Privacy policy

Shiseido values your privacy and your privacy preferences. We are committed to building strong, lasting relationships with our customers based on trust and transparency. In keeping with this approach, protecting your personal data is essential to us, and we want to explain in this Privacy policy how we collect and process that data.

This Privacy policy ("Policy") explains in detail the types of personal data we may collect about you when you use the Shiseido website and application (hereinafter, the "Services", the "Site" or the "Sites") and any other online or offline interaction you have with us through other written, oral or digital channels.

We are likely to need to update this Privacy policy from time to time. We will notify you of any significant changes, but you can come back and read it whenever you wish.

We hope the following sections answer any questions you may have. If not, please contact us.

Shiseido Spain SAU is part of the Shiseido Group and acts as joint controller of your data together with Beaute Prestige International, S.A., whose trade name is Shiseido EMEA. Shiseido Spain SAU manages our local operations and Shiseido EMEA manages our e-commerce, customer relations and marketing activities for Europe.

Data protection law in the European Union sets out a number of "legal bases" for processing personal data, which are the legal grounds that allow companies such as ours to hold your personal information. We have taken care to ensure that we have a legal basis for all the data processing we carry out. Our legal bases include:

Performance of the contract we have with you

• In certain circumstances we need your personal data to fulfil our contractual obligation to deliver the products you request, or to take steps at your request before entering into a contract. For example, if you buy our products through our website, we need your name and contact details so that we can communicate with you and deliver the products. In this case, providing your personal data will be necessary to supply the products, information and services you request and to carry out the activities described above. If you do not provide your personal data, we will not be able to provide the products and services requested.

Legal compliance

• Sometimes the law requires us to collect and use your data. For example, we may pass on the details of people involved in fraud or other criminal activity if the authorities ask us to, and tax law requires us to keep a record of your orders and payments. In this case, providing your personal data will be necessary to supply the products, information and services you request and to carry out the activities described above. If you do not provide your personal data, we will not be able to provide the products and services requested.

Legitimate interests

• This is a technical term in data protection law which means that, if we have fair and proportionate reasons and do not harm your interests and rights, we may use your personal data. Sometimes we may use your data to pursue our legitimate interest in a reasonable way, where that use is not detrimental to your rights, freedoms or interests. For example, we will send you communications about our service, always giving you the chance to control whether we continue to do so. We also analyse how users interact with our website so that we can understand which parts of the design work well and which work less well. This allows us to improve and develop the quality of the online experience we offer all users.

Consent

• In certain cases, we may ask for your consent before using your information.

There are several occasions on which we will collect information from you:

• When you visit one of our websites, use your account to buy products and services, or redeem our coupons in person or by telephone.
  
• When you make a purchase and check out as a guest (in which case we only collect data based on your transactions);
  
• When you create an account or profile with us;
  
• When you sign up online or in our stores to receive electronic newsletters, blog posts, special offers and other materials;
  
• When you join one of our loyalty programmes online or in a store;
  
• When you sign up to take part in competitions or contests we may hold.
• When you choose to complete any survey we send you;
  
• When you comment on our products;
  
• When you take part in our user community or contribute content to the websites, for example by posting on our forums or commenting on a blog;
  
• When you interact with us on social media;
  
• When you book any kind of appointment with us or book to attend an event with us, for example appointments with our beauty advisors in stores and department stores for beauty consultations, make-up sessions and tutorials, as well as events for new product launches;
  
• When you contact us in any way: online chat, email, text message or telephone helpline, for any reason, whether a compliment, a comment or a request;
  
• When you complete any form. For example, if an accident occurs in the store.
  
• When you submit a job application and/or a CV, or complete other employment documentation;
  
• When you download or install one of our applications;
  
• When you give a third party permission to share with us the information they hold about you.
  

Depending on how you interact with us (online, in store, by telephone, and so on), we may collect different types of information, which are described in more detail below. In some cases we may combine one type of information with another and store them together in our records. In all cases, however, we try to limit the amount of information we collect and store to what is necessary for the legal reason we hold it. Wherever possible we tell you why we need the information requested, or whether you can choose not to provide it and still place an order, subscribe to updates and offers, and so on. We may not be able to provide a service if you do not give us the information requested.

1. Information provided when you interact with us

• Account information: Such as your name, customer number, sign-in ID, username, password and/or security question and answer, and other registration information. Sometimes we will generate certain sign-in information, such as your customer number. We only collect (or create for you) unique sign-in information for activities that require an account. Your unique sign-in information, especially your password, must always be kept confidential and must never be shared with anyone else.
• Personal contact information: This includes any information that allows us to contact you personally, such as your name, home or postal address, telephone number (home or mobile) or email address. In some cases this could include information about another person (for example, if you ask us to send a product to a friend). We usually collect personal contact information in connection with a variety of activities, including account registration (for example, online purchases and web community activities, newsletter subscription, and so on), product orders, customer service, contests and promotions, and customer feedback. If you create an account with us, some of your personal contact information may be stored in your account profile.
• Order and product information: This includes details of the products you have ordered or searched for online through our website or in physical stores, the time and date of orders or searches, or the stores you prefer to visit. We use this information to send you emails and promotional communications (with your consent), to make (with your consent) personalised recommendations or products when you return to the website, to advertise to you when you visit other websites, and to understand our customers better so that we can improve our products and the customer experience in our business, both offline and online.
• Demographic information and preferences: Such as age, gender, preferences, interests, date of birth, age or age range, and, with your consent, facial attributes (for example, hair colour, eye colour, skin tone and type — this data is only transferred if you choose to do so, and you can order products without transferring it), general geographic location (for example, postcode or city and region), favourite products, hobbies and interests, or lifestyle information. We generally collect demographic information in connection with a variety of activities, including account registration (for example, online purchases, website community activities, newsletter subscriptions, and so on), contests and promotions, and customer surveys. If you create an account with us, you can change the demographic information stored in your account profile. We use this information to send you emails and promotional communications (with your consent), to make (with your consent) personalised recommendations or products when you return to the website, to advertise to you (with your consent) when you visit other websites, and to understand our customers better so that we can improve our products and the customer experience in our business, both offline and online.
• Payment and transaction information: Such as the information you use to make a purchase, for example your bank card details, gift card information or other available forms of payment. We only collect payment information for purchases (whether your purchase is made in store, online, by telephone or by catalogue). If you create an account with us (for example, a commercial account, a community account, or another type), your payment information may be stored in your account profile. We use this information to process your payments when you request products from us, to allow you to redeem gift vouchers, and to record your payment information and make transactions easier if you wish. When we allow you to buy products and services from the Website, payments made on the Website are processed through our payment link provider, ADYEN and PAYPAL. You will provide credit or debit card information directly to them, encrypting your credit/debit card information and authorising the payment. The information you provide to ADYEN or PAYPAL is not under our control and is subject to their own privacy policy.
• User-generated content and posts: This refers to any content you may create and share with us (and, where applicable, with third parties) by uploading it to our websites and/or applications, such as Facebook fan pages or applications. Examples may include photos, videos, personal stories or other similar media or content. In general, we collect customer-generated content in connection with contests and promotions, website community activities, customer participation and third-party social networks. It also includes any other information you may make public on the Website (for example, information shared with other members of our user community).
• Allergy and intolerance information for the safety of our cosmetic products: This includes information about your allergies or intolerance, as provided by you to our customer service. Examples may include intolerance to our products or to a component of a product. We only use this information with your express consent to follow up on allergies and intolerance you may experience with our products and, wherever possible, to develop and improve our products. It is always your choice whether or not to share those details with us.
• CCTV: Your image may be recorded on CCTV when you visit one of our stores. We use it for security reasons and delete the video regularly unless we have an incident or an alleged incident that requires an investigation or action by the competent authorities.

2. Information collected automatically

When you interact with us through the website or the application, we use various technologies (including cookies, as described below). We use this information to understand your needs and preferences better, so that we can offer you a better online and in-store experience, monitor and maintain our online infrastructure, and improve our website and applications in general.

Our site uses cookies and/or other similar technologies, such as device identifiers, in-app codes, pixel tags and web beacons, to collect and store certain information. This is generally information or code that a website transfers to, or accesses from, your computer's hard drive or your mobile device in order to store and sometimes track information about you. Cookies and similar technologies allow you to be remembered when you use a computer or device to interact with websites and online services, and they can be used to manage a range of features and content, such as social media accounts together with websites and applications.

In accordance with the information provided in the banner or pop-up notice on our Website when you first visit our site, by browsing and remaining on our Site you are understood to accept the use of the cookies mentioned above in this Policy and in the
Cookie policy.

You can change your browser to refuse cookies, and its help screen or manual will tell you how. We also give you information on how to disable cookies
here. However, you may not be able to get the most out of our website if you do so.

We use these cookies and other technologies on the basis that they are necessary for the performance of a contract with you and, in some cases, where required by law or where you have given your consent to their use. For more details of the cookies we use, see here. You can also find information about social networks and advertising partners here, as they also use cookies and similar technologies on the Website.

3. Information we receive and collect from other sources

We may obtain information, including personal data, from other parties, such as our partners and advertisers. If we combine this with the personal data we collect through the service, we will treat it as personal data in accordance with this policy.

4. Social networks and advertising partners

We work with social media platforms and digital advertising platforms to:

• Make it easier to sign in to your account (for example, by using your Facebook account).
  
• Show you advertising for our products and those of other Shiseido Group companies on other websites and social media platforms. For example, if you show an interest in buying a product on our website or in one of our physical stores, we may advertise those products that may interest you on other websites or on Facebook or other social networks. To do this, we share information with our social media and digital advertising partners about your age, gender and interests, for example, so that they can better understand what interests you. Our partners may also store that information about you and use it to help other companies, unrelated to Shiseido, show you online ads. You will never be identified "in the real world" by this information. For more information on how to turn this feature off, see below or visit https://
  www.youronlinechoices.eu.

Our social media and digital advertising partners also use cookies and similar technologies, so please see them
here.

We want to offer you deals and promotions that may be relevant to your interests at specific times, in emails (when we have your consent to do so) or on the website when you visit it. To help us gain a better overall understanding of you as a customer, we may combine your information from several channels, for example your online and offline purchase history. For this purpose we also combine the data we collect directly from you with data we obtain from third parties to whom you have given consent to transfer information about you to us. By doing this, we can place you in one or more customer categories that we use to develop our promotional and marketing strategies, and that category will partly determine the promotional communications and recommendations you receive from us.

Our website may provide links to, or features of, other third-party websites (such as third-party social networks) that we do not own or control. If you click on those links or use those features, you do so at your own risk. We are not responsible for the content or practices of any third-party site, application or feature.

If you experience allergies or intolerance when using our cosmetic products, your requests or complaints about product safety or cosmetics should be sent by contacting:

Shiseido EMEA
Regulatory Department – Cosmétovigilance
56 A, rue du Faubourg St Honoré
75008 Paris
France
Phone: +33- 1 46 94 10 00

The data you provide for safety reasons are your name, contact details and health data relating to the allergy or intolerance. Processing of this data is based on the safety of our cosmetic products and on your consent. This information is used in digital environments and channels that are separate from the environments and channels used for commercial and marketing purposes. We will only tailor our marketing messages to you with your prior consent.

We may also pass information relating to the safety of our products to the competent health authorities in anonymised form.

Like most websites, our Site uses cookies and/or other similar technologies, such as device IDs, pixel tags or web beacons, to collect and store certain information. You can find out more about cookies and how they work at https://www.allaboutcookies.org or https://www.youronlinechoices.eu. You can always disable cookies through your browser settings. https://www.youronlinechoices.eu.

Although most web browsers accept cookies automatically, the decision to accept them is yours. You have the option to accept or refuse cookies by way of consent. You can adjust your browser settings to prevent cookies from being received, or to be notified each time a cookie is sent to you.

See our
Cookie policy for more information about which specific cookies we may use, for what purpose, and the choices you have regarding the use of cookies.

Shiseido is a leading beauty and fragrance company and its products are distributed in around 120 countries. As a global company, we may share your personal information with Shiseido Group companies and trusted third parties based outside the country where you live, who may process that data on our behalf. We never rent, sell or trade your information to third parties for their own commercial use.

Shiseido group affiliates and entities

We may share (or receive) information about you, including personal information, with our regional headquarters for Europe, the Middle East and Africa (EMEA), Beaute Prestige International S.A., whose trade name is Shiseido EMEA, RCS B 379 445 984, which has its registered office at 56 A, rue du Faubourg Saint Honoré 75008 Paris, France ("Shiseido EMEA"), and Shiseido Americas Corporation, based at 900 Third Avenue, New York, NY 10022, USA ("SAC").

Shiseido EMEA is responsible for directing our e-commerce, customer relations and marketing activities for the Europe, Middle East and Africa region, which means that it is also a controller of your personal data under European data protection law.

SAC is responsible for designing and managing the Shiseido Group's IT system, providing technology for the infrastructure, including through its external suppliers, which helps us host the website and your information, provide customer relationship management or "CRM" services and payment processing. As such, SAC acts as a data processor on our behalf.

External suppliers

Sometimes we share your personal data with trusted third parties. For example, delivery couriers, fraud management, to handle complaints, to help us personalise our offers, website and application development, hosting, maintenance, customer relationship management and promotional services for you, and so on. You can see the main companies we work with to collect information relating to you directly from this
link.

When we use any of these suppliers:

• We provide only the information they need to perform their specific services.
  
• They may only use your data for the purposes we specify in our contract with them.
  
• We work closely with them to ensure that your privacy is protected at all times.
  
• If we stop using their services, all of your data will either be deleted or anonymised.
  

For some suppliers, we have to transfer your information to locations outside the European Union.

Legal disclosures (where necessary)

This is when we are required to share your information for law enforcement or other legal purposes. This kind of sharing may be necessary in connection with a lawsuit, claim or inspection, a government investigation, a court order, the enforcement of legal rights (for example, contractual terms, intellectual property rights, and so on), security issues or other similar legal or security matters. Sharing your information for these reasons is not something that happens often, but it can happen. We will try to limit the types and amounts of information we need to share for legal reasons to what is necessary, and we will make sure that any transfer outside the European Union is made in accordance with the appropriate legal framework.

Business transfers (for example, the sale or acquisition of a company)

To the extent permitted by law, we may share (or receive) information about you, including personal information, if an acquisition, merger, sale, corporate restructuring, insolvency or other similar event involving Shiseido EMEA or its parent or affiliated companies takes place. If such an event occurs, we will take reasonable steps so that the processing of your data complies with this privacy policy, unless that is not reasonable or appropriate, and in any event we will make sure that any transfer outside the European Union is made in accordance with the appropriate legal framework.

Shiseido has its head office in Japan, and we have operations, affiliates, entities and service providers in Europe and around the world, including in the United States. As such, we and our service providers may transfer your personal information, or access it, in jurisdictions that may not provide levels of data protection equivalent to those of your home jurisdiction.

Whenever we transfer your personal data outside the EEA or Switzerland, we make sure that a similar degree of protection is provided by ensuring that these transfers are based on standard contractual clauses, in accordance with the model clauses approved by the European Commission or, for some transfers to the United States, under the Privacy Shield programme, details of which you can find here:
https://www.privacyshield.gov/welcome. Where such sharing of information involves transfers outside the EEA or Switzerland to SAC, these transfers are based on its Privacy Shield certification. SAC complies with the EU-U.S. Privacy Shield Framework as set out by the U.S. Department of Commerce with respect to the collection, use and retention of your information transferred from the European Union to the United States. For more information about the Privacy Shield programme and to view our certification, visit https://www.privacyshield.gov/list

Shiseido knows how much the security of your personal data matters to all our customers. That is why we take care in handling your data and take all appropriate measures to protect it, and we require the same of our suppliers who process your data.

Secure operating environments

We secure access to all areas of our websites and applications using 'https' technology.

Encryption of payment information

Access to your personal data is password-protected, and confidential data is secured by SSL encryption.

Other security measures

In addition to the methods above, we may take other measures to protect your information, depending on the sensitivity of the data and other considerations. These measures may include (among other things) additional access restrictions, password requirements and physical protections (for example, secure data centres, and so on).

Steps you can take

Despite all our efforts, there are no guarantees or security standards that provide 100% security. It is also important that you keep your information safe and protected. When you sign up for an online account, make sure you choose a password that is hard for others to guess and never reveal it to anyone. If you use a public or shared computer, never choose to have your password remembered and make sure you sign out every time you leave the computer.

Please note, however, that these protections do not apply to information you choose to share in public areas such as the community areas of our websites or other social platforms. We pay particular attention to confidential data, in particular payment card data, allergy or intolerance data, and so on.

We will keep your personal information for the period required to fulfil the purposes described in this Privacy policy. This includes the following criteria: (i) the length of time we have an active relationship with you; (ii) whether there is a legal or commercial obligation to which we are subject; or (iii) whether a longer retention period is required or permitted by law.

You have the legal right to request:

• Access to the personal data and content we hold about you.
  
• Correction of your personal data where it is inaccurate.
  
• In some specific cases, erasure of your personal data.
  
• That we stop using your data where the legal basis for that use is consent, by withdrawing that consent at any time, or that we stop using your data where the legal basis is a legitimate interest and we do not have an overriding interest, or where the reason we collected the data has come to an end.
• In specific cases, that we restrict our processing of your personal data.
  
• That we stop using your personal data for direct marketing.
  
• If your data is processed automatically on the basis of your consent or the performance of a contract with you, a copy of the personal data you provided to us, in a commonly used format, so that it can be transmitted to another data controller.
  

You have the right to request a copy of any personal information we hold about you. Contact the Data Protection Officer (DPO) at the address given in the Contact section. To ask for your information to be changed, please update your online account or contact our Customer Service team.

If we do not comply with your request, we will explain the reason for our refusal.

To protect the confidentiality of your information, we will ask you to verify your identity before we act on any request you send us relating to this privacy policy. If you have authorised a third party to submit a request on your behalf, we will ask them to prove that they have your authorisation to proceed.

Our sites are not directed at people under the age of 16. We do not request or collect information from anyone under 16. If we become aware that we have accidentally collected information from a child, we will delete the information from our records as soon as possible (or obtain the parental permission required to keep it).

This Privacy Policy sets out our accepted privacy principles, but it does not replace or override existing national legislation. It supplements the relevant national data protection law. The relevant national law prevails where deviations from this privacy policy are required or where it sets stricter requirements. The content of this privacy policy will also apply where there is no national regulation on the protection of personal data.

If you have a complaint about our compliance with this privacy policy, please contact us first. We will investigate and try to resolve all complaints and disputes relating to the use and disclosure of personal information in accordance with this Privacy Policy.

If you consider that your data has not been handled correctly, or you are not satisfied with our response to any request you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the French Privacy Commission (CNIL), which is our "lead supervisory authority" under data protection law. That means they are the data protection regulator with primary responsibility for supervising our compliance with data protection law. You can contact them by calling +33 (0)1 53 73 22 22 or online at
www.cnil.fr (it will open in a new window; please note that we cannot be responsible for the content of external websites).

In addition, users in Spain can contact the Spanish Data Protection Authority directly by writing to C / Jorge Juan, 6. 28001, Madrid or online at
www.agpd.es.

If you live outside France or Spain, you have the right to submit your complaint to the relevant data regulator in your country of residence. (see
https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.html).

We hope this Privacy policy has been useful in explaining how we handle your personal data and your rights to control it.

If you have further questions about this Policy, or if you have any concern about your personal data, please contact our Data Protection Officer, who will be glad to help:

Contact us here:
https://privacy.emea.shiseido.com/es/

Or write to us at: Data Protection Officer
Shiseido EMEA

56 A, rue du Faubourg St Honoré75008 Paris
France

Please contact the company for all the processes described in this privacy policy. For the safety of cosmetic products, see Section 6 of this Privacy Policy.