Privacy Policy

WHO THIS APPLIES TO

This Privacy Policy applies to you if you are signing up or otherwise engaging in our Friends and Family Sale (‘Sale’) – you may be doing this as you are invited as an employee of L’Oréal (UK) Limited or as a friend or family member invited to join-in our Sale by one of our lovely employees.

We set out below the types of personal data we might collect or hold about you, how and why we use it, who we share it with, how we protect it and keep it secure, and your rights around your personal data.

Please note that you must be at least 18 years old or older to create a Sale account with us and receive marketing from us.

WHY THIS MATTERS

Please read this information carefully. If you have any questions, please contact us using the contact details provided below (please see the “Contact Us” section) and let us know you are a Friends and Family Sale Customer so we can best support you. Note that not all the information set out below may apply to you. We have detailed all possible situations in which we could interact together as part of our Sale - one or more of these may apply to you.

WHO WE ARE

“L’Oréal”, “us”, “our” or “we” means L’Oréal (UK) Limited. We are responsible for the personal data that you share with us as we are the “controller” for the purposes of applicable data protection laws.

The L’Oréal family is made up of a number of different brands – you can find out more here http://www.loreal.co.uk/.

We are also part of the L’Oréal Group which operates in 140 countries around the world. For details on the L’Oréal Group, please see http://www.loreal.com/group.

WHAT’S NOT INCLUDED

This Privacy Policy does not apply to our L’Oréal employees or shareholders in the context of your employment or shareholding with us (please see our Employee Data Protection Notice available via our intranet and shareholders privacy policy available via our corporate site). You may also be a Business Customer of ours, if so, with the exception of Aesop business customers, please see our Business Customer Privacy Policy for further information on how we use your personal data in that context. If you are a talent partner of ours then please see our Talent Partner Privacy Policy for details on how we use your personal data in that context. If you visit one of our premises or attend an event we are hosting, we will also provide you with information about how we use your personal data to manage your time safely and securely with us. If none of these apply to you, you may be a Consumer of ours, in which case please see our Consumer Privacy Policy.

This Privacy Policy doesn’t cover other companies or organisations (which ‘drop’ and operate cookies, tags and other tracking technologies on our site) - you should review their cookie and privacy policies before giving them your personal information.

OUR PRIVACY PROMISES

Our ambition is to be an exemplary corporate citizen and we place great value on honesty and clarity. Part of this commitment means safeguarding and respecting your privacy and your choices - this is essential to us. We want you to understand how we use your personal data so you can feel comfortable and confident in sharing it with us.

1. We respect your privacy and your choices.
2. We make sure that privacy and security are embedded in everything we do.
3. We will not send you marketing communications unless you have asked us to. You can change your mind at any time.
4. We will never sell your personal data.
5. We are committed to keeping your personal data safe and secure. This includes only working with trusted partners.
6. We are committed to being open and transparent about how we use your personal data.
7. We will not use your personal data in ways that we have not told you about.
8. We respect your rights and will always try to accommodate your requests as far as is possible, in line with our own legal and operational responsibilities.

WHAT IS PERSONAL DATA?

“Personal data” means any information or pieces of information that could identify you either directly (e.g. your name) or indirectly (e.g. through pseudonymised data, such as a unique ID number). This means that personal data includes things like email/home addresses, usernames, and financial information. It could also include unique numerical identifiers like your computer’s IP address or your mobile device’s MAC address, as well as cookie identifiers.

WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU AND HOW DO WE USE IT?

At L’Oréal, our ambition is to build relationships based on transparency and mutual trust. As a valued customer of our Friends and Family Sale, we need you to share certain information with us so we can best engage with you, such as contacting you about the Sale and any changes you need to be aware of, make sure you get your order and handle any queries you may have. We explain more about this below.

How do we collect or receive your personal data?

We collect or receive personal data from you in a number of ways, including via our Sale website and our Sale account registration form. Sometimes you give this to us directly (e.g. when you create Sale account), when you contact us, and when you make a purchase, and sometimes we collect it indirectly such as via third parties managing cookies to understand how you use our website.

The table below sets out which legal basis we rely on when processing your personal data.

To explain what a ‘legal basis’ is – under data protection laws, the legal basis for the processing of your personal data can be:

• Your consent – where we ask for your agreement to use your personal data for a specific purpose.
• The performance of a contract – where we need to process your personal data to provide you with a service/something under an agreement we have with you or as part of preparing to enter into an agreement with you.
• Our legitimate interests – where the use of your personal data is in our legitimate business interests.
• To comply with a legal obligation – where we need to use your personal data for our own legal and regulatory compliance reasons (for example to comply with our tax and financial reporting obligations).

When we collect personal data, we will indicate which types of personal data are mandatory via asterisks (*). For example, mandatory information to allow us to create your account or deliver the goods you have purchased on our websites/apps.

We collect the following types of personal data when creating and managing your Sale Account and purchases: first name, surname, email address, postal and billing address, phone number, transaction information including purchased products, payment information, and any other information you may have provided us with e.g. via a query or complaint.

We use this information to:
Create and manage your account, your orders and communicate with you. We do this:

• To perform our contractual obligations with you – so you can create and manage your account, place orders with us, and so we can provide you with access to and information about the Sale;
• As it is in our legitimate interests to: (i) improve our products and services; (ii) better engage with you, particularly in the lead up to and during the Sale ‘live’ period in case of any relevant promotional comms such as newly added products and brands, or if we opt to extend the Sale period for whatever reason; (iii) send or display personalised communications or content; and/or (iv) prevent fraud or criminal activity, for our and your safety.
• As we have a legal obligation to keep certain information such as purchase and order fulfilment details, and verify your age; and
• Consent, where we ask for consent (we don’t always rely on consent) including to send you marketing messages.

Manage our website. We do this using cookies or similar technologies (“cookies”*) when you browse our Sale website. For information on the specific cookies placed on a particular website/app, please check the cookies table or tool available on the specific website/app.

We use the information collected via these cookies to:

• Send or display personalised communications and/or publish content, where we have your consent to do so; and
• Prevent fraud or criminal activity, monitor, maintain and improve our website including its security, run analytics or collect statistics, where it is in our legitimate interests to do so.

AUTOMATED DECISION MAKING

Automated decision making means the ability to make decisions using technology, without human involvement.

We may use automated decision-making techniques for the purposes of securing transactions placed through our website against fraud. In addition, we may use a third-party provider’s solution to protect our systems, assets etc. against fraud.

The method of fraud detection is based on several different data prediction and data intelligence techniques that may change over time, to keep up with technological advancements. These may include, for example, simple comparisons, or association, clustering, prediction and outlier detections using intelligent agents, data fusion and data mining techniques. This fraud detection process may be completely automated or may involve some human intervention where the final decision is taken by a person. In all cases, we take all reasonable precautions and safeguards to limit access to your data.

As a result of automatic fraud detection, you may: (i) experience a delay in the processing of your order/request whilst we review your transaction; and/or (ii) be limited or excluded from using a service if a risk of fraud is identified.

You have the right to access the information on which we base our decision. Please see “Your Rights and Choices” section below.

JOINT CONTROLLERS

We are always responsible for personal data that we collect about you. In some cases, for example, when we collaborate with our trusted partners, we may be jointly responsible with those partners for protecting your personal data.

Our data protection commitments as joint controllers are as follows:

• We will agree the respective roles and responsibilities of each party involved;
• We will make sure that both parties are transparent about the joint purposes for processing your personal data, and explain how your personal data is used for these purposes; and
• We will make sure that you are always able to exercise your legal rights.

Where we work jointly with another party, we will inform you about your rights and other important information at the point we ask for your personal data.

An example of where we act as a joint controller, is with the third-party partners we share and receive personal data with about you to be able to display tailored ads on their sites. To do this we share your (pseudonymised) identification data, i.e. your full name and email address, to enable the partner to find you among their members/users and to display relevant ads about our products and services to you and to create lookalike audiences (please see the ‘Your Profile’ section above for more details). Our partners provide us with reports on the results of our ad campaigns (number of clicks, conversion rate, audience profile, etc.) so we can improve our future campaigns. In these activities, we act as joint data controller with the third-party partner, but only to the extent of the personal data shared by them as relevant to our business – we do not have access to all personal data they hold about you.

Please note, if you do not have an account with that third party partner, then the processing activity is limited to sharing with a ‘no match’ finding. We only do this where we have your consent to do so.

SHARING YOUR PERSONAL DATA

We may share your personal data within L’Oréal and the L’Oréal Group - Access within the L’Oréal Group will always be controlled on a need-to-know basis, to fulfil our contractual obligation with you (such as to refund you), or to allow us to perform any necessary or legitimate functions. This may include sending you marketing communications about other brands but only where we have a marketing permission to do so.

We may also share your personal data in a pseudonymised way (not allowing direct identification of you) with L’Oréal Research & Innovation scientists, including those located outside of your country, for research and innovation purposes.

Your personal data may also be processed on our behalf by our trusted suppliers - We only provide them with the information they need to perform the service they are providing. We require them to keep it secure and tell them not to use it for any other purpose. For example, we may trust third parties to deliver services that require the processing of your personal data as follows:

• As required to deliver a product to you, for example, postal/delivery services;
• Payment service providers and credit reference agencies to assess your credit score and verify your details where this is a condition of entering into a contract with you;
• Advertising, marketing, digital and social media agencies to help us deliver advertising, marketing, and campaigns, to analyse their effectiveness, and to manage your contact details, questions, and our relationship;
• Third parties that assist us with customer care, product queries and complaints; and/or
• To provide us with IT services such as website hosting and platform management services.

We may also disclose your personal data to third parties beyond those that provide services to us, such as:

• If we sell any or part of our business or assets, we may disclose your personal data to the prospective buyer of such business or assets. Your personal data will usually be processed by the buyer acting as the new controller and its privacy policy will govern the processing of your personal data;
• If we are under a duty to disclose or share your personal data to comply with a legal obligation, or in order to enforce or apply our terms of use/sales or other terms and conditions you have agreed to, or to protect the rights, property, or safety of L’Oréal, our customers, or others; and/or
• In other circumstances if we have your consent or we are permitted to do so by law.

WHERE WE STORE YOUR PERSONAL DATA

The personal data that we collect from you may be transferred to, accessed in, and stored at, a destination outside the United Kingdom. It may also be processed by staff operating outside the United Kingdom who work for us or for one of our service providers.

Where L’Oréal transfers personal data outside of the United Kingdom and/or including Ireland, this will be done in a secure and lawful way. As some countries may not have laws governing the use and transfer of personal data, we will take steps to ensure that third parties adhere to the commitments set out in this Privacy Policy (e.g. reviewing their privacy and security standards and subjecting them to appropriate contractual obligations).

When we transfer your personal data outside of the territories described above, we:

• review and/or enter into appropriate contracts (including adding the European Commission’s standard contractual clauses (available here) which may include the UK’s Addendum to the standard contractual clauses (available here); or
• rely on the applicable UK or European Commission (depending on whether the transfer is from UK or Ireland) adequacy decision which finds the third country to which we may transfer your personal data offers an adequate level of data protection (copies of adequacy decisions available here (UK) and here (EU)).

For further information, please contact us as per the “Contact us” section below.

HOW LONG DO WE KEEP YOUR PERSONAL DATA AND HOW DO WE KEEP IT SECURE?

We will keep your personal data for as long as we need it subject to the different use cases described above. For example, we retain certain personal data for the following periods:

• For the duration of our contractual relationship and for a reasonable period after it ends in case of a query or claim;
• Where you create an account, we keep your personal data until you request us to delete it or after a period of inactivity (i.e. where you have not interacted with us for a period of time). This period is defined in accordance with local regulations and guidance; and
• Where cookies are placed on your browser, they are stored for as long as necessary to achieve their purposes (e.g. statistics on your social media post) and otherwise for a period defined in accordance with local regulations and guidance.

When we no longer need to use your personal data, it is removed from our systems and records, or anonymised so that you can no longer be identified from it.

We are committed to keeping your personal data secure and taking all reasonable steps to do so. We contractually require that trusted third parties who handle your personal data for us do the same. However, as no sharing of information via the Internet is completely secure, we cannot guarantee the security of your personal data transmitted to our site. Any sharing is therefore at your own risk.

YOUR RIGHTS AND CHOICES

L’Oréal respects your right to privacy: it is important that you are able to control your personal data. You may have certain rights and choices over the personal data we collect from you. These rights may be limited depending on our rights as a business and/or the legal basis on which we use the data, but we will always explain where this is the case. We will take reasonable steps to verify your identity before granting access or making corrections to the information we hold about you. You may exercise these rights by contacting us using the details provided below.

Email opt-out

You can opt-out from our email marketing at any time by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us (see the ‘Contact Us’ section below). We will act on your request as quickly as we can, but it can take about 30 days to take effect due to system updates. We will add your email address to our opt-out list to make sure we continue to exclude you from future marketing communications.

Withdrawing your consent

You may also withdraw any consent you previously provided to us at any time by contacting us using the details provided below. This will not affect the lawfulness of our use of your personal data based on your consent before its withdrawal.

Reviewing, correcting, updating, restricting, objecting to our use of or deleting your personal data

You have the right to request access to and correction or erasure of the personal data we hold about you, or to request our use of this information is restricted, as appropriate. You also have the right to object at any time to the use of your personal data for direct marketing purposes, including the profiling we do related to direct marketing.

These rights may be limited depending on our rights as a business and/or the legal basis on which we use the data, but we will always explain where this is the case.

Other Rights

You have the right to receive, in a structured, commonly used and machine-readable format, the personal data that you have provided to us about you, with your consent or based on your contract with us. You also have the right to have this information transferred to another data controller, where it is technically feasible. You may exercise this right by contacting us using the details provided below. You may also lodge a complaint with a data protection authority about our use of your personal data, but we do ask that you contact us first and try to resolve any issues or causes for concern you may have.

How to turn on/off cookies

The settings from the Internet browsers are usually programmed by default to accept cookies, but you can easily adjust them by changing the settings of your browser or, where available, by using the tools on our websites.

Many cookies are used to enhance the usability or functionality of a website; therefore disabling some types of cookies may prevent you from using certain parts of our websites. 

If you wish to manage your preferences regarding the cookies and other similar technologies that are set by our websites, you can navigate to the “Cookies Settings” link available in the footer of our websites) or refer to the Help function within your browser to learn how to manage your settings within your browser. For more information please consult the following link: https://www.aboutcookies.org/.

CHANGES TO THIS PRIVACY POLICY

We may make changes to this Privacy Policy from time to time. Changes may be due to, for example, amendments to applicable laws, regulations, and industry practices, or due to changes we make to our services. We encourage you to review our Privacy Policy to stay informed.

If we make material changes that may affect your rights, as per the “Your Right and Choices” section above, we may provide additional notice, such as via email or via a notice on our website. If you continue to use our services after we publish or send a notice about any changes to our Privacy Policy, it will mean that you have read and understood the updated Privacy Policy.

CONTACT

If you have any questions or concerns about how we treat and use your personal data, or would like to exercise any of your rights as outlined above, please contact us at [email protected],

or by writing to us at:

Data Protection Officer
L’Oréal (UK) Limited
Gateway Central
187 Wood Lane
London W12 7SA
United Kingdom

If you would like to get in touch with our Data Protection Officer, please contact us at [email protected].

Published: September 2025, version 1.