Privacy policy
1.GENERAL
1.1What does this policy cover?
This Privacy Policy (the “Privacy Policy”) describes how we process personal data collected from individual users (“you” and “your”) through the e-commerce website https://xlash.com and its relevant localised versions (the “Website”). The Privacy Policy does not apply to other websites, applications or software integrated with the Website or to third-party products and services (for example, social media providers linked from the Website).
1.2What is personal data?
Personal data means any information that, directly or indirectly together with other information, can be linked to a living individual. Examples include:
-Name
-National identification number
-Delivery address
-Telephone number
-Email address
-Order history
-Usage data
1.3What does processing of personal data mean?
Processing includes any operation performed on personal data, whether or not by automated means. This includes, for example:
-Collection
-Recording
-Combination
-Transfer
-Erasure
1.4Who is responsible for your personal data?
The Website is owned and operated by:
Beauty Generation AB (“Xlash”)
| Company registration number: | 559150-3270 |
| Address: | Fiskargatan 8, 116 20 Stockholm, Sweden |
| Email: | hello@xlash.com |
Beauty Generation AB is responsible for the processing of your personal data through the Website and is therefore the data controller.
1.5Why are we allowed to process personal data?
For processing of personal data to be lawful, there must be a legal basis under applicable data protection law. Such legal bases include:
-Your consent.
-Processing that is necessary to perform a contract with you (in this case, the terms applicable to the Website, your purchase of products and, where relevant, your Xlash Rewards membership).
-Processing that is necessary to comply with a legal obligation, for example obligations to retain accounting records.
-Our legitimate interests, following a balancing test showing that our interest in the processing is not overridden by your interests, rights and freedoms.
2.PERSONAL DATA COLLECTED THROUGH THE WEBSITE
2.1What personal data do we collect?
As a starting point, we only collect the amount of personal data necessary for your use of the Website. We use your personal data for limited, specified and legitimate purposes expressly described in this Privacy Policy. In general, we use your personal data to provide access to the Website, maintain and improve it, process your orders, provide customer service and respond to enquiries, produce statistics concerning use of the Website and pursue our legitimate interests.
Below is a more detailed summary of the types of personal data we collect, the purposes for which we use them and the legal bases on which we rely.
Orders
Type of personal dataWhen you place an order on the Website, we collect your first name, last name, address, email address and telephone number.
PurposeWe use this information to send order confirmations and receipts, deliver your orders, contact you where necessary and provide customer service.
Legal basisProcessing necessary to fulfil the purchase is based on our contract with you. Where data is processed for accounting purposes, the legal basis is compliance with a legal obligation. Where data is processed after completion of the purchase in order to establish, exercise or defend legal claims, the legal basis is our legitimate interest in doing so.
Retention periodWe retain order data needed to fulfil your purchase and handle statutory conformity, complaint and related legal claims for the period required under the mandatory consumer law applicable to your purchase. Data that is not needed for these purposes is erased earlier. If a specific legal claim is still ongoing when the ordinary retention period expires, we retain only the data needed for that claim. We review the need at least annually and erase the data once the claim has been finally resolved and the data is no longer needed to enforce or defend the outcome. Information constituting accounting records is retained until the end of the seventh year following the end of the calendar year in which the relevant financial year ended, in accordance with the legal obligations applicable to Beauty Generation AB.
Payments
Type of personal dataWhen you make a payment, our payment service providers collect personal data such as your first name, last name, billing and delivery addresses and payment details (for example, card details). The data you must provide depends on the payment service provider you choose. We do not have access to your complete payment details; only certain personal data is made available to us by the payment service providers.
PurposePayment information is used to process payments and administer our accounting.
Legal basisProcessing necessary to handle your payment is based on our contract with you. Processing required for accounting purposes is based on a legal obligation.
Retention periodWe retain the payment data needed to complete and follow up the payment and handle refunds for twelve months after the payment or most recent refund was completed. Data still needed for a complaint is retained together with the relevant case in accordance with the rules for enquiries below. If a specific legal claim is ongoing when the ordinary retention period expires, we retain only the data needed for that claim and review the need at least annually. Accounting records are retained as described above.
Enquiries
Type of personal dataWhen you contact us by email, contact form or chat, we process the contact details you provide and the content of your message, including any attachments. If your enquiry concerns a purchase, we also process the order information needed to handle the matter.
PurposeWe use the data to answer and handle your enquiries and provide the information you have requested.
Legal basisWhere processing is necessary to perform our contract with you or, at your request, to take steps before a purchase, the legal basis is contract. For other general enquiries, the legal basis is our legitimate interest in answering questions and providing customer service. Where processing is required by law, the legal basis is compliance with a legal obligation. If the data is needed to establish, exercise or defend legal claims, we rely on our legitimate interest in doing so.
Retention periodGeneral enquiries and customer-service messages are retained for six months after the matter is closed so that we can follow up our response if you contact us again. Data no longer needed is erased earlier. For complaints concerning a purchase, we retain the necessary case material until the applicable statutory complaint or conformity period has expired, or for six months after the matter is closed, whichever is later. Health data is subject to the more limited retention described in section 2.5. Accounting information is retained in accordance with section 3.3.
Reviews
Type of personal dataWhen you submit a review of products you have purchased, we collect your name and any information you choose to include in the review.
PurposeWe use the data to display your review on the Website and provide other customers and potential customers with an opinion about our products.
Legal basisThe legal basis for publishing your review and the personal data displayed with it is your consent. You can withdraw your consent at any time by contacting us in accordance with section 6.4. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Retention periodWe retain the data until you ask us to delete your review or until we determine that it is no longer relevant, for example because the reviewed product has been discontinued.
Technical data and use of the Website
Type of personal dataWe process IP addresses, device and browser information, and technical events and error messages for operations and security. When you consent to analytics, we also process cookie identifiers, the pages and products you visit and information about how you use the Website.
PurposeTechnical data is used to keep the Website functioning, troubleshoot problems and detect misuse. Analytics is used to understand how the Website is used and improve content and functionality.
Legal basisProcessing necessary for operations and security is based on our legitimate interest in providing a secure and functioning website. Analytics involving personal data is based on your consent where consent is required.
Retention periodOperational and security logs are normally retained for no more than 30 days. Data needed to investigate a specific security incident is retained until the investigation and necessary measures have been completed; the need is reviewed at least every three months. Personal data used for analytics is retained for no more than six months from collection and is then erased or anonymised.
Customer account / Xlash Rewards
Type of personal dataWhen you create a customer account and become a member of Xlash Rewards, we process the contact and account information connected with your membership, such as your name, email address, telephone number and, where available through your account or purchases, your address. We also process information about your purchase history, returns, points balance, points earned and redeemed, membership level, and available and used member offers.
When you register a purchase made from an authorised retailer by uploading a receipt, we also process the receipt image and the information shown on it that is needed to verify the purchase, such as retailer, purchase date, product name and price.
PurposeWe use the data to create and administer your customer account and membership, register and verify qualifying purchases, calculate and adjust your points balance and any membership level, administer member benefits and point redemptions, and handle returns and other matters connected with Xlash Rewards.
We also process information about your purchase history and your use of Xlash Rewards to analyse your purchases and tailor member offers and discounts displayed to you or otherwise offered to you as part of the membership.
Legal basisProcessing necessary to create and administer the customer account, register purchases, calculate and adjust points, administer benefits and otherwise provide Xlash Rewards is based on our membership contract with you.
When we use purchase-history and membership-use data to select and tailor member offers, we rely on our legitimate interest in providing relevant member benefits and developing Xlash Rewards. You have the right to object to such processing as described in section 5.1.
If personalisation is based on information about how you use the Website collected through cookies or similar technologies for which consent is required, we use that information for personalisation only where you have provided the required consent. This processing is also described under “Technical data and use of the Website”.
Where processing is necessary to prevent or investigate misuse of Xlash Rewards, we rely on our legitimate interest in protecting the loyalty programme and its benefits against misuse.
Retention periodWe retain the account information needed for the membership for as long as your customer account or membership remains active. Information about qualifying purchases needed to calculate points during a rolling twelve-month period is retained for this purpose for twelve months from each purchase.
A receipt image uploaded to register a purchase made from an authorised retailer is retained only for as long as needed to verify the purchase and deal with questions concerning registration, and for no more than six months after upload. Data from the verified purchase needed to administer points may then be retained in accordance with the periods described above.
When you terminate your membership, account information that is no longer needed is erased within 30 days. Data also processed for other purposes, for example order handling, complaints, accounting or legal claims, may be retained separately for the retention periods specified for those purposes in this Privacy Policy.
2.2Commercial communications
We send commercial communications by email and SMS where you have consented to receiving such communications through the relevant channel. The legal basis is your consent.
Where permitted by applicable rules on electronic marketing, if we obtained your email address in connection with a purchase, we may also send information about our own similar products. The legal basis for the processing of personal data is our legitimate interest in marketing our own similar products to existing customers, subject to the conditions required by applicable law.
You may withdraw your consent or object to direct marketing at any time through the unsubscribe function in the message or by contacting us in accordance with section 6.4. This is free of charge and does not affect your purchase. We will then stop processing your data for direct-marketing purposes.
For consent-based communications, we use your contact details for no more than 24 months from when you most recently gave or actively confirmed your consent. Communications based on the existing-customer exception cease no later than twelve months after your most recent purchase. Both periods end earlier if you unsubscribe. After unsubscribing, we retain only the contact detail and suppression record necessary to prevent further communications. This data is not used for marketing and is removed when there is no longer any basis that could result in you being added to a mailing list again. We review the need at least annually. This processing is based on our legal obligation to respect your objection or withdrawal where such an obligation applies. Limited documentation of the content and timing of consent and any withdrawal is retained for three years after the consent ceased, based on our legitimate interest in demonstrating that communications were lawful and handling legal claims. If a dispute is ongoing, only the necessary documentation is retained until the dispute has been finally resolved.
2.3Transactional communications
We may send transactional messages by email or SMS where necessary to administer your purchase, for example order updates, payment receipts, invoices and shipping information. The processing is based on our contract with you or, where a message is required by law, a legal obligation. You cannot opt out of messages necessary for these purposes. Commercial communications are handled in accordance with section 2.2.
2.4Feedback and questions
If you contact us, we may record questions, answers, complaints, recommendations or compliments from you. We limit the personal data retained to what is necessary for the purpose. If the data can still be linked to you, including with the help of additional information, we treat it as personal data under this Privacy Policy. Data anonymised so that it can no longer be attributed to an identified or identifiable person is not personal data.
2.5Special categories of personal data
We do not ask you to provide health information in order to shop with us or receive general product information. If you make a complaint concerning a reaction to a product, information about, for example, irritation or allergy may be necessary to assess and handle your claim. We then process only the health data necessary to establish, exercise or defend legal claims. The legal basis is our legitimate interest in handling such claims under Article 6(1)(f) GDPR and, where applicable, the corresponding provision of other applicable data protection law; the exception permitting processing of health data is Article 9(2)(f) GDPR and, where applicable, its corresponding provision. The data is accessible only to persons who need it for the matter. Where necessary, it may be processed by our customer-service provider on our behalf or disclosed to legal advisers, insurers and competent authorities or courts where necessary for the claim and legally permitted. We do not use health data for marketing or customer profiling. We erase health data when it is no longer needed for the claim. After the matter is closed, it is retained for no more than six months unless there is a specific continuing need connected with a legal claim. Such a need is reviewed at least every six months. Accounting records should not contain more health information than necessary. Please do not provide more health information than the matter requires. If we receive irrelevant health information, we erase it without undue delay.
2.6Where we obtain your personal data
We obtain personal data from the following sources:
-Directly from you, for example when you provide personal data while purchasing from us, becoming a member, using your Xlash Rewards account or contacting us.
-Directly or indirectly through your activity on the Website; when you use the Website, we automatically collect technical information about your use of it.
-From third parties. We receive information about payment status, transaction numbers, payment amounts and refunds from payment service providers. From carriers and warehouse or logistics providers we receive information about shipment status, delivery and returns. We use this information to complete and follow up your purchase, deliver your goods and handle refunds. The legal basis is our contract with you. For information that must be processed for accounting purposes, the basis is a legal obligation. Retention periods are stated under Orders and Payments in section 2.1. Where we receive personal data from someone other than you, we provide the information required by applicable data protection law within the applicable time limit unless an exemption from the information obligation applies.
2.7Consequences of not providing personal data
If you decide not to provide personal data when we ask for it, we may be unable to carry out certain requested processes, for example process your order, and you may be unable to use all features of the Website, receive requested information or receive our response.
3.RETENTION OF PERSONAL DATA
3.1Retention period for personal data
We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy. Retention periods or the criteria used to determine them are stated for each processing activity in section 2. If you request rectification or erasure, we handle your request in accordance with section 5. Certain data may need to be retained after an erasure request, for example to comply with a legal obligation or to establish, exercise or defend legal claims. Once personal data is no longer necessary for its purpose and we have no other lawful basis to retain it, we securely erase it from our systems without undue delay. As a rule, we do not retain personal data longer than necessary.
3.2Retention of anonymous data
We may retain anonymous data, meaning data that can no longer be attributed to an identified or identifiable person, for the purposes described in this Privacy Policy. This may include retention for the period needed to operate our business, fulfil contractual obligations, pursue legitimate interests, conduct audits, comply with laws and regulations and resolve disputes.
3.3Retention required by law
Where we are legally required to retain personal data, we retain the data covered by that obligation for the prescribed period. Accounting information is retained until the end of the seventh year following the end of the calendar year in which the relevant financial year ended, in accordance with the legal obligations applicable to Beauty Generation AB. When the retention period expires, we erase or anonymise the data unless it is still needed for another stated purpose supported by a legal basis.
4.PROTECTION AND SHARING OF PERSONAL DATA
4.1How we protect your personal data
We implement appropriate technical and organisational security measures designed to protect your personal data against, among other things, loss, misuse, unauthorised access and disclosure. Our measures include secure networks, strong passwords, restricted staff access to personal data, multi-factor authentication, anonymisation where possible, regular updates and security patches, and careful assessment of our processors.
4.2When we share your personal data
We share only the personal data needed for the purposes described in this Privacy Policy. Recipients include providers of e-commerce platforms and IT operations, payment services, warehousing and logistics, transport, customer service, communications, and consent-based analytics and advertising.
For deliveries, necessary data such as name, address, contact information and delivery information is provided to the relevant carrier depending on the delivery option.
Providers that process data on our behalf and in accordance with our instructions are processors. This includes, for example, services used for IT operations, customer service and communications where they handle data solely on our behalf. Payment service providers may act as independent controllers for purposes such as credit assessments, fraud prevention and their own legal obligations. Carriers may have corresponding independent responsibility for processing where they determine the purposes and means themselves. The recipient’s own privacy information applies to such processing.
We may also share cookie and device identifiers and information about product views and purchases with digital analytics and advertising providers to tailor and measure advertising. We do not sell your personal data to other companies for their own direct marketing.
Disclosure is limited to what is necessary to:
-Ensure that the Website functions properly.
-Deliver the products you have ordered.
-Handle your payments.
-Respond to your enquiries.
-Protect our rights and security and prevent or detect fraud.
-Fulfil our contractual obligations.
-Disclose data to competent authorities where required by law or where the disclosure otherwise has a lawful basis.
4.3International transfers of personal data
Beauty Generation AB is established in Sweden within the European Economic Area (“EEA”). Some of our processors or other recipients may be located outside the EEA, which may involve transfers of personal data to third countries. Where we make such a transfer, we ensure that a lawful transfer mechanism is in place, for example an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. You can contact us if you would like more information about the safeguards used for a particular transfer.
5.YOUR RIGHTS
5.1Control over processing
Subject to limitations provided by law, you have the following rights in relation to our processing of your personal data:
-Right of access – you can obtain a copy of the personal data we hold about you and information about the purposes for which it is processed.
-Right to rectification – you can ask us to correct inaccurate or incomplete data about you.
-Right to erasure – you can ask us to erase your personal data in the circumstances provided by law.
-Right to restriction – you can ask us to restrict processing of your personal data in the circumstances provided by law.
-Right to data portability – where the legal conditions are met, you can ask us to provide personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
-Right to object – where we process personal data on the basis of legitimate interests, you have the right to object on grounds relating to your particular situation. We may then continue the processing only if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if processing is needed to establish, exercise or defend legal claims. You always have the right to object to processing for direct marketing, including profiling related to such marketing. We will then stop processing for those purposes.
-Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time. You can do so through the function where the consent is managed, for example the unsubscribe link in a communication or the Website’s cookie settings, or by contacting us in accordance with section 6.4. It must be as easy to withdraw consent as to give it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
-Right to lodge a complaint – you can lodge a complaint concerning our processing of your personal data with a competent supervisory authority.
5.2Exercising your rights
If you wish to exercise any of the rights above, you can contact us by email at hello@xlash.com. You may use the subject line “Data protection request” and describe the right you wish to exercise. No particular wording is required for us to handle your request.
If we have reasonable doubts about your identity, we may request the additional information necessary to confirm it. We will not request more information than necessary.
We handle your request without undue delay and within the time limit required by applicable data protection law. Under the GDPR, this is normally one month from receipt, with a possible extension of up to two additional months where necessary due to the complexity or number of requests. We will inform you within the initial period if an extension applies and explain the reasons. If we do not take the action you requested, we will inform you of the reasons and of your right to complain to a supervisory authority and seek a judicial remedy.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country of your habitual residence, place of work or the place of the alleged infringement. Because Beauty Generation AB is established in Sweden, you may also contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se. You do not have to contact us before lodging a complaint, although contacting us first may allow us to resolve the matter more quickly.
6.OTHER INFORMATION
6.1Validity
This Privacy Policy takes effect on the date stated at the top of the Privacy Policy (“Last updated”) and remains in force until it is replaced or updated by us.
6.2Changes and updates
We may revise this Privacy Policy from time to time. The current version is published on the Website and the date of the most recent update is stated at the top of the Privacy Policy. We will inform you appropriately of material changes. If we intend to process your personal data for a purpose other than the purpose for which it was collected, we will provide information about the new purpose and other relevant information before such processing begins. Where the changed processing requires your consent, we will obtain it before the processing begins.
6.3Personal data relating to minors
If we process personal data relating to persons under 18, we take particular account of their need for protection and adapt information about the processing so that it is clear and understandable. Where consent from a parent or guardian is required under applicable data protection law, we obtain such consent before processing begins. If you are a parent or guardian and believe that we are processing your child’s personal data unlawfully, you can contact us in accordance with section 6.4. We will investigate the processing and erase data that we have no right to process. Data that must be retained to comply with a legal obligation or to establish, exercise or defend legal claims may need to be kept.
6.4Contact
Please contact us if you have questions about this Privacy Policy, our processing of your personal data or if you wish to exercise your rights. Our contact details are:
Beauty Generation AB (“Xlash”)
| Company registration number: | 559150-3270 |
| Address: | Fiskargatan 8, 116 20 Stockholm, Sweden |
| Email: | hello@xlash.com |
