Privacy Policy

Just like your skin, protecting your privacy is important to us. When you browse our site or purchase our products, your personal data may be shared with us directly or indirectly. That personal data is precious, and it is your own business. For that reason, we only collect and processes your personal data in a transparent, fair and lawful way.

 

About BIODERMA

 

Bioderma is operated by NAOS Group (UK) Limited having its registered offices at Dickens House, 1 Fetter Lane, EC4A 1BR London, UK, and registered with the Registrar of Companies for England and Wales under number 08975311 (NAOS). We are the data controller for the purposes of the personal information processed in accordance with this Policy.  

 

You can contact us regarding this Privacy Policy by email to support@uki.naos.com. 

 

At NAOS, we are committed to keeping your personal information safe and secure, and handling it in accordance with our legal obligations. This Policy sets out in detail the purposes for which we process your personal information, what rights you have in relation to that information, who we share it with and everything else we think is important for you to be aware of.

 

Please make sure you check it carefully and if you don’t agree with it, then you shouldn’t use our Website or access or products or services. This is because by accessing our Website, products and services, you confirm that you accept the way in which we process your personal information. This Policy forms part of our Website Terms and Conditions (together the “Terms”), and capitalised words and phrases in it have the same meaning as those in our Terms.

 

In this Policy, unless the context requires a different interpretation: 

 

1. the singular includes the plural and vice versa;
2. references to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices of this privacy policy;
3. a reference to a person includes firms, companies, government entities, trusts and partnerships;
4. "including" is understood to mean "including without limitation";
5. reference to any statutory provision includes any modification or amendment of it;
6. the headings and sub-headings do not form part of this privacy policy.

1.      About this Privacy Policy

This Policy applies to the personal information we collect about you through our Website through delivery of our products and services, by telephone, by post, through our social media platforms, from third parties and when you otherwise communicate with us. “Personal data” refers to information that directly or indirectly identifies an individual. This includes, for example, your name, email address and telephone number, as well as information on your buying habits, your skin type, etc. This Policy applies to all personal data that you provide to us or that we collect during your visits to one or more of our Websites or when purchasing our products.

This Policy may change from time to time and, if it does, the up-to-date version will always be available on our Website. We will also tell you about any important changes to our Privacy Policy.

 

2.      Reasons for personal data collection

Personal information means any information about an individual from which that individual can be identified. There are various reasons and purposes for why we may collect your personal information, for example:

·       To provide services and offers on our Website(s) (e.g. account creation, skin diagnosis, etc.);

·       To manage your participation in our loyalty programme(s) and grant you benefits for this;

·       To process your product purchases on our Website(s) (e.g. order management, tracking, shipping, etc.) and handle customer relations following your purchase(s);

·       To ensure the functionality and content of our Website(s) and services to better meet your needs and requests;

·       To better understand you and segment data based on your needs and preferences, allowing us to send personalised information, advice and offers;

·       To respond to your enquiries and provide personalised advice, particularly through our customer service channels (contact forms, social media, phone, etc.);

·       To collect your feedback on our products;

·       To conduct audience analyses and statistical studies, such as measuring websites visits, user activity, subscription rates to our services and the effectiveness of promotional offers;

·       To manage cosmetovigilance (handling reports of adverse effects related to our products, conducting safety studies and implementing corrective actions if necessary);

·       To organise product testing and contests;

·       To carry out targeted communications via email or advertising banners on partner sites (analysing the personal data you provide or data related to your visits on our Website(s) to assess your preferences, needs and interests and display or offer tailored content);

·       If you have given your consent, to send you postal or electronic communications (email, SMS/MMS) about our products, services and activities, which may be personalised;

·       To detect fraudulent behaviour on our Website(s) and manage disputes;

·       To ensure the security of our Website(s) and services;

·       To manage our social media pages.

 

 

3.      Data we collect, when we collect it and how long we retain it for

We collect and process your personal data in a fair and lawful manner. We also ensure that the data, if necessary, is updated so that it does not become outdated. This data may be collected (a) either directly from you, for example, when you complete our data collection forms on our Website(s) (e.g., registration form, contact form, etc.), or (b) indirectly, for example, through our partners (e.g., advertising networks, etc.).

The following shows a breakdown of information we process about you, how we collect it, and how long we retain it for, along with the legal basis we have for doing so. We define the retention periods for your personal data based on the duration necessary to fulfil the purposes of the data collection. Once these purposes have been achieved, we delete your data, unless certain legal obligations require us to retain it.

If you would like further information, please contact us at support@uki.naos.com.

 

Moment of collection	Categories of data collected	Retention period	Legal bases
Your complete a purchase through our Website(s)	We and/or our subcontractors collect and process: -your names, addresses, email addresses, dates of birth, phone number and other information we collect for the purpose of completing purchases of our products and services.	We are required by law to retain transaction data for 6 years for tax and contract claim requirements	Contract: For performance of our contract to process your order
You browse on one of our Websites or on a third party partner’s website	We and/or our subcontractors collect certain data through cookies or similar technologies:   -your technical connection and navigation data (e.g., your IP address, browser, device information, analytical data, number of clicks and pages viewed, time spent on the Website(s) or on specific Website(s) elements; language and country of consultation; geolocation by city, transaction number, identifiers, clicked ads, etc.).   For more information, please refer to our Cookie Policy.	13 months from the date of cookie placement or other similar technologies. Some third-party partners may retain your personal data for a longer period. We encourage you to review their privacy policies. Your cookie preferences will typically be saved for 6 months. However, our cookie management partner will retain proof of your consent(s) for 5 years.	Legitimate interest: For strictly necessary cookies required for the functioning of our Website(s).   Consent: For cookie categories that require your prior consent before being set.
Your interact with our Automated Services on our Website(s)	We and/or our subcontractors collect and process:   -the data you input directly through the Automated Services, which may include personal characteristics and preferences; -Outputs from your Use of Automated Services	For so long as you retain an account with us ad otherwise for the duration necessary for delivering the Automated Services to you.	Consent: Consent granted to process personal data for use of the Automated Services.
You join our loyalty programme(s), create an account, use your account or complete your profile, including to set preferences for marketing communications	We and/or our subcontractors collect and process:   -your identification data (e.g., name, surname, email address, postal address, etc.); -Data related to your consumption habits; -Data related to your skin type (e.g., oily, dry, etc.) -Your marketing preferences	3 years from the later of creation of your account or your last activity on the account, or in the case of your preferences, so long as you retain an account with us.	Legitimate interest : To provide you with the requested service
You subscribe to one of our commercial communications	We and/or our subcontractors collect and process:   -Your identification data (e.g., name, surname, email address, etc.)   We also use data related to your consumption habits, preferences, interests, skin type, etc. only if we have previously collected such data through other means (e.g., skin diagnosis, past purchases, etc.). This enables you with personalised content tailored to your skin and needs.	Until you unsubscribe or for a maximum of 3 years from the date of data collection or your last interaction with us.	Consent : To send you commercial communications.
You participate in a customer survey promotional game	The data that we and/or our subcontractors collect and process depend on the specific customer survey or  promotional game:   -your identification data (e.g., name, surname, postal or email address, etc.); -your social media profile (if the customer survey or promotional game is conducted on one of our social media pages, if you use a social media account to log in or if you voluntarily provide it to us); -your consumption habits; -your interests; -date related to your skin type (e.g., oily, dry, etc.).	Duration necessary for managing the promotional game	Performance of a contract : To provide the requested service (contest participation)
You report an adverse reaction or accident following the use of one of our products   In accordance with legal requirements, we are required to monitor and record adverse reactions related to the use of our products and to promptly report all serious adverse reactions to the competent authority.	When you, a close relative or a healthcare professional report an adverse reaction to our customer and consumer service, we collect and process:   -your identification data (e.g., name, surname, email address, phone number, etc) -a description of the adverse reaction experienced; -your consumption habits (e.g., the product used); -personal life data (e.g., if you are reporting an adverse reaction or accident experienced by a family member)   This data allows us to forward your case to our partner so that they may contact you to conduct a medical analysis of your reaction through a detailed questionnaire administered by qualified professionals or to communicate with our insurers. For this purpose, our partner or insurers will collect and process only the data strictly necessary for the assessment of the adverse event, including without limitation:   -your identification data (e.g., name, surname, email address, identification number, etc.); -health-related data (e.g., skin conditions, allergies, medical test results, etc.); -data related to your consumption habits (e.g., products used); -data related to your skin type (e.g., oily, dry, etc.); -data related to your ethnic origins if necessary (e.g., phototype); -personal life data (e.g., if you are reporting an adverse reaction experienced by a family member).	Our customer and consumer service retains your data for the time necessary to process your request (transmission of information to the relevant and authorized teams, etc.).   Our cosmetovigilance service retains your data for 3 years from the date of collection. The data are then archived securely for 10 years from the date the product concerned is withdrawn from the market.   Our partner retains your data for one year from the date of collection. At the end of the current year, your data is returned to us and our partner proceeds with its destruction	Legitimate interest: Respond to your request   Performance of a public interest task or the exercise of official authority: The collection of data as part of health vigilance for reasons of public interest. Its primary objective is to ensure compliance with high standards of quality and safety for our products.

 

Please note that payment and payment card information is stored through our third party payment processor and is required to complete purchases with us.

 

 

1. Our legal basis for processing personal information

We only ever use your information in line with applicable data protection laws – in particular, the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (DPA 2018) and together the Data Protection Legislation. In short, this means we only use it where we have a legal basis to do so. Under the Data Protection Legislation, these are the general legal bases for which we process your personal information, as detailed in the table above:

·       Consent – you have given us consent to process your personal information for a specific purpose that we have told you about.

·       Performance of our contract – processing your personal information is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

·       Legitimate interests – processing your personal information is necessary for our legitimate interests or those of a third party, provided those interests are not outweighed by your rights and interests (including where processing is required to comply with or enforce a legal obligation, or to exercise or defend our legal rights).

 

 

5.      When do we share your personal information?

We may disclose your information for certain purposes and to third parties, as described below:

·       NAOS staff and our group of companies: we share your information with our staff (including employees, consultants, agents and advisors) and within the NAOS group of companies as required for: providing you with access to our services according to our agreement, data storage and processing, providing customer support, making internal choices around business improvements, content development, and for the other purposes set out in this Privacy Policy.

·       Third Party Providers: We use certain companies, agents or contractors (Third Party Providers) to perform services on our behalf or to help deliver our services to you. In particular, we contract with Third Party Providers, for example:

o   to host our Website and the data we collect,

o   to maintain our infrastructure and IT tools and databases,

o   to manage payments for online purchases,

o   to track our contacts and communications,

o   for advertising and marketing communications,

o   to personalise and enhance our services,

o   to deliver our products to you through postal services,

o   to provide customer service,

o   to analyse and action data (including data about interactions with our services),

o   to process and administer consumer surveys; and

o   for cosmetovigilance case management.

In the course of providing such services, these Third Party Providers may have access to your personal information. Whilst we cannot warrant or guarantee compliance with Data Protection Legislation by third parties, we endeavour to choose Third Party Providers and suppliers that offer sufficient guarantees to ensure the protection, security and confidentiality of your personal data, in particular by putting in place appropriate technical and organisational measures and complying with legal requirements. They are authorised to process your data only in strict compliance with our instructions.

·       Promotions with our partners: We may offer joint promotions, schemes or incentives with our selected partners that, in order for you to participate, will require us to share your information with the relevant partner. In fulfilling these types of promotions, we may share your name and other information in connection with fulfilling the relevant incentive. Please note that our partners are responsible for their own privacy and data protection methods and if applicable you should refer to their relevant privacy policy.

·       To protect legitimate interests: There are certain circumstances where NAOS and our Third Party Providers may disclose and/or make use of your information where a disclosure would be necessary to: (a) satisfy any applicable law, regulation, legal process, or other legal or governmental request or requirement, (b) enforce applicable terms of use, including investigation of any actual or alleged breaches, (c) detect, prevent, or otherwise address illegal or suspected illegal activities (including payment fraud), security or technical issues, or (d) protect against harm to the rights, property or safety of NAOS, its users or the public, as required or permitted by law.

·       Transfers of our business: In connection with any corporate reorganisation, restructuring, investment, merger or sale, or other transfer of assets, we will transfer information, including personal information, provided that the receiving party agrees to comply with our requirements as set out in this Privacy Policy relating to your personal information.

 

 

6.      Communications

This section is to explain how we will ensure that you only receive communications that you wish to receive.

6.1 Marketing communications:

We want to ensure that you are informed and aware of the best services and promotions that we can offer you. By consenting to receive additional communications (by mail, telephone, text/picture/video message or email) from us and any named third parties that feature at the point of obtaining consent in respect of such information, we will process your personal information in accordance with this Privacy Policy.

You can change your marketing preferences and unsubscribe at any time by emailing us or clicking the ‘unsubscribe’ in applicable communications. If you choose not to receive this information we will be unable to keep you informed of new services and promotions of ours, or the NAOS group of companies, that may interest you.

Whatever you choose, you’ll still receive other important information, for example service updates, as described below.

6.2 Newsletter Global Opt-in

By signing up for the newsletter of any brand affiliated with NAOS Group (UK) Limited, including NAOS UKI Corporate, Institut Esthederm brand (https://www.esthederm.co.uk), Bioderma brand (https://www.bioderma.co.uk/), Etat pur (https://www.etatpur.com/), NAOS (https://naos.com/en-uk), NAOS Store (https://www.naos-store.co.uk/) and our e-commerce website, you are providing your explicit consent to receive communication from NAOS GROUP UK LTD. This communication may include updates, promotions, and information related to any of our brands. We are committed to safeguarding your privacy and complying with all applicable data protection laws.

In such cases, your personal information will be used solely for the purpose of delivering relevant newsletters and marketing content from NAOS Group (UK) Limited and its affiliated brands. You have the right to withdraw your consent or manage your communication preferences at any time by following the instructions provided in our communications or by contacting our Data Protection Officer at support@uki.naos.com.

6.3 Service communications:

We may send you communications such as those which relate to any service updates (e.g. new product features, service availability) or provide customer satisfaction surveys. We consider that we can lawfully send these communications to you as we have a legitimate interest to do so, namely to effectively provide you with the best service we can and to grow our business.

 

7.      Social Networks

On our Website, you can connect via your social network profiles, click on links to our social networking pages, etc.

Social networks (Facebook, Instagram, TikTok, Pinterest, Twitter, YouTube, etc.) may collect personal data about you. You will find below the links to the privacy policies of these main social networks. To ensure the security of your data, we invite you to consult the privacy policy of these websites.

·       Facebook: https://en-gb.facebook.com/privacy/explanation/

·       Instagram: https://en-gb.facebook.com/help/instagram/155833707900388

·       TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en

·       Twitter: https://twitter.com/en/privacy

·       Pinterest: https://policy.pinterest.com/en-gb/privacy-policy

·       YouTube: https://policies.google.com/privacy?hl=en-GB&gl=zz

 

You also have the option to publish content on our pages. We remind you that any content transmitted via our pages is accessible to the public. Concerned about the protection of your privacy, we invite you to be vigilant when you communicate your personal data on social networks. We are not responsible for the use that may be made by third parties, data that you have communicated publicly.

We remind you that we may collect the content you publish on our pages, to know you better and to segment our consumer databases. We may also import some of the information you have disclosed to your social media pages, such as Facebook or Google (if you choose to connect with us via a social network) and may use this information for analytical purposes. Equally, certain parts of our service enable you to share our content or information by email, text (SMS) message or other social applications. We may collect personal data from third parties we work with, such as advertising agencies, for analytical purposes and to enable us to operate our service.

 

8.      Profiling

When we display personalised content or send you personalised communications, we are using techniques known as “profiling”. Profiling is defined in the Data Protection Legislation as “any form of automated processing of personal data which involves using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict factors concerning their economic situation, interests, behaviour, location, etc.”.

We may therefore analyse the personal data we have collected, as set out in the table above, to predict your preferences, interests and needs. These analyses will allow us to display and send communications tailored to your interests, your needs, your skin type and/or your consumer habits.

You have the right to object to your data being used for profiling purposes at any time in accordance with this Privacy Policy and the Data Protection Legislation.

 

9.      How long do we store your personal information?

Unless a longer retention period is required or permitted by law, we will only hold your personal information on our systems for the period necessary to fulfil the purposes outlined in this Privacy Policy as set out in section 3 or until you request that the Data be deleted where we are not required to maintain it for legal reasons. Even if we delete your personal information, it may persist on backup or archival media for legal, tax or regulatory purposes.

In accordance with this Privacy Policy, you have the right to request that we delete your personal information, except where we are legally permitted or required to maintain certain personal information. For example:

·       We are legally required to retain financial and transaction data for a minimum period of 6 years for tax, audit and accounting purposes. This includes keeping a record of the amount of each transaction, what it related to, and who we transacted with.  

·       If there is an unresolved issue between you and us, for example relating to an issue with a product purchase or an unresolved dispute, then we will retain your personal information until the issue is resolved.

·       There may be other situations where we have legitimate business interests to retain personal information, such as to prevent fraud or protect security of other people interacting with us.

Any Third Party Providers that we engage will keep your personal information stored on their systems for as long as is necessary to provide the relevant services to you or us. If we end our relationship with any third party providers, we will take reasonable steps to ensure that they securely delete or return your personal information to us.

We may retain personal information about you for statistical purposes. Where information is retained for statistical purposes it will always be anonymised, meaning that you will not be identifiable from that information.

 

10.  Security of your personal information

We are committed to securing and protecting your personal information, and we make sure to implement appropriate technical and organisational measures to help protect the security of your personal information. We may adopt various policies including anonymisation, pseudonymisation, encryption, password restricted access, and retention policies to guard against unauthorised access and unnecessary retention of personal information in our systems.

The information that we collect from you may be transferred to, and stored at, a destination outside of the European Economic Area (EEA). When we transfer and store your personal information outside of the EEA we will take steps to ensure that the information is transferred in accordance with this Privacy Policy and applicable data protection laws. In particular, we will ensure that appropriate contractual, technical, and organisational measures are in place with any parties outside the EEA such as the Standard Contractual Clauses approved by the EU Commission.

Unfortunately, the transmission of your personal information via the internet is not completely secure and although we do our best to protect your personal information, we cannot guarantee the security of your information transmitted to us over the internet and you acknowledge that any transmission is at your own risk.

 

11.  Links

Our Website may, from time to time, contain links to websites operated by third parties, which will usually be those of our commercial partners. This Privacy Policy only applies to the personal information that we collect from you and we cannot be responsible for personal information collected and stored by third parties. If you click on a link, please understand that the relevant third party websites have their own terms and conditions and privacy policies, and we do not accept any responsibility for the content of those third party websites or third party terms and conditions or policies. Please check these policies before you submit any personal information to these websites.

 

12.        Age restrictions

Whilst our Website is accessible to everyone, you agree that you must be 16 years of age or older to use our Website and purchase products from it. We do not knowingly collect personal information from individuals under 16 years of age. If you are under that age limit, then please do not use NAOS or provide any personal information to us. If you are under 18 years of age, then you will be required to have consent of your parent or guardian to access our Website and/or services and we will only process the basic information which we require from you for so that you can use our Website and purchase products with us.

If you are a parent or legal guardian of a child under the applicable age limit or accessing our Website and/or services without consent, and you become aware that your child has provided his/her personal information to us, please contact us at support@uki.naos.com. If we learn that we have collected personal information of an individual under the age of 16, then we will take all reasonable steps to delete that information from our systems.

 

13.  Your rights and choices

This section explains that you have a number of rights in relation to your personal information.

Under the Data Protection Legislation, you are entitled to certain rights. There are circumstances in which your rights may not apply. Subject to such circumstances, you have the right to request that we:

·                provide you with a copy of the information we hold about you;

·                update any of your personal information if it is inaccurate or out of date;

·                delete the personal information we hold about you - if we are providing services to you and you ask us to delete personal information we hold about you then we may be unable to continue providing those services to you;

·                restrict the way in which we process your personal information;

·                stop processing your data if you have valid objections to such processing;

·                restrict the capacity for you to be subject to a decision based solely on automated processing that produces legal effects concerning you or significantly affects you; and

·                do not subject you to commercial prospecting or profiling;

·                transfer your personal information to a third party.

For more information on your rights and how to use them, or if you would like to make any of the requests set out above, please contact us.

If you make such a request, you will typically receive a response within one month from the receipt of your request, although certain requests may take up to three months to process depending on their complexity. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

As explained above, even if you consented to the processing of your personal information for marketing purposes (by ticking the relevant box or by requesting information about services for example), you have the right to ask us to stop processing your personal information for such purposes. You can exercise this right at any time by contacting us. Please note that we reserve the right to charge a fee for responding to requests where we reasonably determine that they are manifestly unfounded or onerous or being made in bad faith.

 

14.  Contacting us

If you have any questions or concerns about how we handle your personal information, please contact by email to support@uki.naos.com.

If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may be able to refer your complaint to the relevant data protection authority. For the UK, this is the Information Commissioner's Office (ICO). The ICO's contact details can be found on their website at https://ico.org.uk/.

 

15.  Cookies

We may use cookies on our Website which help us monitor use of it, and in turn improve it based on how our interact with it. You can choose to accept or turn off cookies within your browser settings. You can view more information on our Cookies Policy.

 

16.  General

You may not transfer any of your rights under this Privacy Policy to any other person. We may transfer our rights under this privacy policy where we reasonably believe your rights will not be affected.

If any court or competent authority finds that any provision of this Privacy Policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be affected.

Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

This Privacy Policy will be governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.