Data Protection Policy
Data Protection Policy
Our personal data protection policy helps build a relationship of trust between you and our services, so that we can offer you a positive experience in a fully transparent manner.
Through this policy, we are able to take your requirements into account and remain in line with your expectations.
In order to honour your trust, Guillaume Landeau, trading as Romy & Hazel, guarantees above all the protection of your personal data, as well as the confidentiality of our customers' information (hereinafter "Your Data").
For full transparency, and to guarantee secure use of our website romyandhazel.com in all its available versions and related applications (hereinafter the "Romy & Hazel Site"), we set out below how we process your data, so that our services always respect your rights. In this way, we ensure the security, confidentiality, and integrity of your privacy and your data across all our platforms.
Our policy, and we ourselves, guarantee that all necessary precautions are taken to protect all of your data against disclosure, loss, or alteration. This is why we provide you with all the information you need to easily understand how we process your data. This data will only be retained for as long as necessary for the management and processing purposes set out. You may, of course, access and modify your data at any time, as it is available in your personal account area on the Romy & Hazel Site.
To this end, we strive to take all necessary steps to comply with applicable data protection law.
Accordingly, the undersigned, Romy & Hazel, undertakes through this personal data protection policy to comply with the essential principles of the EU General Data Protection Regulation (GDPR), UK GDPR, and French data protection law, by making available to you information concerning the existence and terms of the data processing applied here (Section 3), the rights you hold regarding your data, and by applying these rights ourselves (Sections 6 and 10). Any information relating to potential transfers to a third country or to recipients is also made available, as is the retention period for collected data (Section 5) and the security measures applied (Section 9).
WHO ARE YOU?
When we refer to "you" in this Data Protection Policy, it is simply because it directly relates to and concerns you as a customer of Romy & Hazel — whether you have placed an order on the Romy & Hazel Site, created a customer account without having ordered any products or services, or browsed the Romy & Hazel Site as a visitor without creating a customer account or placing an order.
FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?
3.1. When do we collect your personal data?
Your personal data may be collected if you visit the Romy & Hazel Site (which uses cookies), if you create a customer account on the Romy & Hazel Site, if you place an order for one of our products or services, or if you agree to become a member of our newsletters (SMS, email).
Your personal data is used to make your browsing experience on the Romy & Hazel Site smoother, and to offer you a more personalised experience. This allows us to better process your orders, offer instalment payment options, prevent fraud, carry out any necessary refunds, and manage customer reviews.
3.2. Your browsing on the Romy & Hazel Site
To allow you to browse the Romy & Hazel Site, we process your data on the legal basis of your consent.
3.3. Processing your orders
To handle and process your orders, we use your data.
We use this data to manage mediation, customer relations (including via social media), our after-sales and distance-selling service, our marketing and commercial prospecting activities for the Romy & Hazel Site, as well as the management, delivery, and shipping of orders.
The performance of the contract between the two parties (you and us) is the legal basis for processing this data.
Romy & Hazel's legal obligations are the legal basis for processing relating to product recall management. Your consent or our legitimate interest are, depending on the case, the legal basis for marketing and commercial prospecting activities. Your consent is the legal basis for the implementation of "flash" payment.
3.4. Instalment Payment
For orders eligible for instalment payment, and for certain customers, your data is processed in order to offer you this type of payment. The performance of the contract between the two parties is the legal basis for processing this data. However, your consent remains the basis for the processing of your banking data.
3.4.1 Klarna
In order to offer you Klarna's payment options, we may need to transfer your personal data to Klarna, including your contact details and order information, so that Klarna can assess whether you meet the requirements to benefit from this option and tailor it to your needs. Your personal data transferred in this way will be processed in accordance with Klarna's Privacy Policy (https://www.klarna.com/international/privacy-policy/).
3.5. Customer Reviews
To allow you to share your reviews with our customers and visitors, and to let you leave a review on the Romy & Hazel Site, we use your data on the legal basis of your consent or our legitimate interest.
3.6. Payment Collection and Fraud Prevention
To enable payment collection and fraud prevention, we use your data. This also allows us to guarantee payment security.
The performance of this contract between the two parties, as well as Romy & Hazel's legitimate interest as data controller, are the legal bases for this processing.
3.7. Management of Romy & Hazel's Advertising Operations
Romy & Hazel's advertising operations are managed using your data. This allows us to grow our customer and prospect data, manage technical maintenance and prospect activity, produce sales statistics and advertising campaign analysis, update prospecting files with the body responsible for managing opt-outs from telephone marketing, run solicitations, and set up our competitions and prize draws or any other promotional operation (excluding online gambling and games of chance).
The legal bases for the above are the user's consent or Romy & Hazel's legitimate interest.
WHERE DOES YOUR DATA GO?
Your data is shared with several internal Romy & Hazel departments. It is not shared with third parties, except in the situations described below:
To process your orders, your personal data may be shared with several service providers specialising in banking transactions, customer relations, after-sales service, delivery, IT development, site management, or the provision of warranties or insurance.
For instalment payment, your data may be shared with providers such as payment and transaction centres (banks, etc.), or call centres for business process management or customer experience, or, for customer reviews, with a provider managing the collection and processing of reviews.
Romy & Hazel's advertising operations are managed, using your data, with advertising network clients and advertisers.
DATA RETENTION
Data collected by Romy & Hazel is retained only for the time and to the extent necessary to carry out the operations described in Section 3 of this data protection policy.
In current archives, for prospects, data is retained for 3 years from the customer's last contact. We do not carry out intermediate archiving of this data (for data of administrative interest, such as litigation, retention periods are set by applicable statutory limitation rules).
Regarding orders, your data will be kept in current archives for 5 years from the end of use of the customer's orders, and in intermediate archives for a further 5 years. The same applies to customer accounts.
Regarding banking data, it is kept in current archives for the entire period of validity of the bank card (plus one day), with no intermediate archiving.
Cookies, their use, and retention periods are detailed in Section 7 of this policy.
EXERCISING YOUR RIGHTS
6.1. You have the right to request access to, and the modification and rectification of, your Data.
6.2. You have the right to request restriction of the processing of your Data.
6.3. You have the right to request the deletion of your Data. Romy & Hazel may nonetheless retain it in intermediate archive format for the time necessary to comply with its legal, accounting, and tax obligations.
6.4. You have the right to object to the processing of your data for commercial prospecting purposes. For email marketing, unsubscribe via the link in every newsletter. For SMS marketing, reply "STOP" to any marketing text message.
6.5. You have the right to provide instructions regarding the retention, deletion, and disclosure of your personal data after your death.
6.6. You have the right to data portability.
6.7. You have the right to withdraw your consent regarding processing based on this legal basis, without affecting the lawfulness of processing carried out before withdrawal.
6.8. You have the right, at any time, to lodge a complaint with the competent supervisory authority — in France, the CNIL (www.cnil.fr); for data subjects in the United Kingdom, the Information Commissioner's Office (ICO, www.ico.org.uk).
To exercise your rights, please send your request (accompanied by your email, first name, last name, a copy of your ID, and postal address) to Romy & Hazel's data protection officer by email at contact@romyandhazel.com and/or by post to the address indicated in our Legal Notice. We will respond within a maximum of one (1) month.
COOKIES
7.1. What is a cookie? A small text file placed on your device via your browser, allowing a website to recognise your device on a subsequent visit.
7.2. What are cookies used for?
7.2.1.1. "Essential" Cookies — required to access our site and place an order.
7.2.1.2. "Analytics and Personalisation" Cookies — not mandatory, help optimise your experience and our offers.
7.2.1.3. "Advertising" Cookies — target your interests and display relevant advertising based on your browsing history.
7.2.2. Cookies issued by third-party companies — governed by their own privacy policies, not necessary for use of our site.
7.2.3. Cookies issued by third-party applications embedded on our site — e.g. social share/like buttons, which may identify you if logged into your social account.
Privacy policies of the social networks we integrate:
Facebook: https://www.facebook.com/privacy/explanation
Instagram: https://privacycenter.instagram.com/policy
TikTok: https://www.tiktok.com/legal/page/row/privacy-policy/en
7.3. Managing cookies via your browser
Google Chrome™: https://support.google.com/chrome/answer/95647
Microsoft Edge™: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge
Safari™: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
Firefox™: https://support.mozilla.org/kb/enable-and-disable-cookies-website-preferences
Opera™: https://help.opera.com/en/cookies/
TRANSFERS OUTSIDE THE EUROPEAN UNION
Most of the time, your data is stored within the European Union. Where our service providers are located outside the EU, we take necessary steps to ensure compliant data sharing (e.g. European Commission standard contractual clauses, or the UK's International Data Transfer Agreement for UK data transfers).
SECURITY MEASURES
We implement technical and organisational measures appropriate to the risks involved, and comply with the Payment Card Industry Data Security Standard (PCI DSS).
PROFILING AND AUTOMATED DECISION-MAKING
We use automated processing (such as profiling) for automated customer identification and "pay in 4" instalment payment options, based on analysis of order type and customer profile. If risk is assessed as too high, this option will not be offered. You may request human intervention and contest any automated decision.
UPDATES AND REVIEW OF THIS POLICY
Our data protection policy will be updated whenever necessary to remain in line with applicable regulations (at least every three (3) years).