Personal Data Protection Policy

We may collect or process the following types of Personal Data about you, depending on how you interact with us:

• Personal identification data: such as your first name, last name, postal address, e-mail address, telephone number, etc.
• Connection data: such as your IP address, your browser type, logs or other online identifiers relating to the terminal — computer, tablet or smartphone (the “Terminal”) — used to connect, as well as information on your use of the Site (such as the operating system of your Terminal, the type of browser you use, whether or not a proxy is used, the location of the Terminal deduced from your IP address, access times, pages visited, and the link that led you to access our Site).
• Commercial data: such as the products you have purchased, returned or selected, and your preferences in terms of products, areas of interest that you choose to communicate to us during your browsing and/or exchanges with our customer service.
• User content: such as the history of your communications with us (in case of contact with our customer service via the contact form or in case of a written complaint).

We remind you that we do not, directly or indirectly, collect Personal Data of persons under the age of 15, without prejudice to any local law setting a different minimum age. We therefore ask you not to provide us with Personal Data of persons who do not meet this criterion.

In the context of the services offered by the Site, we necessarily process your Personal Data for the following purposes:

• to enable you to use and benefit from our Site (searching for products, adding them to your basket, making purchases, managing the processing of your orders and their delivery, etc.), to pay online, and to use all other functionalities — on the basis of the performance of the contract;
• to manage user accounts (creation of a customer account, access to the service and deletion of accounts, etc.) — on the basis of the performance of the contract;
• to receive our commercial e-mails and our newsletter — on the basis of your prior consent if you are not already a customer, and on the basis of our legitimate interest in sending you commercial offers if you are already a customer of our products;
• to receive our technical e-mails (password changes, etc.) essential to the proper functioning of our Site — on the basis of the performance of the contract;
• to provide you with quality customer service (answering your questions, handling any complaints, etc.) — on the basis of the performance of the contract;
• to communicate with our customer service by e-mail or by telephone — on the basis of the performance of the contract or of legitimate interest;
• to guarantee and strengthen the security and quality of our services on a daily basis (statistics, data security, etc.) — on the basis of legal obligations binding on us, of the performance of the contract and of our legitimate interest in ensuring the proper functioning of our services;
• to carry out analyses and statistics in order to improve our services, optimise your user experience and better understand your needs — on the basis of our legitimate interest in monitoring performance and continuously improving our offers;
• to manage e-commerce fraud on our Site — on the basis of our legitimate interest or the performance of a contract.

Your Personal Data is collected directly from you when you use our Site, and we undertake to process it only for the reasons described above.

We remind you that for processing operations based on your consent, you may withdraw it at any time, in particular by objecting to receiving our commercial e-mails and our newsletter at the time of placing your order and in each of these e-mails.

Your Personal Data is retained for a period that does not exceed the time necessary for the purposes for which it was collected.

General case

Generally speaking, when you create a customer account online, your Personal Data is kept for as long as you use or order products or services that we offer via your customer account, plus the statutory limitation periods, which are generally 5 years.

However, this Personal Data and your customer account will be deleted (i) if you decide to delete it by sending us a request by e-mail to contact@yumay-beauty.com, or (ii) if you no longer use your online account (you have not made any purchase on the Site for 5 consecutive years, or have ceased to interact with us during that fifth year, in particular by not logging into your online customer account on the Site).

In certain cases, we may keep certain Personal Data concerning you for a longer period than indicated above, including after the closure of your customer account, by legal obligation, or if there is an outstanding issue concerning that customer account (such as a debit balance, or the existence of an unresolved claim or dispute). In such a case, the Personal Data necessary to resolve the issue or dispute will be kept for as long as the dispute lasts, within the limits of applicable rules on limitation periods.

Specific cases

• Newsletter subscription: the Personal Data relating to your e-mail address and/or used for electronic prospecting is retained until the end of your subscription to these e-mails or up to 3 years from your last interaction with us.
• Purchase history: the list of orders placed online is retained throughout the duration of activity of your customer account, until you request deletion of your account or after a period of inactivity of 36 months on the account. Your purchase invoices are retained for 10 years, even if you are no longer a customer.
• Connection data: this Personal Data relating to your identification and connection data, including your IP address, is retained for a period of one (1) year.

Upon expiry of the retention periods described above, the deletion of your Personal Data is irreversible and after this period we will no longer be able to communicate it to you.

Please also note that in the event of a dispute, we are required to retain all the Personal Data concerning you throughout the processing of the file, even after the expiry of the retention periods described above.

If you would like to obtain more details on the retention periods applicable to your Personal Data, you may contact us at: contact@yumay-beauty.com.

We never transfer or sell your Personal Data to third parties or commercial partners.

All of your Personal Data is used exclusively by our teams and our processors (IT service providers or our providers in charge of payment for your orders).

More specifically, we only communicate your Personal Data to persons duly authorised to use it in order to provide you with our service, such as our IT department or our department in charge of customer relations.

Your Personal Data is also transferred to our IT service providers, which are used solely to operate our Site, such as our hosting provider or our technical e-mail sending tool.

We specify that we check all of our processors before engaging them in order to ensure that they scrupulously comply with the rules applicable to the protection of personal data.

Finally, we may be required to communicate your Personal Data to third parties where such communication is required by law, by a regulatory provision or by a judicial decision, or if such communication is necessary to ensure our protection and the defence of our rights (for example, to our external agents and advisers in case of debt recovery).

The Personal Data processed by our Site is exclusively hosted on servers located within the European Union.

The regulations applicable to the protection of Personal Data grant you specific rights that you may exercise at any time and free of charge, in order to control the use we make of your Personal Data.

• Right of access and right to obtain a copy of your Personal Data, which you may send to us under the conditions described below, or, if you have an online customer account, you may access your Personal Data in the settings of your account.
• Right to rectification of your Personal Data that is inaccurate, out-of-date or incomplete, which you may send to us under the conditions described below, or, if you have an online customer account, you may access your Personal Data in the settings of your account.
• Right to withdraw consent where the processing of your Personal Data is based on your consent — you may withdraw it at any time.
• Right to object to the processing of your Personal Data on the basis of legitimate interest, on grounds relating to your particular situation, unless we demonstrate that there are legitimate grounds for the processing which override your interests, or for the establishment, exercise or defence of legal claims.
• Right to restriction of the processing of your Personal Data, which allows the processing of your Personal Data to be suspended pending a verification (verification of the accuracy of the information, of the lawfulness of the processing, of our legitimate grounds in the event of a challenge to the legitimacy of a processing operation, except where processing is necessary for the management of subscribed services), or where we no longer need your Personal Data for the purposes of its processing but you still need it in case of the establishment, exercise or defence of your legal claims.
• Right to request the erasure (“right to be forgotten”) of your Personal Data where its retention is no longer necessary in light of the purposes for which it was collected or otherwise processed; where you withdraw the consent on which the processing was based and there is no other legal basis for processing your Personal Data; where you object to the processing of your Personal Data and there is no compelling legitimate reason for processing it; where your Personal Data has been unlawfully processed; or where your Personal Data must be erased to comply with a legal obligation.
• Right to portability of your Personal Data, which allows you to retrieve all or part of your Personal Data in a structured, machine-readable form, so as to store it or transmit it easily from one information system to another.
• Right to give directives, at any time, on what happens to your Personal Data after your death, either personally or through a successor in title.
• Right to lodge a complaint with the French data protection authority (Commission Nationale de l’Informatique et des Libertés — “CNIL”). You may contact the CNIL at any time to lodge an online complaint at https://www.cnil.fr/fr/adresser-une-plainte, by telephone on +33 (0)1 53 73 22 22, or by post at the following address: “Service des plaintes de la CNIL — 3 place de Fontenoy, TSA 80751, 75334 Paris Cedex 07”.

In order for a request to be processed, it must be made directly by you to the following address: contact@yumay-beauty.com.

Any request that is not made in this manner and/or is incomplete cannot be processed.

Requests cannot come from anyone other than yourself. We may therefore ask you to provide proof of identity in case of doubt as to the identity of the requester.

We will respond to your request as soon as possible.

We implement all the technical and organisational means required to ensure the security of your Personal Data, in particular to combat any risk of destruction, loss, alteration, unauthorised access or disclosure of your Personal Data.

We may amend our Policy at any time to adapt it to new legal and regulatory requirements, or to keep you informed of changes relating to the processing of your Personal Data that we may implement.

We advise you to always read the most recent version of this Policy whenever you interact with us, by consulting it in the “Privacy Policy” section at the bottom of the Site.

The Site may contain links to third-party websites. We have no control over the content, the personal data protection policy or the actions of these third-party websites.

The use of information you may provide to third parties on other sites, or that such third parties may collect on other websites, is not governed by this Policy.

You should carefully review the personal data protection policy of third-party websites and contact the publishers of those sites if you have any questions about how they use information concerning you.

We cannot be held liable for any third party that fails to use information concerning you in accordance with that third party’s personal data protection policy, or in accordance with any contractual or legal obligation to which that third party is subject.

For cookies, please consult our dedicated “Cookie Information” section accessible on our Site.

You may contact us at any time, free of charge, to obtain more information or details on how we process your Personal Data, by e-mail at contact@yumay-beauty.com, by telephone on +32 (0)4 94 62 22 15, via the “Contact us” section of the Site, or by post addressed to ELM MANAGEMENT, Avenue Louise 428 box 34, 1050 Brussels, Belgium.