Privacy Notice

1. APPLICATION

This Privacy Notice explains the types of Personal Data we collect and how we use, disclose, transfer, process and protect that information.

We collect Personal Data through, but not limited to, the following means:

i) Data you provide to us, such as:

1. (a) When you use or interact with our websites, platforms, virtual environments, product and service offerings and/or applications (both web and mobile versions) (collectively, our "Platforms");
2. (b) When you shop on, browse, access, or interact with us via our Platforms;
3. (c) When you shop in-store at our physical stores. In addition, your image may be recorded on CCTV during those visits;
4. (d) When you connect with us through social media, participate in our surveys, promotions, campaigns and other activities, or attend our marketing events;
5. (e) When you subscribe to our newsletter or other marketing communication;
6. (f) When you agree and consent to be our member and/or create an account with us, whether through physical or electronic means, or any other joint membership that we have with our partners;
7. (g) When you voluntarily share with us any content (suggestions, testimonials, surveys or any other feedback) about your experience in using our products or services. This also includes your posts on our Platforms (such as photos, videos, personal stories, or other similar media or content); and
8. (h) When you contact us via our customer service or via any other channel (online chat, email, text message, telephone help line for any reason, compliments, feedback or a request, etc.).

ii) Automatically collected data

Subject to the set-up of your internet browser, the following categories of Personal Data may be collected automatically when you navigate through our Platforms, due to various tracking technologies such as browser cookies. Such information may include (but are not limited to):

1. (a) Technical information: your IP address, the browser (type and version) you use, the name of your access provider, your operating system and interface or data related to your device and language preferences;
2. (b) Connection data: logs (identifiers, date and time of connection to your account and/or to our Platforms);
3. (c) Personal Data relating to your use of our Platforms: pages viewed, the website from which you are visiting us, your navigation actions, searched products, date, time and duration of your visit;
4. (d) Location-related information, which can be derived from information such as your device's IP address or your device's GPS signal; and
5. (e) Information collected in and through cookies, local storage, pixels and similar technologies.

iii) Data we receive and collect from other sources

1. (a) Third parties and advertising partners: We may obtain Personal Data from third parties and sources, such as our advertising partners. This may be the case when you accept our cookies on the Platforms, which will help us understand your activities, how you use our Platforms, the purchases you make, the advertisements you watch, among others. Such information are necessary for us to optimize our media campaigns and ensure we are not delivering to you ads that do not fit your preferences and profile.


2. (b) Social media partners: Subject to your consent to the use of cookies or similar technologies, we might receive your Personal Data from social media platforms (such as Facebook and Instagram, when you voluntarily provide to them your Personal Data in accordance with their policies), when you link your account with us to your social media account, or when you use your social media account to access any of our Platforms (e.g. to create an account with us on our Platforms, to participate in one of our promotional campaigns or to make a purchase without having to create an account on our Platforms) or when using social media plug-ins (e.g. “like” and “share” buttons). We will manage such Personal Data in accordance with this Privacy Notice. For the avoidance of doubt, the mere use of our Platforms does not generally involve Personal Data processing activities or Personal Data transfers or disclosures by or to social media platforms. However, depending on your cookies choices or confidentiality set-up, social media platforms may independently collect and otherwise process Personal Data about or related to you in order to provide personalized advertising, including ads from Shiseido. For more information about the scope and purposes for which your Personal Data is processed by these social media platforms, please refer to their privacy notices.

If you provide Personal Data of a third party to us, you must obtain the necessary consent from that third party to transfer their Personal Data to us, and for us to collect, use, disclose, transfer or process that Personal Data in accordance with this Privacy Notice and all applicable law.

We may update this Privacy Notice from time to time by posting updated versions on our Platforms, and/or by sending an e-mail to you. Your continued membership, access to and/or use of the Platforms will be taken to be your agreement to, and acceptance of, all changes made in each updated version.

Please check back regularly for updated information on how we handle your Personal Data.

2. CONSENT

We do not collect, use, process or disclose your Personal Data without your consent (except where permitted and authorised by law). By providing your Personal Data to us, you hereby consent to us collecting, using, disclosing, transferring, and processing your Personal Data from the sources set out in Section 1 of this Privacy Notice and for the purposes set out in Section 3 of this Privacy Notice.

The types of Personal Data we collect include, but are not limited to, your: (a) first name and family name; (b) home address; (c) age and date of birth; (d) email address; (e) mobile number; (f) gender and, only if appropriate, your (g) user name and password; (h) billing and delivery address; (i) personal identification number; (j) skin and/or health information (such as your physical characteristics, skincare concerns and/or skincare regimes, skin type, skin conditions and medications for the same); (k) racial or ethnic origin; (l) biometric data; (m) billing and financial information (e.g. credit and debit card information); (n) purchase history; (o) product preferences and communication channel preferences; (p) communications data (such as your correspondence or feedback history with us); (q) technical information about your interaction with our Platforms (such as the type and configuration of your device or browser, your IP address, time zone, language settings, date and time of your visit, the URL of the website from which you have been referred and your browsing history); and (r) other information as may be reasonably required for us to fulfil the purposes set out in Section 3 below, in accordance with all applicable law.

3. PURPOSE

We collect, use, disclose, transfer and process your Personal Data for the following purposes:

1. 1. providing you with our products and services;
2. 2. providing you with information on products and campaigns from us, Shiseido Group and our third party business partners via emails, phone messages, postal mails and social networking services, including back-in stock notifications (where we have your consent or are permitted to do so under applicable law);
3. 3. including you in our databases and collaterals for our sales and marketing opportunities and campaigns;
4. 4. tailoring ads on our Platforms, social media platforms and elsewhere to your interest, use patterns and history with us;
5. 5. allowing you to purchase products and services offered for sale, including establishing an account for checkout purposes;
6. 6. ensuring the quality of products and services we provide to you;
7. 7. facilitating your transactions with us;
8. 8. administering your accounts with us;
9. 9. sending you product samples and/or products;
10. 10. keeping you informed of updates, changes, and developments relating to us and our services;
11. 11. notifying you about important changes to this Privacy Notice, and to our other policies or services;
12. 12. providing you with personalized consultations (whether conducted in-person or remotely), and managing any related appointments;
13. 13. responding to queries or feedback from you;
14. 14. managing your comments and reviews on our products and services;
15. 15. maintaining and operating the Platforms, and ensuring network and information security;
16. 16. managing our administrative and business operations;
17. 17. prevention and detection of fraud and any unlawful use of our Platforms;
18. 18. ensuring business and disaster recovery (such as the creation of back-ups);
19. 19. engaging third party business partners and data processors (whether located locally or overseas) for the purposes stated in this section;
20. 20. performing customer profiling, market analysis, market surveys, and research to improve our product and service offerings to you;
21. 21. for document and data retention or storage, record keeping, statistical analysis, internal reporting and research purposes;
22. 22. preventing, detecting and investigating crime and analysing and managing commercial risks, or any complaints you make;
23. 23. protecting and enforcing Shiseido's (including its affiliates and personnel) contractual and legal rights and obligations;
24. 24. safeguarding the interests of Shiseido in the event of any claim, litigation or suits;
25. 25. fulfilling the legitimate interests of Shiseido or any other person, in accordance with applicable law;
26. 26. complying with applicable legal requirements, relevant industry standards and our policies or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
27. 27. processing payment or credit transactions;
28. 28. any other purposes for which you have provided the information; and
29. 29. any other purposes which are reasonably related to the above or for the performance of our obligations in the course of or in connection with the provision of our product and services offerings to you.

4. WITHDRAWAL OF CONSENT, ACCESS & CORRECTION

If you wish to withdraw your consent to receive information on new products and campaigns, or any other services, you may do so by:

1. 1. unsubscribing from our Platforms;
2. 2. clicking the “Unsubscribe" link in the email(s) we send to you;
3. 3. contacting our Data Protection Officer at the email address below; or
4. 4. writing to us at the address below.

You may also withdraw your consent and request us to stop collecting, using, disclosing and/or processing your Personal Data for any or all of the purposes listed above in Section 3 by: (a) contacting our Data Protection Officer at the email address below; or (b) writing to us at the address below. Please note that if you choose to withdraw your consent to our use, disclosure, transfer and/or processing of your Personal Data, we may not be able to provide you with some or all of our services or you may not be able to use our Platforms. Please note that withdrawing consent does not affect our right to continue to collect, use and disclose Personal Data where such collection, use and disclosure without consent is permitted or required under applicable laws.

We will ensure that the Personal Data in our possession is accurate and complete to the best of our knowledge. You agree to only submit Personal Data which is accurate and not misleading and to keep it up to date. We may verify the Personal Data provided by you as part of our user verification processes or as required under applicable law.

You have a right to request for access and correction of your Personal Data. If you would like assistance in accessing and/or correcting your Personal Data, please contact our Data Protection Officer at the email address below.

5. CHILDREN

Our Platforms are directed toward and designed for use by persons aged 16 or older. We do not intend to collect Personal Data from children under 16 years of age. We are not able to verify whether a Platform user is under 16 years of age and therefore, we recommend parents or guardians to be involved in the online activities of their children in order to consent to or prevent their children's Personal Data from being collected, used, disclosed and/or processed by us. In the event where we become aware that we have accidentally collected Personal Data from a child under the age of 16, we will remove that Personal Data from our records as soon as feasibly possible. If you are over 16 but below 18 years old, you represent and warrant that you have obtained consent from your parent(s) or legal guardian(s), and your use of the Services are under the control and responsibilities of your parent(s) or legal guardian(s).

6. THIRD PARTY DISCLOSURE & TRANSFER

We do not disclose or transfer your Personal Data to third parties unless we have clearly asked for and obtained your consent to do so (except where permitted and authorised by law).

The Personal Data which you provide to us may be stored, processed, transferred between, and accessed from servers located in the United States (“USA”) and other countries. Some of these countries have laws and regulations which may not guarantee the same level of protection of Personal Data as Vietnam. However, we will take reasonable steps to ensure that your Personal Data is provided a standard of protection as required under applicable data privacy law and handled in accordance with this Privacy Notice, regardless where your Personal Data is stored or accessed from.

1. The Shiseido Group comprises a number of affiliated companies and legal entities located both within and outside of Vietnam. For additional information regarding our affiliated companies and legal entities, please see https://corp.shiseido.com/en/company/structure. We may disclose, where appropriate and to the extent necessary, your Personal Data to such affiliated companies and legal entities (including those in Japan and USA) for the purposes of corporate reporting, market research and analysis, supporting any actual or contemplated merger, reorganisation, restructuring, acquisition or similar corporate transaction or proceeding involving all or a portion of our business, customer relationship management and other related purposes, or for other purposes stated in Section 3 above. Please note that we provide our affiliated companies and legal entities with only the Personal Data they need for such purposes, and we require that they protect such Personal Data in accordance with the applicable laws and regulations and this Privacy Notice, and not use it for any other purpose.

1. We rely on third party business partners located both within and outside of Vietnam, to perform a variety of services on our behalf. In so doing, Shiseido may let them, where you have consented, to use your Personal Data for the marketing and promotion of our products, services or events that may be of interest to you, for market research and analysis, for customer relationship management, for the fulfilment of your orders for products and services purchased via the Platforms, or for other purposes stated in Section 3 above. Please note that we provide our third party business partners with only the Personal Data they need to perform their services and we require that they protect such Personal Data in accordance with the applicable laws and regulations and this Privacy Notice, and not use it for any other purpose.


2. Some of our third party business partners may act as a data controller in the course of delivering specific services to you. Your use of their services may be subject to conditions as may be agreed between you and them. Upon your acceptance of their services, the collection, use, disclosure, transfer and processing of your Personal Data in respect of their services will be subject to their applicable privacy notices. You must direct to them any queries or complaints relating to your use of their services.


3. Our Platforms may also contain links to third party websites, applications or services that are outside our control (even though they may display our logo or our trademarks). To the fullest extent permitted under applicable laws, we are not responsible for these websites’, applications’ or services’: (a) privacy practices and data policies; (b) use of cookies; (c) content or security; or (d) other acts and omissions. We would encourage you to review the privacy notices applicable to the third party websites, applications and services you use to determine how they will handle any Personal Data they collect from you.

1. We may use third party service providers, located both within and outside of Vietnam, to help us maintain and operate the Platforms, to act on our behalf for the purposes stated in Section 3 above, as we may deem necessary to facilitate your dealings with us, and/or for other reasons related to the operation of the Platforms and Shiseido’s business (e.g. to manage the cloud servers), and they may receive your Personal Data for these purposes. We only provide them the Personal Data they need to provide these services on our behalf. We require these companies to protect the Personal Data in accordance with the applicable laws and regulations and this Privacy Notice, and to not use the information for any other purpose.

1. We may use and disclose your Personal Data to perform your instructions and, as relevant, (a) comply with legislative and regulatory requirements; (b) protect, enforce and/or defend the rights and/or properties of Shiseido, and its customers and employees; and/or (c) take emergency measures for the purpose of securing the safety of customers, Shiseido, or the general public. This may result in us needing to share your Personal Data with any persons, government agencies, statutory authorities and/or industry regulators for the purpose of complying with applicable laws or regulations, and to anyone to whom Shiseido has transferred or may transfer its rights and duties (e.g. to prospective and actual investors and other relevant third parties in the event of a potential or completed sale or other corporate transaction related to Shiseido and/or any of its affiliates).

1. In order to share content on or through social media, our Platforms may use functionalities, links or icons owned by our digital and social media partners. It may consist, for example, of the like or sharing buttons on social networks such as Facebook or Instagram. Such functionalities allow you to view content or share content, preferences and opinion on or in relation with our products and services. We are also using online tools such as Google, Facebook or Instagram (Google Analytics, Facebook Custom Audience or Conversion API) in order for us to optimize our ad targeting campaigns and ensure the delivery of advertising content that suits you best. The providers of these tools, functionalities, links or icons can directly identify you when you use it, or even if you do not use it but (i) you have an account to such social network or platform, or (ii) you are already known and identified by such providers. As soon as you view content or share content, preferences and opinion, our partners may connect your activities on our Platforms to other information they already own on you in their capacity as data controllers.


2. We may also use the lookalike functionalities (for example from Facebook) to build audiences similar to your profile in order to allow us or other brands of the Shiseido Group to target prospects that match your profile.


3. The above data processing is governed by our partners’ own privacy notices in their capacity as data controller. We strongly suggest that you visit and check the privacy notices of such online tools and to change your advertising or cookies preferences on those websites or platforms should you wish to opt out of advertising content.

7. SECURITY & PROTECTION

We maintain strict procedures, standards, and security arrangements to protect Personal Data in our possession or under our control. Upon receipt of your Personal Data, whether through physical or electronic means of collection, we will make the necessary security arrangements to protect such Personal Data as are reasonable and appropriate in the circumstances. Such arrangements may comprise administrative measures, physical measures, technical measures, or a combination of such measures.

When disclosing or transferring your Personal Data over the internet, we take all reasonable care to prevent unauthorised access to your Personal Data. However, no data transmission over the internet can be guaranteed as fully secure and you acknowledge that you submit information over the internet at your own risk.

Please note that any information you choose to share in public areas such as our Platforms' community features, or other social areas, is by definition considered as public and can be seen by anyone accessing the related platform.

8. RETENTION OF PERSONAL DATA

We may retain your Personal Data for as long as is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable law. After this period of time, we will destroy or anonymise any documents containing your Personal Data in a safe and secure manner.

9. GOVERNING LAW

This Privacy Notice is governed by Vietnam law.

10. CONTACT US

If you would like to access or correct any Personal Data which you have provided to us, submit a complaint in relation to your Personal Data, or have any queries about your Personal Data, please contact our Data Protection Officer by contacting us at dpo@scv.shiseido.vn. Alternatively, you may write to us at:

Attention: Data Protection Officer
SHISEIDO COSMETICS VIETNAM COMPANY LIMITED
27^th Floor, Vietcombank Tower, no 5 Me linh Square,
Ben Nghe Ward, Ho Chi Minh City, Vietnam

For General Enquiries: NARScustomerservice@scv.shiseido.vn

Please note that to process your request, we may ask you for proof of identity.

Date: June 01 2023