegally;

   e. The personal data have to be cancelled to meet a legal obligation;

   f. The personal data have been collected for the service offer of the information company;

4. Limitation of the processing:

   a. In case you question the exactness of personal data, for the period needed to the Data Controller to verify the exactness of such data;

   b. When the processing is unlawful, and the Data Subject opposes to the cancellation of personal data and asks a limitation of their employment;

   c. When the personal data are needed to the Data Subject for the ascertainment, exercise or defence of a right before the court, even if the Data Controller doesn’t need them anymore for the purposes of the processing;

   d. If you oppose the processing by virtue of the opposition right;

5. Receiving a notification in case of rectification or cancellation of personal data or processing limitation;
6. Data portability, that is the right of receiving your personal data in a structured and commonly used format - readable from automatic devices - and the right of transmitting such data to another Data Controller, in case:

   a. The processing is based on the Data Subject’s express consent for one or more specific purposes or is carried out by virtue of a contract signed with the Data Subject, and

   b. The processing is carried out with automated devices;

7. Opposition at any moment, for reasons connected with your particular situation, to the processing of your personal data.

In case you think that the rights here specified have not been recognized, you can submit a claim to the Supervisory Authority.

In order to exercise the above-specified rights, you can contact the Data Controller, at the addresses indicated in the following section “Contact us”.

How To Contact Us

If you have any questions or comments about this Privacy Policy, or if you would like to exercise your rights, you can submit a request through our Privacy Request Portal, or contact our Data Protection Officer by sending us a letter to the legal entity located in the country where you live, as indicated below, or by emailing us at privacy@elceurope.com together with a copy of an identity document, or contact us by phone at the number 800110330.

We may take reasonable steps to verify your identity before granting access or making corrections.

These are our local country affiliates:

 

Your billing address country	Our local affiliate acting as a data controller
France	Estée Lauder Companies 48 rue Cambon 75001 Paris – France
Germany	Estée Lauder Companies GMBH Domagkstrasse 10 D-80807 Munich – Germany
Italy	Estée Lauder S.r.L. Via Turati 3 Milano 20121 – Italy
Netherlands	Estée Lauder BV Safariweg 50 (2e verd.) 3605 MA MAARSSEN, NEDERLAND
Switzerland	Estée Lauder GmbH, Hardturmstrasse 11 8005 Zürich - Switzerland