PERSONAL DATA POLICY

Sothys Paris attaches great importance to protecting your privacy and personal data and, to this end, has implemented this policy.

This policy informs you of the processing of personal data that Sothys Paris, in its capacity as data controller within the meaning of EU Regulation No. 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the “GDPR”, carries out as part of the operation of the website https://dermo-booster.sothys.com/ , hereinafter the “Website”.

This policy does not apply to sites and services that have separate charters or policies that do not incorporate or refer to this policy.

What is personal data?

This refers to any data that can directly (ex: a name) or indirectly designate a natural person (ex: an identifier, a code).

What data does we collect?

As part of your interactions with us, we collect personal data about you. This data varies depending on the purpose of our interactions.

You may provide us with your personal data in different ways via our Website, as set out in the table below:

• either directly: request for information, contact for a project or application.
• or indirectly: cookies.

We do not collect personal data from third parties.

We make sure that we only collect data that is strictly necessary to be able to offer you a user experience that is as pleasant as possible and adapted to your needs and to be able to provide you with the services to which you have subscribed.

For this purpose and if necessary, your consent will be required.

If your data is collected via a form, the fields that must be completed are marked with an asterisk. Failure to complete the fields marked with an asterisk may affect our ability to provide you with the requested service or manage your requests.

The personal data that may be processed, the purposes for which we may process it, the applicable legal bases for processing and the retention periods for your data are as follows, depending on the circumstances in which it is collected:

It should be noted that the retention periods indicated cover storage in active databases and internal archives.

Who is the data controller?

The data controller is the person who determines the purposes and means of the processing. It is directly responsible for compliance with personal data protection obligations.

Sothys Paris is the data controller.

Recipients of your data

Your personal data is intended exclusively for authorised and specific recipients, for the sole purpose of performing the desired services.

Only the members of Sothys Paris’ internal departments and, if necessary, the authorised departments of one of the companies in the Sothys Group may be required to process some of your personal data.

Certain data (ex: cookies) may be processed by authorised third party service providers (hereinafter ‘Subcontractors’) as part of the management of the Website and to secure our tools.

In this case, Sothys Paris ensures that its Subcontractors comply with applicable European regulations on the protection of personal data.

As such, we inform you that your personal data may be transferred outside the European Union in connection with the performance of services by our Subcontractors.

In this case, Sothys Paris ensures that these transfers comply with applicable European regulations on the protection of personal data.

What are your rights?

In accordance with the regulations in force, you have a right to information (to receive concise, transparent, comprehensible and easily accessible information in clear and simple terms), a right of access to your personal data, and a right to rectify, oppose, erasure and limit it, by contacting us at dpo@sothys.net.

If we have any doubts about your identity, we may ask you to provide a copy of your identity document.

If you exercise your right to object to and/or erase and/or transfer your data:

– we may be unable to provide certain services;

– we will be unable to comply with your request when the legal basis for the processing in question is compliance with a legal obligation (e.g. cosmetovigilance).

You may withdraw your consent to the collection and processing of your personal data at any time.

You also have the right to lodge a complaint with the CNIL:

–    on the CNIL website at: https://www.cnil.fr/fr/plaintes ; or

–    by post, writing to: CNIL – Service des Plaintes – 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07.

 and/or to take any legal action.

Updates

This policy may be updated at any time, in particular to take into account any new processing of personal data, regulatory, legal or technological changes. The update becomes effective as soon as it is posted online.