NEWS EVENTS PRESS LOCATIONS CONTACT EN - FR ABOUT US Expertise Our commitments CSR action plan Our history PERSONAL CARE PHARMACEUTICALS GATTEFOSSÉ FOUNDATION PERSONAL DATA PROTECTION POLICY Version in force on 04/02/2021 Purpose Personal data is information that may allow, directly or indirectly, the identification of a natural person. This includes, for example, surnames, first names, email addresses, telephone numbers, user names, IP addresses, cookies, etc. This Personal Data Protection Policy applies to personal data collected by Gattefossé directly from users (the “Users”) of the website www.gattefosse.com (the “Website”). In its capacity as data controller, Gattefossé undertakes to collect, process and store the personal data of Users in complete confidentiality and in accordance with the provisions of this Policy. By accessing the Website, the User acknowledges having read and accepted, without reservation, the terms of this Personal Data Protection Policy. Purposes of processing Gattefossé collects the personal data that Users agree to provide. Data is collected and processed for the following purposes: Contact form Management, processing and response to Users’ enquiries and requests for information and/or samples; Management and processing of requests for information, access, rectification, deletion or portability of personal data or requests to oppose or restrict data processing. Cookies Facilitation of browsing on the Website; Sharing of videos, animated and interactive content; Statistics (analysis of traffic on the Website for example); Analyses to develop and improve browsing on the Website and/or the content of the Website. Registration form for the Members’ Section of the Website Validation and management of access to the Members’ Section of the Website; Commercial prospecting; Management and processing of requests for information, access, rectification, deletion or portability of personal data or requests to oppose or restrict data processing. Request form for samples in the Website’s Members’ Section Management, processing and response to Users’ enquiries and requests for information and/or samples. The User is hereby informed of the purpose of processing prior to any collection of personal data and has the opportunity to oppose it. Duration of storage In accordance with legal requirements, the personal data of Users collected on the Website will be stored by Gattefossé only for the time required to fulfil the intended purpose, namely: Contact form: time required to process the enquiry or request plus two (2) years Cookies: two (2) years Registration form for the Website’s Members’ Section: period of validity of access to the section plus two (2) years Request form for samples in the Website’s Members’ Section: time required to process the request plus (2) years The personal data collected will be deleted: At the end of the term stipulated above; or At the User’s request, in accordance with the applicable regulations and the procedures provided for in Article 7 below (subject to any legal retention obligation). Transmission Should it prove necessary, personal data collected on the Website may be communicated to other Gattefossé Group entities worldwide. The latter must comply with the processing purposes defined for this data. This data may not be sent to third parties for commercial and/or promotional purposes without the User’s prior consent. On the other hand, this data may be sent to certain service providers/technical subcontractors of Gattefossé (hosting company or audience analysis service in particular) bound to the confidentiality and security of this data and exclusively for the purposes described in Article 2 above. In the event that the data is transferred to a country that is not a member of the European Union and is not subject to an Adequacy Decision, Gattefossé will take all necessary measures to ensure that the data is protected with an appropriate level of confidentiality and security. Gattefossé may be required to send the data to the competent administrative or judicial authorities, at their request. Confidentiality and security Gattefossé undertakes to set up all necessary technical and organisational measures to preserve the confidentiality and security of the personal data collected on the Website. However, Gattefossé cannot be held liable for a security failure attributable to the User. Cookies When browsing the Website, cookies may be placed on the User’s device (computer, tablet, smartphone). A cookie is a small computer file deposited on the User’s device through their internet browser that allows certain data to be stored in order to facilitate browsing on a website and enable certain functionalities. The User is informed of the use of cookies by a banner that appears when connecting to the Website. The User may choose to authorise or prohibit all or some of the cookies by clicking on the “Customise” button on the banner. The disabling of certain cookies may alter the operation of the Website. The User is informed of this when personalising cookies. In the event that the User decides to prohibit a cookie necessary for the optimal operation of the Website, Gattefossé cannot under any circumstances be held liable for the consequences relating to the altered or impaired running of the Website. Cookies can be deposited by Gattefossé partners (such as Google Analytics for example). These partners may also use the information contained in cookies. The User is entitled to withdraw their consent and/or their choice to personalise cookies at any time. Information on the User’s consent and choice of personalising cookies will be retained by Gattefossé for thirteen (13) months. User Rights In accordance with the provisions of Law no. 7817 of 6 January 1978 on Technology, Files and Civil Liberties (known as “Loi Informatique & Libertés”) and European Regulation 2016/679 of 27 April 2016 (General Data Protection Regulation), the User has the following rights with regard to their personal data: Right to information; Rights of access and rectification; Right of deletion; Right to oppose processing for legitimate reasons; Right to oppose, without reason, the processing of data for marketing purposes; Right to personal data portability; Right to restrict processing. These rights may be exercised at any time by the User by sending an email to: dataprotection@gattefosse.com, provided that proof of identity is attached. In the event of an unsatisfactory response from Gattefossé in exercising the rights mentioned below, the User may lodge a complaint with the French National Commission for Data Protection and Liberties (“CNIL”). Amendments This Personal Data Protection Policy may be updated at any time by Gattefossé without any formality other than the online publication of a new amended version, the latter prevailing over any previous version. Legal notice - Terms and condition - Privacy policy © 2021 Gattefossé People make our name