Beautylounge AG Privacy Policy
Version of 8 March 2023
In this privacy policy, we, Beautylounge AG, explain how we collect and otherwise process personal data. This is not an exhaustive description; other privacy policies may govern specific matters. Personal data means any information relating to an identified or identifiable person.
If you provide us with personal data of other persons (e.g. family members, data of work colleagues), please make sure that these persons are aware of this privacy policy, and only share their personal data with us if you are permitted to do so and if this personal data is correct. This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation (“GDPR”), the Swiss Federal Act on Data Protection (“FADP”) and the revised Swiss Federal Act on Data Protection (“revFADP”). Whether and to what extent these laws apply, however, depends on the individual case.
1. Controller / data protection officer / representative
The Art. 27 representative is also the Art. 37 data protection officer: unless otherwise stated in an individual case, the party responsible for the data processing we carry out here is Beautylounge AG, Burgunderstrasse 42, 4051 Basel. If you have any data protection concerns, you can send them to us at the following contact address: Beautylounge AG, Burgunderstrasse 42, 4051 Basel, info@beautylounge.ch.
You can likewise reach our data protection officer pursuant to Art. 37 GDPR at Beautylounge AG, Burgunderstrasse 42, 4051 Basel, info@beautylounge.ch. He is also our representative in the EEA pursuant to Art. 27 GDPR (where required).
2. Collection and processing of personal data
We primarily process the personal data that we receive from our clients and other business partners, and from other persons involved, in the course of our business relationship with them, or that we collect from the users of our websites, apps and other applications when operating them.
Where permitted, we also obtain certain data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, the press, the internet) or receive such data from other companies within Beautylounge AG, from authorities and from other third parties. In addition to the data you give us directly, the categories of personal data that we receive about you from third parties include, in particular, information from public registers; information that we learn in connection with official and court proceedings; information in connection with your professional roles and activities (so that we can, for example, conclude and carry out transactions with your employer with your help); information about you in correspondence and meetings with third parties; credit reports (insofar as we do business with you personally); information about you that people close to you (family, advisers, legal representatives, etc.) give us so that we can conclude or perform contracts with you or involving you (e.g. references, your delivery address, powers of attorney); information on compliance with legal requirements such as anti-money-laundering rules and export restrictions; information from banks, insurers, distribution partners and other contractual partners of ours concerning the use or provision of services by you (e.g. payments made, purchases made); information about you from the media and the internet (where this is appropriate in the specific case, e.g. in connection with a job application, press review, marketing/sales, etc.); your addresses and, where applicable, interests and other socio-demographic data (for marketing); and data in connection with the use of the website (e.g. IP address, MAC address of your smartphone or computer, information about your device and settings, cookies, date and time of your visit, pages and content accessed, functions used, referring website, location data).
3. Purposes of data processing and legal bases
We use the personal data we collect primarily to conclude and perform our contracts with our clients and business partners, in particular in connection with the beauty services we provide to our clients and the purchase of products and services from our suppliers and subcontractors, and to comply with our legal obligations in Switzerland and abroad. If you work for such a client or business partner, your personal data may of course also be affected in that capacity. In addition, where permitted and where we consider it appropriate, we process personal data about you and other persons for the following purposes, in which we (and sometimes third parties) have a legitimate interest corresponding to the purpose:
Offering and further developing our offers, services and websites, apps and other platforms on which we are present;
Communicating with third parties and processing their enquiries (e.g. job applications, media enquiries);
Reviewing and optimising needs-analysis procedures for the purpose of approaching clients directly, and collecting personal data from publicly accessible sources for the purpose of client acquisition;
Advertising and marketing (including organising events), provided you have not objected to the use of your data (if we send you advertising as an existing client of ours, you can object to this at any time, and we will then put you on a blocking list against further advertising mailings);
Market and opinion research, media monitoring;
Asserting legal claims and defending ourselves in connection with legal disputes and official proceedings;
Preventing and investigating criminal offences and other misconduct (e.g. conducting internal investigations, data analyses to combat fraud);
Ensuring our operations, in particular our IT, our websites, apps and other platforms;
Video surveillance to uphold our rights as occupier of our premises, and other measures for IT, building and facility security and for the protection of our employees and other persons and of assets owned by or entrusted to us (such as access controls, visitor lists, network and mail scanners, telephone recordings);
Buying and selling business units, companies or parts of companies and other corporate transactions and the associated transfer of personal data, as well as measures for business management and, to that extent, for compliance with legal and regulatory obligations and the internal regulations of Beautylounge AG.
Where you have given us your consent to process your personal data for specific purposes (for example when you sign up to receive newsletters or for a background check to be carried out), we process your personal data within the scope of and on the basis of this consent, insofar as we have no other legal basis and require one. Consent that has been given can be withdrawn at any time; however, this has no effect on data processing that has already taken place.
4. Permanent cookies / tracking and other technologies in connection with the use of our website
We typically use "cookies" and comparable technologies on our websites that allow your browser or device to be identified. A cookie is a small file that is sent to your computer or automatically stored on your computer or mobile device by the web browser you are using when you visit our website. This allows us to recognise you when you visit this website again, even if we do not know who you are. In addition to cookies that are used only during a session and are deleted after your visit to the website ("session cookies"), cookies can also be used to store user settings and other information for a certain period (e.g. two years) ("permanent cookies"). However, you can set your browser to reject cookies, to store them for one session only or otherwise to delete them early. Most browsers are set to accept cookies by default. We use permanent cookies so that we can better understand how you use our offers and content, and so that we can show you offers and advertising tailored to you (which may also happen on the websites of other companies; however, these companies will not learn from us who you are, if we even know this ourselves, as they only see that the same user is on their website who was also on a particular page of ours). Some of the cookies are set by us, and some by contractual partners with whom we work. If you block cookies, certain functions (such as language selection, shopping basket, ordering processes) may no longer work.
In some cases and where permitted, we also include visible and invisible image elements in our newsletters and other marketing e-mails; when these are retrieved from our servers, we can determine whether and when you opened the e-mail, so that here too we can measure and better understand how you use our offers and tailor them to you. You can block this in your e-mail program; most are set to do so by default.
By using our websites and consenting to receive newsletters and other marketing e-mails, you agree to the use of these technologies. If you do not want this, you must set your browser or e-mail program accordingly.
We sometimes use Google Analytics or comparable services on our websites. This is a service provided by third parties who may be located in any country in the world (in the case of Google Analytics, it is Google Ireland (based in Ireland); Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”), www.google.com), with which we can measure and evaluate the use of the website (on a non-personal basis). Permanent cookies set by the service provider are also used for this purpose. We have configured the service so that visitors' IP addresses are truncated by Google in Europe before being forwarded to the USA and therefore cannot be traced back. We have switched off the “Data sharing” and “Signals” settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google may use this data for its own purposes to draw conclusions about the identity of visitors, create personal profiles and link this data to these persons' Google accounts. If you have registered with the service provider yourself, the service provider will also know who you are. The processing of your personal data by the service provider is then the responsibility of the service provider in accordance with its data protection provisions. The service provider only tells us how our respective website is used (no information about you personally).
We also use so-called plug-ins from social networks such as Facebook, Twitter, Youtube, Pinterest or Instagram on our websites. This is visible to you in each case (typically via corresponding icons). We have configured these elements so that they are deactivated by default. If you activate them (by clicking on them), the operators of the respective social networks can record that you are on our website and where, and can use this information for their own purposes. The processing of your personal data is then the responsibility of this operator in accordance with its data protection provisions. We do not receive any information about you from it.
5. Disclosure of data and transfer abroad
In the course of our business activities and for the purposes set out in section 3, where permitted and where we consider it appropriate, we also disclose personal data to third parties, either because they process it for us or because they wish to use it for their own purposes. This concerns in particular the following parties:
Our service providers (within Beautylounge AG and external ones, such as banks, insurers), including processors (such as IT providers);
Dealers, suppliers, subcontractors and other business partners;
Clients;
Domestic and foreign authorities, official bodies or courts;
Media;
The public, including visitors to websites and social media;
Competitors, industry organisations, associations, organisations and other bodies;
Acquirers of, or parties interested in acquiring, business units, companies or other parts of Beautylounge AG;
Other parties in potential or actual legal proceedings;
Other companies of Beautylounge AG;
collectively “recipients”.
Some of these recipients are in Switzerland, but they may be located anywhere in the world. In particular, you must expect your data to be transferred to all countries in which Beautylounge AG is represented by group companies, branches or other offices, as well as to other countries in Europe and to the USA, where the service providers we use are located (such as Microsoft, SAP, Amazon, )
.
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection rules (for this purpose we use the revised standard contractual clauses of the European Commission, which are available here: /eli/dec_impl/2021/914/oj?), insofar as the recipient is not already subject to a legally recognised set of rules ensuring data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interest, or if the performance of a contract requires such disclosure, if you have given your consent, or if the data concerned has been made generally accessible by you and you have not objected to its processing.
6. Retention period for personal data
We process and store your personal data for as long as is necessary to fulfil our contractual and legal obligations or otherwise for the purposes pursued with the processing, i.e., for example, for the duration of the entire business relationship (from the initiation and performance through to the termination of a contract) and beyond that in accordance with statutory retention and documentation obligations. Personal data may be retained for the period during which claims can be asserted against our company and insofar as we are otherwise legally obliged to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the above purposes, it will, as a rule and as far as possible, be deleted or anonymised. For operational data (e.g. system protocols, logs), shorter retention periods of twelve months or less generally apply.
7. Data security
We take appropriate technical and organisational security precautions to protect your personal data against unauthorised access and misuse, such as issuing instructions, training, IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, pseudonymisation and checks.
8. Obligation to provide personal data
In the context of our business relationship, you must provide the personal data that is required to establish and conduct a business relationship and to fulfil the associated contractual obligations (as a rule, you have no statutory obligation to provide us with data). Without this data, we will generally not be able to conclude or perform a contract with you (or with the entity or person you represent). Nor can the website be used if certain information required to ensure data traffic (such as the IP address) is not disclosed.
9. Profiling and automated decision-making
We process some of your personal data automatically with the aim of evaluating certain personal aspects (profiling). We use profiling in particular so that we can provide you with targeted information and advice about products. For this purpose, we use evaluation tools that enable us to communicate and advertise in line with your needs, including market and opinion research. As a rule, we do not use fully automated decision-making (as governed, for example, in Art. 22 GDPR) to establish and conduct the business relationship or otherwise. Should we use such procedures in individual cases, we will inform you of this separately where required by law and explain the associated rights to you.
10. Rights of the data subject
Within the scope of the data protection law applicable to you and insofar as provided for therein (such as in the case of the GDPR), you have the right of access, rectification and erasure, the right to restriction of data processing and otherwise to object to our data processing, in particular processing for direct marketing purposes, profiling carried out for direct advertising and other legitimate interests in the processing, as well as the right to receive certain personal data for the purpose of transferring it to another party (so-called data portability). Please note, however, that we reserve the right to invoke the restrictions provided for by law, for example if we are obliged to retain or process certain data, have an overriding interest in doing so (insofar as we may rely on this) or need it to assert claims. If you incur any costs, we will inform you in advance. We have already informed you about the possibility of withdrawing your consent in section 3. Please note that exercising these rights may conflict with contractual agreements and may have consequences such as early termination of the contract or costs. In this case, we will inform you in advance where this is not already provided for in the contract.
Exercising such rights generally requires you to prove your identity clearly (e.g. by means of a copy of an identity document where your identity is otherwise not clear or cannot be verified). To assert your rights, you can contact us at the address given in section 1.
Every data subject also has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).
11. Changes
We may amend this privacy policy at any time without prior notice. The current version published on our website applies. Insofar as the privacy policy forms part of an agreement with you, we will inform you of any update by e-mail or by other suitable means.
