Privacy Policy

POLICY FOR THE PROCESSING OF PERSONAL DATA ON THE SITE AND IN THE SHOP

Version applicable from July 8, 2025

In application of Act n°78-17 of January 6, 1978 as amended relating to data processing, files and freedoms, the European Protection Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, the Company hereby informs any person accessing the services offered on the Site (the “User”) of its commitment to respect the confidentiality, integrity and security of any data that the User may communicate to it, in particular via the website www. goutalparis.com (the “Site”) or in store.

All personal data identifying the User, whether directly (notably surname, first name, postal address, e-mail address, telephone number) or indirectly, are considered as confidential data and are treated as such, subject to the evolution of the legal framework on the qualification of personal data (the “Personal Data”).

The terms used below beginning with a capital letter, in the plural as well as in the singular, have the meaning given to them in the GCU and/or GTC; other terms may also be defined in the present Privacy Policy.

1. Identification of the data controller

The data controller who collects and manages User data on the Site and in the store is AmorePacific Europe, a simplified joint stock company with capital of €63,050.00 whose registered office is located at 6, Rue Cambacérès 75008, Paris, with unique identification number 379 384 225 RCS Paris.

2. Personal data likely to be collected

When browsing the Site, visiting the stores and/or using the various services offered by the Company, where applicable, the User consents to the Company collecting the following categories of data:

- Personal identification and contact data: surname, first name, date of birth, postal address, e-mail address, telephone number, nationality, language;

- Connection and browsing data: IP address, password;

- Personal data such as geographical area of connection, day and time of Site consultation, services consulted and/or used.

The User undertakes to provide up-to-date and valid Personal Identification Data as part of the information requested on the Site, and guarantees not to make any false statements or provide any erroneous information.

3. How Personal Data is collected

The User consents to the Company collecting Personal Data during the following activities and interactions:

- Browsing the Site;

- Subscribing to alerts or newsletters;

- In-store form;

- Reserving a product in the boutique;

- Product waiting list registration;

- Any other voluntary interaction through the functionalities made available on the Site.

4. Legal basis for the collection and processing of Personal Data

Users' Personal Data is collected on the basis of the following legal grounds:

- The User's specific, free and informed consent (in particular for the creation of a Shop account, subscription to the newsletter and special offers from the Company's partners, etc.);

- Fulfillment of a legal obligation incumbent on the Company;

- The execution of a contract concluded between the Company and the User (notably for the execution of the Company's general conditions of use and sale);

- The legitimate interests of the Company (in particular to ensure the security of transactions).

5. Purpose of processing Personal Data

Compulsory Personal Data is data that is strictly necessary for the processing or requests of the User. In the absence of such Personal Data, the User is informed that certain services offered by the Company may not be provided. The compulsory nature of the information requested is indicated to the User at the time of collection.

Optional Personal Data is data collected by the Company in order to get to know the User better and improve his/her browsing experience on the Site and/or in the Shop.

Personal Data is collected and processed for the following purposes:

- Subscription to the Company's newsletter;

- Contact and assistance;

- Managing commercial relations and sending newsletters;

- Commercial prospecting;

- Service improvement.

Users are informed that, subject to their prior, specific and positive consent, the Personal Data transmitted may be transferred to the Company's commercial partners and/or to companies belonging to the same group as the Company, so that the latter may inform Users of their offers and services.

6. Retention period for Personal Data

Personal Data is kept by the Company for as long as is necessary to meet the aforementioned purposes, and in particular :

- Data relating to file management (order tracking, invoicing) are deleted or archived after a period of five (5) years following the end of the relationship with the Company;

- Data relating to customer and prospect relationship management (loyalty and canvassing operations, relationship follow-up, newsletter dispatch, etc.) are deleted or archived three (3) years after the end of the relationship with the Company.

Personal Data may also be kept for a further ten (10) years in the archive, with restricted access, in order to: (i) comply with the Company's legal and regulatory obligations; and/or (ii) enable it to assert a legal claim, before being permanently deleted.

7. Recipients of Personal Data

The User's Personal Data is intended for persons duly authorized to process it within the Company, in particular, and depending on the nature of the processing and the type of data, persons in the sales, customer, marketing, administrative and/or logistics and IT departments.

In order to carry out its activities and provide its services, the Company may have recourse to subcontractors who process the User's Personal Data on its behalf and on its instructions. In such cases, the Company may transfer Personal Data outside the European Union, in particular to Canada and/or South Korea.

The Company ensures :

- Subcontractors, employees or collaborators guarantee the same level of protection as the Company;

- they process personal data only for the purposes authorized by the purposes pursued, with the required discretion and security, and

- That, to this end, they provide sufficient guarantees as to the implementation of appropriate technical and organizational measures to ensure the security and confidentiality of the User's data.

Where the Company has recourse to subcontractors located in countries offering levels of protection that are not equivalent to the level of protection afforded to personal data in the European Union, the Company undertakes to comply with the following conditions.

8. Measures taken by the Company to ensure the security and confidentiality of Personal Data

The Company undertakes to process Personal Data in a manner that is:

- Lawful ;

- Fair ;

- Transparent;

- Proportionate ;

- Relevant;

- Within the strict framework of the purposes pursued and announced;

- For the length of time required to process the data;

- In a secure manner.

The Company implements and maintains appropriate technical and organizational measures to ensure the security and confidentiality of Personal Data, preventing it from being distorted, damaged or communicated to unauthorized third parties.

9. Users' rights to Personal Data

It is possible for the User, by simple written request, to access the Personal Data concerning him or her, to request their modification or rectification, or to demand that they no longer appear in the Company's database.

Under the right of access, the User is entitled, in accordance with Article 15 of the RGPD, to question the Company with a view to obtaining: (i) communication of the Personal Data concerning him or her in an accessible form; (ii) confirmation that his or her Personal Data is or is no longer being processed; (ii) communication of the purposes of the processing, the categories of Personal Data processed and the recipients to whom his or her Personal Data is communicated; and (iv) the period of retention of his or her Personal Data or the criteria used to determine this period.

In accordance with Article 16 of the RGPD, the right of rectification gives the User the right to require the Company to rectify, complete or update his Personal Data where it is inaccurate, incomplete, equivocal or out of date.

Under the conditions set out in Article 17 of the RGPD, the User has a right to erasure of his Personal Data, enabling him to request the Company to erase his Personal Data as soon as possible, in particular when it is no longer necessary with regard to the purposes for which it is collected.

The User also has the right to limit the processing of his Personal Data in the cases listed in Article 18 of the RGPD. He may thus request that his Personal Data be kept solely for the purposes of:

- Verifying the accuracy of the Personal Data he/she disputes ;

- To serve him in the context of establishing, exercising or defending his legal rights and this despite the fact that the Company no longer has any use for it ;

- Verify whether the legitimate reasons pursued by the Company prevail over his own in the event that he objects to processing based on the Company's legitimate interest;

- Fulfill his request to limit the use of his data, rather than to erase it, in the event that the processing of his data is unlawful.

The User has the right to withdraw consent at any time. Withdrawal of consent does not call into question the lawfulness of processing already carried out, based on consent given prior to such withdrawal.

In the circumstances provided for in Article 20 of the RGPD, the User has a right to the portability of his Personal Data, enabling him to recover from the Company the Personal Data he has provided, in a structured, commonly used and machine-readable format, for the purposes of transmitting it to another data controller.

In accordance with Article 21 of the RGPD, the User has the right to object, at any time, to the processing of his/her Personal Data for commercial prospecting purposes.

In accordance with Article 85 of Law 78-17 of January 6, 1978 on Data Processing, Data Files and Individual Liberties, the User has the possibility of defining particular directives relating to the retention, deletion and communication of his post-mortem Personal Data. These specific directives will only concern processing carried out by the Company and will be limited to this scope.

In order to exercise their rights of access, rectification, deletion, limitation, withdrawal of consent, portability and opposition referred to above, Users simply need to send their request:

- By e-mail to: customerservice@goutalparis.com; and/or

- By post to the following address CEVA LOGISTICS, Parc Logistique du Pont de Normandie P.L.P.N. 2, Port 5051 - BP 112, 76051 Le Havre, France.

The Company will provide the person exercising one of these rights with information on the measures taken, as soon as possible and in any event within one (1) month of receipt of the request. This period may be extended by two (2) months, depending on the complexity and number of requests. The Company may verify the person's identity before acting on the request.

If the Company does not act on the request, it will inform the person as soon as possible, and at the latest within one (1) month of receipt of the request, of the reasons for its inaction and of the possibility of lodging a complaint with a supervisory authority and of taking legal action.

These rights are exercised free of charge. However, in the event of a manifestly unfounded or excessive request, the Company reserves the right to: (i) demand payment of a fee to cover administrative costs; or (ii) refuse to comply with such requests.

10. Recourse in the event of violation of Personal Data

In the event of a breach of its Personal Data likely to give rise to a risk to its rights and freedoms, the Company will notify the CNIL of the breach as soon as possible, and, if possible, no later than seventy-two (72) hours after becoming aware of it. The Company will also inform the User, as soon as possible in accordance with the provisions of Article 34 of the RGPD.

Without prejudice to any other administrative or judicial remedy, Users who consider that the processing of their Personal Data constitutes a breach of the provisions of the legislation in force may lodge a complaint with a competent supervisory authority such as the Commission Nationale de l'Informatique et des Libertés (CNIL).

11. Request for information

For any questions concerning the processing of their personal data and the exercise of their rights, Users may contact the dedicated department by specifying in the subject of their request “RGPD information request”:

- By e-mail to: customerservice@goutalparis.com; and/or

- By post to the following address: CEVA LOGISTICS, Parc Logistique du Pont de Normandie P.L.P.N. 2, Port 5051 - BP 112, 76051 Le Havre, France[LB2].

12. Modification of the personal data processing policy

The Company reserves the right to modify the present personal data processing policy in order to comply with the obligations set forth in legislation protecting privacy or in order to adapt it to its practices. Consequently, the User is invited to consult it regularly in order to take note of any modifications and adaptations.