GLOBAL POLICY OF L’OREAL 

FOR BRANDSTORM VISITORS 2025-2026

 

L’Oréal’s ambition is to aim at being an exemplary corporate citizen to help make the world a better place. We place great value on honesty and clarity and we are committed to building a strong and lasting relationship with our visitors based on trust and mutual benefit. Part of this commitment means safeguarding and respecting your privacy and your choices.

Given this need for transparency and because  participating in a competition organized by the L'Oréal Group involves the processing of personal data within the meaning of the applicable regulations, in particular the General Data Protection Regulations ("GDPR"), it was our duty to inform you of our commitments in this respect and to adopt this privacy policy.

 

Our commitments:

  1. We respect your privacy and your choices.

  2. We make sure that privacy and security are embedded in everything we do.

  3. We are committed to keeping your data safe and secure, this includes working only with trusted partners. 

  4. We are committed to being open and transparent about how we use your data.

  5. We do not use your data in ways that we have not told you about.

  6. We respect your rights, and always try to accommodate your requests as far as is possible, in line with our own legal and operational responsibilities.

This  Policy sets out the different types of personal data that We may collect from you directly or from your interaction with us, how We may use it, the purposes for which We collect it, the people with whom We may share it with, how We protect it and keep it secure, and the rights you have with respect to such Data.

When you share personal data with us or when we collect or generate with our IT tools personal data about you, We do so in line with this  Policy. 

If you have any questions or concerns about your personal data, please contact us at:

 [email protected]

What will you find in this policy?

-WHO WE ARE, AND WHOM TO CONTACT?

-DETAILED PROCESSINGS

-YOUR RIGHTS

Who we are, and whom to contact?

Who is the Data Controller?

L’Oréal S.A. is responsible for and acts as data controller of the personal data that you share with L’Oréal and that it processed in the context of  Brandstorm contest.

The terms “L’Oréal », « We”, « Us” or “We” used in this Policy therefore mean, without further details 

-L’Oréal SA in its capacity as publisher of the Site, having its registered office at the following address: 14 rue Royale 75008 Paris

Except in exceptional cases involving certain entities, L'Oréal SA  for the processing of data for the purpose of administering Brandstorm contest, acts as controller within the meaning of the RGPD, which means that it defines the human, technical and material resources required for processing, as well as its purposes, i.e. its objectives.

 

Who is covered by this Policy?

The Policy applies to all persons who visit the specific pages of the Site.

In addition to this policy that is brought to the visitors’ attention when they access Our Site, visitors are invited to read the General Terms of Use of the Site and of the various tools available on the Site, which they accept and which they undertake to comply with by ticking the appropriate box for this purpose when they access these tools or by any other means indicated on this occasion.

 

What are the applicable rules to the processing implemented?

L'Oréal's tools allow you to vote to Brandstorm contest.

 

What does “Personal Data” mean?

 

“Personal data” means any information or pieces of information that could identify you either directly (e.g. your name, like email/home addresses/mobile phone or your profile pictures) or indirectly (e.g. through pseudonymized data such as a unique ID number, your computer’s IP address or your mobile device’s MAC address, as well as cookies, considered in our cookie policy available on the Site.

 

How do we collect, generate or receive your Personal Data?

As L'Oréal, We place you, whether you are a visitor of Our Site, at the heart of our concerns.

 

In particular, We would like to hear from you, get to know you and share with you interesting Brandstorm experience. To do son at each stage of this process, you may share personal data with Us, or We may collect personal data about you.

 

We may collect Data directly from you, which means that either you provide this information to Us or We collect it ourselves:

-Either you provide it to Us, for example when you fill in an account or contact form; 

-Or We collect them ourselves through the implementation of technologies for watching people's activity such as cookies for example.

We may also collect Data indirectly when We collect it from service providers or partners, as is the case when We collect data resulting from your answers when using the tools provided by our providers or partners such as questionnaires.

 

When We collect Data from you, We indicate the mandatory fields with asterisks. Some of the Data that We ask for from you is necessary for the following reasons:

-Provide you with the service you have asked for (e.g. to provide your e-mail address to confirm your vote); or

-Answer to a request that you have sent us, or

-Use some of the tools We have put in place as part of the Brandstorm contest 

-Comply with our legal requirements. 

When you access our Site as a simple visitor, you are not required to enter your personal data in order to browse the Site. We may, however, and provided We have your express consent, place cookies on Our Site in order to better understand your browsing habits, in accordance with Our cookie policy accessible in this website.

 

TABLE SUMMARIZING THE PERSONAL DATA PROCESSINGS MADE BY L’OREAL SA

During which  interactions may you provide and we may collect your data?

What personal data may we receive from you directly or resulting from your interaction with us?

 

How and why we may use your data ?

What is the legal basis for using your personal data?

 

Retention period

 

Account Creation and management

 

Information collected during the creation of an account on L’Oréal websites/app

Depending on how much you are interacting with us, those data may include:

-Name and surname; 

-Gender;

-Image;

-Email address;

-Address;

-Phone number;

-Age ;

-ID, username, and password;

-Country of residence

-Area of activity & studies

-User content as uploaded by the data subject, such as videos, pictures, texts, images, logos

-Brandstorm evaluation, as assessed by the Jury

 

 

To:

-Manage any competitions, surveys or contests you choose to enter;

-Respond to your questions and otherwise interact with you ;

-Allow you to manage your preferences;

-Performance of a contract

To provide you with the service you requested (e.g. create an account, complete a survey, or participate to competition).

2 years maximum

-Send you marketing communications (where you have asked us to) which may be tailored to your “profile” (i.e. based on the personal data we know about you and your preferences);

 

-Consent

To send you direct marketing communications or newsletter

 

-Monitor and improve our  websites/apps ;

-Run analytics or collect statistics

-Secure our websites/apps and protect you and us against fraud;

 

-Legitimate Interest 

To ensure our websites/apps remain secure, to protect them against fraud, and to help us better understand your needs and expectations and therefore improve our services, and brands.

 

Online browsing

 

Information collected by cookies or similar technologies (“Cookies”*) as part of your browsing on L’Oréal website/apps and/or on third-party website/apps.

 

 

For information on specific Cookies placed through a given website/app, please consult the relevant cookie table.

 

 

 

 

 

 

* Cookies are small text files stored on your device (computer, tablet or mobile) when you are on the Internet, including on L’Oreal Group’s websites.

Depending on how much you are interacting with us, those data may include:

-Data related to your use of our  websites/apps: 

-Where you came from;

-Login details;

-Pages you looked at;

-Videos you watched;

-Your location;

-Duration of your visit;

 

Technical information: 

-IP address;

-browser information; 

-device information.

 

A unique identifier granted to each visitor and the expiration date of such identifier. 

 

 

 

We use Cookies, where relevant, with other personal data you have already shared with us (such as previous purchases, or whether you’re signed up to our email newsletters) or the following purposes: 

-To allow proper functioning of our website/apps:

1/proper display     of the content;

2/creation and remembering of a cart;

3/creation and remembering of your login; 

4/interface personalisation such as language;

5/parameters attached to your device including your screen resolution, etc;

6/improvement of our websites/apps, for example, by testing new ideas. 

 

-To ensure the website/app is secure and safe and protect you against fraud or misuse of our websites or services, for example through performing troubleshooting.

 

-To run statistics:

1/To avoid visitors being recorded twice; 

2/To know users’ reaction to our advertising campaigns; 

3/To improve our offers;

4/To know how you discovered our websites / apps. 

-Legitimate interest: 

To ensure we are providing you with websites/apps, advertising and communications that are working properly and are continually improving for cookies that are (i) essential for the functioning of our     websites/apps, (ii) used to keep our     websites/apps  safe and secure. 

 

 

-Please refer to the Cookie banner / policy 

 

 

-To deliver online behavioural advertising: 

1/to show you online advertisements for products which may be of interest to you, based on your previous behaviour; 

2/to show you ads and content on social media platforms.

-To tailor our services for you:

1/to send you recommendations, marketing, or content based on your profile and interests; 

2/to display our     websites/apps in a tailored way like remembering your cart or login, your language, the user-interface customization cookies (i.e. the parameters attached to your device including your screen resolution, font preference, etc).

 

-To allow sharing of our content on social media (sharing buttons intended to display the site).

 

-Consent

For all other cookies.

 

 

Processings, access rights

No Profiling devices for analyzing your participation

In order to make an initial selection of participants, We use solutions developed by third party suppliers. This enables us to analyze your participation and your suitability for the contest.

These solutions are not based on profiling devices, i.e. automated processing consisting of using your data to evaluate your participation.

 

Who may access your Personal Data?

Your Personal Data is accessible to the Branstorm Department within the L’Oréal SA.

Your Personal Data may also be processed or hosted by trusted service providers

Insofar as L'Oréal requires specialized expertise to provide its services, your Data is made available to some of our service providers to strictly carry out the mission assigned to them by L'Oréal.

In this context, your Data may in particular be transferred to:

-Service providers which help us to provide and make digital tools and services available to you (e.g. a platform for Brandstorm vote, Trailhead Learning platform by Salesforce);

-Service providers which help us provide IT services.

-If We have to disclose or share your Data to comply with a legal obligation or a judicial or administrative decision, or for any other circumstances that you have agreed to; or to protect the rights, property or safety of L'Oréal, its customers or employees; 

-For the defense of L’Oréal’s rights in the context of litigation;

-If permitted by law.

-if We have obtained your consent

-If We sell or intend to sell a business or assets (by any means, including by sale of the business carrying on that business or owning those assets), We may disclose your Data to the purchaser of that business or assets and to potential purchasers for the purposes of an audit, including advice.

-We do not disclose your Personal Data under any other circumstances and do not sell it.

 

How long do We keep your Personal Data?

-Your Data is kept only for the time necessary for the purpose for which it is processed, or to meet our legal obligations. The retention periods for each processing purpose are shown in the summary table above.

-At the end of the retention periods, your Data will be deleted from our systems or made anonymous, unless their retention is necessary for legal protection purposes.

 

Where do we store your Personal Data and what security measures are taken to protect it?

1. Location of your Personal Data

-Your Personal Data is hosted in Europe.

2. Security measures

-We take all useful and reasonable precautions given the nature of the Personal Data and the risks that are presented by processing, to preserve the security of the Personal Data and, in particular, to prevent it from accidental of unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

-As such, we undertake to identify the risks your data may be exposed to and to implement measures to protect and secure your data that we consider proportionate to those risks. However, as the Internet is an open environment, the transmission of Data via the Internet cannot be completely secure. Therefore, despite our best efforts, we cannot guarantee that such risks will never occur considering of your Data that is transmitted via the Internet.

-In addition, We require third party service providers who access your Data on our behalf to do the same under the service agreements.

-Your rights
L’Oréal respects your right to privacy: it is important that you are able to control your Personal Data.You have the following rights regarding your Personal Data:

Your rights

What does this mean?

The right to be informed

You have the right to obtain clear, transparent and easily understandable information about how we use your personal data, and your rights. This is why we are providing you with the information in this Policy.

 

The right of access

You have the right to access to the personal data we hold about you (subject to certain restrictions). 

We may charge a reasonable fee taking into account the administrative costs of providing the information.

Requests manifestly unfounded, excessive or repetitive may not be answered to. 

To do this, please contact us at the details below. 

 

The right to rectification

You have the right to have your personal data rectified if it is incorrect or outdated and/or completed if it is incomplete. 

To do this, please contact us at the details below. If you have an account, it may be easier to correct your own data via your “My Account” function. 

 

The right to erasure/right to be forgotten

In some cases, you have the right to have your personal data erased or deleted. Note this is not an absolute right, as we may have legal or legitimate grounds for retaining your personal data. 

If you would like us to delete your personal data, please contact us at the details below.

 

The right to object to direct marketing

You can unsubscribe or opt out of our direct marketing communication at any time. 

It is easiest to do this by clicking on the “unsubscribe” link in any email or communication we send you. Otherwise, you can contact us using contact detail below.

 

The right to withdraw consent at any time for data processing based on consent

 

You can withdraw your consent to our processing of your data when such processing is based on consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. We refer to the table inserted in section “what data do we collect from you and how do we use it” especially the column “What is our legal basis for processing your data?” to identify where our processing is based on consent.

If you would like to object to withdraw your consent, please contact us at the details below. 

 

 

The right to object to processing based on legitimate interests

You can oppose at any time to our processing of your data when such processing is based on the legitimate interest. We refer to the tables inserted in section “what data do we collect from you and how do we use it” especially the column “What is our legal basis for processing your data?” to identify where our processing is based on legitimate interests.

To do so, please contact us at the details below. 

 

The right to lodge a complaint with a supervisory authority

 

You have the right to contact the data protection authority of your country in order to lodge a complaint against the data protection and privacy practices of L’Oréal. 

Do not hesitate to contact us at the details below before lodging any complaint with the competent data protection authority.

 

The right to data portability

You have rights to move, copy or transfer data from our database to another. This only applies to data that you have provided, where processing is based on a contract or your consent, and the processing is carried out by automated means. We refer to the tables inserted in section “what data do we collect from you and how do we use it” especially the column “What is our legal basis for processing your data?” to identify where our processing is based on the performance of a contract or on consent. 

For further details, please contact us at the details below.

 

The right to restriction

You have the right to request restriction of our processing of your data. This right means that our processing of your data is restricted, so we can store it, but not use nor process it further. 

It applies in limited circumstances listed by the General Data Protection Regulation which are as follow:

-the accuracy of the personal data is contested by the data subject (i.e. You), for a period enabling the controller to verify the accuracy of the personal data;

 

-the processing is unlawful and the data subject (i.e. You) opposes the erasure of the personal data and requests the restriction of their use instead;

 

 

-the controller (i.e. L’Oréal) no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;

 

 

-the data subject (i.e. You) has objected to processing based on the legitimate interests of the data controller pending the verification whether the legitimate grounds of the controller override those of the data subject.




If you would like to request restriction, please contact us at the details below.
 

The right to deactivate Cookies

You have the right to deactivate Cookies. The settings from the Internet browsers are usually programmed by default to accept Cookies, but you can easily adjust it by changing the settings of your browser.

 

Many cookies are used to enhance the usability or functionality of websites/apps; therefore disabling cookies may prevent you from using certain parts of our websites/apps as detailed in the relevant Cookie Table. 

 

If you wish to restrict or block all the cookies which are set by our websites/apps (which may prevent you from using certain parts of the site), or any other websites/apps, you can do this through your browser settings. The Help function within your browser should tell you how. For more information please consult the following links: 

http://www.aboutcookies.org/;

 

 

How to exercise your rights

 

The request to exercise any of your rights must come exclusively from you (unless you have given a mandate to a third party in due form) and must be made in writing to:

-L'Oréal SA when your request concerns a processing carried out on you as a visitor to Our Site , in which case you may contact Us by post at 41, rue Martre 92117 CLICHY, France, or by email at [email protected].

We will do our best efforts to answer your request within the applicable deadline, namely one to three months depending on the level of complexity of the request. In case of a mistake on your part regarding which L'Oréal entity is competent to answer your request, we will redirect your request so that it can be properly processed. We may ask you to clarify your request if it is not sufficiently precise, if we are unable to identify the right you wish to exercise or if we have any doubt as to your identity, in which case We may ask you to provide additional information and in particular proof of identity, which will be deleted after verification of your identity.

In addition, you acknowledge that we will not be required to answer your request if it is manifestly unfounded or excessive, and in particular if you make repetitive requests.

Contact us if you have any question or if you wish to exercise your rights

If you have any questions or comments about the way We process and use your Personal Data, or if you wish to exercise any of your rights mentioned above, please contact us at the following address, mentioning in the subject line your name as well as the mention "contact data privacy": [email protected].