Privacy Policy

1. Data controller

The controller of your personal data is 1108 BRANDS, a simplified joint-stock company (SAS) incorporated under French law with share capital of 400 000 €, whose registered office is located at 231 rue Saint-Honoré, 75001 Paris, France, registered with the Paris Trade and Companies Register under number 951 615 467, publisher of the website shop.mysosbeauty.com.

For any questions relating to your data, write to us at [email protected] or use our contact form.

2. Data that we process

— Identity and contact details: title, surname, first name, delivery and billing addresses, email address, telephone number.
— Orders and billing: products ordered, amounts, purchase history, invoices, credit notes, refunds, loyalty points.
— Payment: payment method used and transaction status. Payment data itself, in particular the card number, is entered and processed directly by our payment service providers.
— Customer relations: your messages, your requests for returns, reshipment, warranty service or investigation, as well as the photographs and videos that you voluntarily send us in support of a complaint.
— Reviews and content: published reviews, ratings, content that you send us.
— Browsing: IP address, browser identifier, pages viewed, products viewed, information collected by means of cookies and similar technologies (see Article 7).

Fields indicated as mandatory in our forms are necessary for processing your order or request; failing this, we will be unable to act upon it.

3. Purposes

— Management of orders, deliveries, returns and after-sales service — performance of the contract (Article 6.1.b of the GDPR).
— Billing and accounting and tax obligations — legal obligation (Article 6.1.c).
— Management of the customer account and loyalty programme — performance of the contract.
— Sending commercial information and newsletters — under the conditions laid down by the regulations applicable to direct marketing; you may unsubscribe at any time.
— Audience measurement, advertising and measurement of the performance of our campaigns — under the conditions laid down by the regulations applicable to cookies and trackers (Article 82 of amended French Law No. 78-17 of 6 January 1978).
— Moderation and publication of customer reviews — legitimate interest in informing other customers.
— Fraud prevention, website security and management of unpaid amounts — legitimate interest.
— Management of disputes and complaints — legitimate interest and, where applicable, legal obligation.

4. Retention periods

Your data is retained for the period necessary for the purposes described in Article 3, and then for the statutory retention periods and applicable limitation periods. In practice:

— Customer account: for the duration of the commercial relationship.
— Orders, invoices and accounting records: ten (10) years from the end of the financial year, pursuant to Article L.123-22 of the French Commercial Code.
— Communications with customer service, including attachments: while your request is being processed, and then for the applicable limitation periods.
— Direct marketing: until you unsubscribe or object.
— Cookies and trackers: the lifespan of each cookie is set by its issuer; it may be viewed at any time in your browser settings.
— Customer reviews: for the period during which the review is published.

You may ask us to erase your data at any time under the conditions set out in Article 8.

5. Recipients of your data

Your data is accessible to our authorised internal departments and is transmitted, to the extent necessary for each purpose, to the following categories of recipients:

— Carriers and logistics operators (Colis Privé, DPD, IMX and their partners): name, address, telephone number and email address, for delivery purposes.
— Payment service providers (HiPay, PayPal, Stripe, Tpay, Payzen): data necessary for the transaction and fraud prevention.
— Customer relationship tool: Zendesk, for managing your requests.
— Sending emails and SMS messages: Mailchimp, iSendPro, as well as our own sending servers.
— Audience measurement and user journey analysis: Google Analytics 4, Google Tag Manager, Microsoft Clarity.
— Advertising and advertising performance measurement: Google Ads, Meta (Facebook, Instagram), TikTok, Snapchat, Pinterest, Microsoft Advertising (Bing). These recipients receive technical identifiers and browsing data, as well as, where applicable, contact data transmitted in hashed form, for the purposes of measuring and targeting our campaigns.
— Website security and delivery: Cloudflare, Google reCAPTCHA.
— Translation of customer reviews: DeepL, Microsoft Translator.
— Hosting and managed services: ILIONA EURL, 231 rue Saint-Honoré, 75001 Paris, France.
— Authorities, officers of the court and advisers, where required by law or for the defence of our rights.

6. Transfers outside the European Union

Some of the recipients mentioned in Article 5 are established outside the European Union, particularly in the United States. The safeguards governing these transfers are based on the mechanisms provided for in Chapter V of Regulation (EU) 2016/679. You may obtain details of transfers concerning you by writing to us at [email protected].

7. Cookies and trackers

Our website uses cookies and similar technologies, including your browser's local storage. A cookie banner is displayed on the website.

The following are used:

— cookies necessary for the operation of the website: session, basket, security, storage of your choices;
— audience measurement and user journey analysis trackers: Google Analytics 4, Google Tag Manager, Microsoft Clarity;
— advertising and performance measurement trackers: Google Ads and DoubleClick, Meta (Facebook, Instagram), TikTok, Snapchat, Pinterest, Microsoft Advertising (Bing);
— security and delivery trackers: Cloudflare, Google reCAPTCHA.

You may view, block or delete cookies and locally stored data at any time through your browser settings (the “Privacy and security” section of Chrome, Firefox, Safari or Edge). The services mentioned above also provide settings relating to personalised advertising on their own websites. Deleting cookies necessary for the operation of the website may prevent the basket and checkout process from functioning correctly.

8. Your rights

Under the conditions laid down by Regulation (EU) 2016/679 and amended French Law No. 78-17 of 6 January 1978, you have the following rights: the right of access, rectification, erasure, restriction of processing, data portability and objection — including objection to direct marketing and related profiling —, the right to withdraw your consent at any time where processing is based on it, and the right to issue instructions regarding the fate of your data after your death.

These rights may be exercised by email at [email protected], via our contact form, or by post to 1108 BRANDS, 231 rue Saint-Honoré, 75001 Paris, France. We may ask you for proof of identity if there is reasonable doubt as to the identity of the applicant. We respond within the time limits provided for by Article 12 of Regulation (EU) 2016/679.

You may also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your country of residence.

9. Security

Communications between your browser and our website are protected by the HTTPS protocol, and access to data is restricted to authorised persons.

10. Minors

Our products and website are intended for adults. We do not knowingly collect data concerning minors under the age of fifteen. If you become aware that such processing is taking place, write to us at [email protected] so that we may erase it.

11. Amendment of this policy

This policy may be amended to reflect changes in our processing activities or in the regulations. The applicable version is the version published on this page, whose last updated date appears at the top.