Privacy Policy

Data controller: OLIVIA BALM SAS (SIRET 935 100 776 00027), 41 rue de la Bourse, 69002 Lyon – 04 22 91 95 87 – contact@oliviabalm.com.

Your privacy is paramount to us. We undertake to protect your personal data and to respect your privacy. This privacy policy describes how we collect, use, store and protect your information.

Data collection

We collect personal information when you browse our site, create an account or make a purchase. This data may include your name, email address, postal address, telephone number, as well as payment information. We also use cookies to analyse the use of the site and improve your experience.

Use of data

The information collected is used to:

• Process your orders and manage your customer account.
• Improve our products and services.
• Provide you with a personalised experience.
• Inform you of our offers and news, where you have consented to receive such information.

Data protection

We implement state-of-the-art technical and organisational measures to ensure the security of your data against any unauthorised access, disclosure or alteration.

Data sharing

Your data is never sold to third parties. However, we may share your information with trusted partners as part of order management (for example, payment providers or delivery companies), subject to strict confidentiality agreements.

• Online payment: Stripe Payments Europe Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
• Shipping: La Poste – Colissimo (France), for the delivery of orders.
• Hosting and infrastructure: Vercel Inc. (front-end, European replication), Render Inc. (back-end) and MongoDB Atlas (database, hosted in the European Union).
• Audience measurement and advertising (with your consent): Google Ireland Limited for Google Analytics 4 and Google Ads.
• Machine translation (non-personal product content): DeepL SE (Germany).
• Transactional email delivery: our email service provider (European Union).

No other transfer is carried out beyond these cases.

Legal basis for processing

The processing operations we carry out are based on the following legal bases, within the meaning of Article 6 of the GDPR:

• Performance of the sales contract or pre-contractual measures (art. 6, § 1, b): order processing, delivery, after-sales service, customer account management.
• Legal obligation (art. 6, § 1, c): retention of accounting and invoicing documents, fraud prevention, responding to judicial requisitions.
• Legitimate interest (art. 6, § 1, f): site security, fraud prevention, product improvement, commercial prospecting of existing customers regarding similar products.
• Consent (art. 6, § 1, a and article 82 of the loi Informatique et Libertés (French Data Protection Act)): analytics and advertising cookies, sending marketing emails to non-customers, processing of health data (prescriptions).

Retention periods

• Customer account: for the entire duration of the account's existence, then 3 years from the last activity (basis: CNIL recommendation on prospecting).
• Order data: 10 years from the order, kept in an active database for the warranty period and after-sales service, then archived for accounting purposes (article L.123-22 of the Code de commerce (French Commercial Code)).
• Invoicing data: 10 years (accounting and tax obligations).
• Health data (prescriptions): retained for the period necessary to fulfil the order, then archived for 5 years to account for legal warranties and professional obligations.
• Analytics and advertising cookies: 13 months maximum from the time they are placed.
• Cookie consent: 6 months from the time it is given (CNIL recommendation).
• Connection logs: 1 year (article L.34-1 of the Code des postes et des communications électroniques (French Postal and Electronic Communications Code)).

Transfers outside the European Union

Certain data may be transferred to countries located outside the European Union, in particular to the United States when you accept analytics or advertising cookies (Google Analytics 4, Google Ads).

These transfers are governed by the European Commission's adequacy decision of 10 July 2023 relating to the "Data Privacy Framework", to which Google LLC is a signatory. Failing that, transfers are carried out on the basis of standard contractual clauses adopted by the European Commission, accompanied, where applicable, by additional measures (encryption, pseudonymisation).

User rights

In accordance with applicable law, you have the right to access, rectify, object to and delete data concerning you. To exercise these rights, please contact us at the following address: contact@oliviabalm.com.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL, the French data protection authority, 3 place de Fontenoy, 75007 Paris, www.cnil.fr) if you consider that the processing of your data constitutes a breach of the applicable regulations.

Withdrawal of consent

You may withdraw the consent you have given us at any time, without affecting the lawfulness of prior processing. In particular, you may change your cookie preferences on the "Cookie management" page, unsubscribe from our emails via the link at the bottom of each message, or write to us at contact@oliviabalm.com.

Cookies

Our site uses cookies to improve your browsing experience and analyse traffic. You can configure your browser to refuse cookies, but this may affect some site features.

Policy update

This privacy policy may be updated regularly. The version in force is the one published on our site on the date of consultation.