1. PREAMBLE
1.1. This Privacy Policy forms an integral part of the General Terms and Conditions, so the definitions used in the latter are reused in this Privacy Policy. It explains how LABORATOIRES SVR processes Personal Data when you use the Website, purchase Products (online or in store) or otherwise interact with us in the United Kingdom. This Privacy Policy is drafted to comply with the UK General Data Protection Regulation (âUK GDPRâ) and the UK Data Protection Act 2018, as well as the UK rules implementing the Privacy and Electronic Communications Directive 2002/58/EC (the âPECRâ) which apply to electronic marketing and cookies.Â
1.2. The purpose of this Privacy Policy is to inform Customers about how their Personal Data is collected from the Website, its variations on different Terminals as well as during your purchases in store or, more generally, whenever you interact with us, how this is processed by the Data Controller and finally the Specific Rights that Customers have with regard to this processing as defined below, including rights under the UK GDPR.Â
1.3. This Privacy Policy forms part of the UK data protection framework, including in particular the UK GDPR, the Data Protection Act 2018 and the PECR rules applicable in the United Kingdom.]
1.4. This Privacy Policy may be modified or updated at any time. It is recommended that you consult it regularly, particularly during each interaction with the relevant services, in order to stay informed of practices regarding the protection of Personal Data and the procedures for exercising your rights.âŻ
2. DEFINITIONS
2.1. The following terms, whether used in the singular or plural in this Privacy Policy, shall have the following definitions:
Intermediate Archiving: refers to the retention of Personal Data that is no longer necessary for the initial purpose of its processing, but which still has administrative value for the Data Controller, particularly in the event of a legal obligation to retain data or for the management of litigation. This Personal Data is moved to a separate database, logically or physically isolated, and whose access is, in any case, strictly limited to authorized personnel and subject to enhanced security measures. This archive is an intermediate step before the final deletion of the Personal Data concerned or its anonymization;
CG : refers to the General Terms and Conditions;
Privacy Policy : refers to this privacy and personal data protection policy for Clients implemented by the Data Controller;
Client : refers to the natural person browsing the Website or making a purchase and whose Personal Data Processing by the Data Controller is governed by the Privacy Policy. Where certain Processing is based on consent, the Client guarantees, if under 13 years of age and located in the United Kingdom, that they have obtained the authorization of the holder of parental authority to consent to the Processing of their Personal Data as defined in the Privacy Policy:
Account : refers to the Client's personal account, accessible on the Website via personal identifiers, confidential to the Client which he/she cannot disclose to a third party, and from which he/she can place an order;
Recipient : refers to any natural or legal person, public authority, agency, or other body to whom Personal Data is disclosed, whether a third party or not. The Recipient may use the data for its own purposes or in compliance with a legal obligation. However, authorities that may receive Personal Data in the context of a specific inquiry are not considered recipients within the meaning of the GDPR.
Data or Personal Data : refers to the Client's personal data, as defined by the Personal Data Regulations, collected and processed by the Data Controller in connection with the use of the Website;
Specific Rights : refers to the rights granted by the Personal Data Regulations to Customers regarding the processing of their Personal Data and developed in Article 12 of the Privacy Charter;
Purpose : refers to the main objective of the use of Personal Data;
Products : refers to the products offered for sale in store or on the website by LABORATOIRES SVR.
Regulation on Personal Data : Regulation on Personal Data: refers to, as applicable to Customers in the United Kingdom, the UK General Data Protection Regulation (âUK GDPRâ), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (âPECRâ), and, where relevant, any directly applicable EU law which continues to form part of UK law, as amended from time to time.Â
Data Controller : refers to the company that determines the purposes and essential means of processing personal data (see paragraph 3 â Data Controller). The Data Controller ensures that the processing it carries out complies with applicable regulations on the protection of personal data and guarantees data subjects the exercise of their specific rights. ;
Website: refers to the website and its local versions on which this Privacy Policy is hosted;
Subcontractor : refers to any natural or legal person who processes Personal Data on behalf of the Data Controller and according to its instructions. The Subcontractor undertakes to process Personal Data only for the Purposes determined by the Data Controller, to implement appropriate technical and organizational security measures , and to provide sufficient guarantees regarding compliance with the GDPR .
Terminal(s): refers to the hardware equipment (computer, tablet, smartphone, telephone, etc.) used by the Client to consult or view the Website.
Processing : refers to any operation or set of operations which is performed on Personal Data, whether or not by automated means. This may include, in particular, the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission or dissemination, alignment, restriction, erasure or destruction of Personal Data.
Special Category Data: refers to Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural personâs sex life or sexual orientation, within the meaning of the UK GDPR. For the purposes of this Privacy Policy, references to âhealth dataâ are Special Category Data.]
Profiling: refers to any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural personâs preferences, interests, purchasing behaviour or location, in accordance with the UK GDPR.
3. THE DATA CONTROLLER
3.1. The company LABORATOIRES SVR, a simplified joint-stock company with a capital of 17,501,502 euros, whose registered office is located at 2 Rue de la Mare à Blot, ZAC de la Tremblaie, 91220 Le Plessis-PâtÊ, France, registered with the Trade and Companies Register of Evry under number 617 080 098, is the Data Controller of the Personal Data collected on this Website, unless otherwise stated, including when the Website is used by Customers located in the United Kingdom.
3.2. Where required by the UK GDPR for organisations not established in the United Kingdom but offering goods or services to individuals in the UK, LABORATOIRES SVR may appoint a UK representative. Details of any such representative, if appointed, will be made available in the legal notices of the Website or by request using the contact details set out in paragraph 12.
4. DATA COLLECTED
4.1. In particular, within the context of creating an Account, managing the Website or browsing, or purchasing Products online or in store, the Data Controller collects and processes the following Personal Data:Â
-
Name,
-
First name,
-
Civility,
-
Date of birth,
-
Email address,
-
Phone number,
-
User name,
-
Password,
-
Delivery postal address,
-
Billing mailing address
-
Company name, if applicable
-
Information relating to an order (including purchase history, payment data via online payment provider),
-
Amount, date and time of transactions carried out
-
Bill,
-
Customer connection data during browsing on the Website (including date, time, IP address, page viewed),
-
Reason(s) for exclusion, if applicable (including all elements demonstrating actions that occurred less than one month ago and justify the exclusion),
-
Content saved in the Customer Account (including correspondence with Customer Service, preferences, loyalty program membership, [ADD: information you choose to provide about your skin type, skin concerns or other health-related information in order for us to recommend or adapt Products (âhealth dataâ), which is treated as Special Category Data under the UK GDPR
-
Any other Personal Data provided during exchanges or received from external suppliers.
4.1.A. For clarity, the Personal Data we process about you may be grouped into the following categories:
⢠Identification Data (e.g. name, surname, title, date of birth, customer ID);
⢠Contact Data (e.g. postal address, email address, telephone number);
⢠Account and Profile Data (e.g. username, password, saved preferences, loyalty programme status);
⢠Transaction and Financial Data (e.g. order history, transaction amounts and dates, partial payment details processed via our payment providers â we do not store your full card details);
⢠Technical and Usage Data (e.g. IP address, device and browser type, login data, pages viewed, clickstream data, cookies and similar technologies â see our Cookies Policy);
⢠Marketing and Communications Data (e.g. your choices about receiving newsletters and offers, your responses to campaigns or surveys);
⢠Health Data / Special Category Data (e.g. information you provide about your skin, dermatological conditions or other health-related information when you contact us or complete online forms for product advice);
⢠Exclusion and Security Data (e.g. reasons for exclusion from services, fraud indicators, logs and audit trails)
4.2. This Personal Data is provided directly by the Client or collected automatically during their browsing on the Website, in accordance with the applicable legal bases, and in particular when their collection is based on the consent of the person concerned.
4.3. All Personal Data indicated as such in the Account creation form is essential to benefit from the services of the Data Controller.
4.4. We may use certain categories of Personal Data (in particular Identification Data, Contact Data, Account and Profile Data, Transaction and Financial Data, Technical and Usage Data and Marketing and Communications Data) for profiling purposes in order to better understand your preferences and purchasing behaviours and to provide you with personalised offers and recommendations on Products. Such profiling does not produce legal effects concerning you or similarly significantly affect you within the meaning of the UK GDPR.
5. THE LEGAL BASIS FOR PROCESSING
5.1. In accordance with the Personal Data Regulations applicable in the United Kingdom, including the UK GDPR and the Data Protection Act 2018, the Processing designated in this Privacy Policy is supported by one or more specific legal bases.
5.2. Consent
5.2.1. Where required, the Processing of Personal Data is based on the free, specific, informed and unambiguous consent of the Client.
5.2.2. The Client consents to the Processing of their Personal Data for one or more specific Purposes, including:
⢠Sending newsletters and commercial communications (including personalised offers based on your profile and purchase history);
⢠Participation in certain specific marketing operations (competitions, promotions, surveys);
⢠Registration for the loyalty program;
⢠The collection and use of health data (Special Category Data) that you voluntarily choose to provide to us (for example, information about your skin or dermatological conditions) so that we can provide you with personalised advice and recommendations on our Products.
5.2.3. The Website collects the Client's express consent prior to implementing any specific processing, in accordance with the information provided when collecting consent.
5.2.4. The Client may withdraw their consent at any time, without having to justify the reason, and this withdrawal does not affect the lawfulness of the Processing carried out before its exercise, and this under the conditions of paragraph 12 â Exercise of Specific Rights of Clients.
5.2.5. Where we process your health data or other Special Category Data, we will only do so where you have given your explicit consent in accordance with Article 9(2)(a) UK GDPR, or where another exemption under the UK GDPR and the Data Protection Act 2018 applies.
5.3. Contract Performance
.3.1. Certain Processing is necessary for the performance of a contract to which the Client is a party or for the performance of pre-contractual measures taken at the Client's request.
5.3.2. In order to use the Website and benefit from its services, the Client has accepted at least the General Terms and Conditions. These documents formalize a contractual relationship between the Client and the Data Controller, serving in particular as the legal basis for the collection and processing of the Client's Personal Data by the Data Controller.
5.3. This Data is necessary for the performance of a number of processing operations related to the execution of the contractual relationship between the Client and the Data Controller, including:
-
The creation and management of the Customer Account;
-
Order processing and tracking;
-
Delivery management;
-
Billing and payments;
-
After-sales service and returns.
5.4. The Legal Obligation
5.4.1. Certain processing operations are necessary for compliance with legal obligations to which the data controller is subject, including:
-
The retention of invoices and accounting documents;
-
The fight against tax fraud;
-
Managing requests to exercise Specific Rights;
-
Obligations related to the legal guarantee.
5.4.2. The Processing of Personal Data may also be necessary to comply with a legal obligation to which the Data Controller is subject, such as the retention of access logs to the Website and records required for tax and accounting purposes, in accordance with applicable UK and French law.
5.5. Legitimate Interest
5.5.1. Certain Processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, unless the interests or fundamental rights and freedoms of the Client which require protection of Personal Data prevail, in particular where the Client is a child.
5.5.2. The Data Controller may have a legitimate interest justifying the processing of the Client's Personal Data, including:
⢠Securing the Website and our IT systems;
⢠Improving the Website and the user experience;
⢠Customer review management;
⢠The fight against payment fraud;
⢠Analysing and improving our Products and services, including the development of statistics, segmentation and profiling for marketing analysis, provided such processing is proportionate and respects your rights and freedoms.
5.5.3. The Data Controller ensures that the Processing in question is indeed necessary for the achievement of its legitimate interest and assesses the consequences of this Processing on the Client, in particular taking into account the nature of the Data processed, and the way in which it is processed.
5.5.4. The Client may, at any time, object to all or part of the processing described in this Privacy Policy, as well as implement his Specific Rights, under the conditions of paragraph 12 â Exercise of Specific Rights of Clients.
5.5.5. Where we rely on our legitimate interests for direct marketing or related profiling, you have the right to object at any time to such Processing. If you object, we will no longer process your Personal Data for these purposes.]
6. PURPOSES OF DATA PROCESSING
6.1. The Customer's Personal Data is necessary to enable them to access, use and improve the Website, and to enable the Data Controller, in particular, to :
-
Managing all operations related to its commercial relationship with the Client, i.e. concerning the issuance of invoices, accounting, monitoring of the "customer relationship" with a Client, such as conducting satisfaction surveys, managing complaints, use of the Website and more generally of services, etc.;
-
Allow the Customer access to the Account and provide them with all the information contained therein, such as their orders, address book, the products they have saved, their preferences;
-
To ensure the placement of an order and the monitoring of the delivery of products;
-
Manage after-sales service, support requests and commercial complaints;
-
To personalize its communication for Customers, in particular through informational emails, based on their observed preferences, their use of services and/or the Website, and, where you have consented, on health data that you have provided to receive tailored skincare advice;
-
Carry out commercial solicitation operations;
-
To allow Customers to access personalized offers on Products, including through profiling based on your purchasing history, browsing activity and stated preferences, without producing legal effects concerning you or similarly significantly affecting you within the meaning of the UK GDPR;
-
Develop commercial statistics, analyses and marketing tools (including classification, scoring, etc.);
-
Optimize the Customer's navigation on the Website by remembering their preferences and simplifying any subsequent purchases on the Website;
-
Manage customer reviews and comments on the website;
-
Improve the quality of the Website, services and user journey, in particular through the analysis of browsing data;
-
To ensure compliance with its legal obligations, particularly those of an accounting and tax nature;
-
Manage requests to exercise Specific Rights under the conditions of paragraph 12 â Exercise of Specific Customer Rights;
-
Participate in the fight against fraud and money laundering;
-
Managing unpaid invoices, preventing payment defaults and handling debt collection procedures;
-
Preventing disputes and managing any potential litigation with the Client;
-
To ensure the security of the Website, to detect and prevent fraudulent activities;
-
To process any other Personal Data that the Customer provides during their interactions with customer service or the company; and
-
Manage, where applicable, specific situations of exclusion from the service and the elements justifying these measures.
7. STORAGE OF PERSONAL DATA
7.1. The Website is hosted by the company whose contact details are available by clicking here. Depending on the services used, your Personal Data may be stored on servers located within the United Kingdom, within the European Economic Area (EEA), or in other countries that provide an adequate level of protection as described in paragraph 9.
7.2. All appropriate technical and organisational measures have been taken to store Customer Personal Data in a secure environment and to prevent it from being altered, damaged, lost or accessed by unauthorized third parties. Information provided by the Customer will never be transmitted to third parties for their own commercial prospecting purposes, nor sold or exchanged, without your consent.Â
8. RECIPIENTS OR CATEGORIES OF RECIPIENTS, IF ANY
8.1. The Data Controller does not, under any circumstances, sell or rent Personal Data to third parties, in particular for commercial prospecting purposes.
8.2. For the Purposes listed below, the Data Controller shares Personal Data with:
⢠Service providers and Subcontractors who act on our instructions (for example, payment providers, IT hosting providers, email and SMS routing providers, customer support tools, logistics and delivery providers, marketing and analytics providers);
⢠Professional advisers (for example, lawyers, auditors, insurers), where necessary for the protection of our legitimate interests and in compliance with confidentiality obligations;
⢠Public authorities, regulators, law-enforcement bodies and courts, where we are required to do so by applicable law or where this is necessary to establish, exercise or defend legal claims;
⢠Other entities of the SVR group, to the extent necessary to manage your orders, your Customer Account, the loyalty programme and for internal administrative purposes, in accordance with the applicable data protection rules.]
These Recipients are bound by contractual and/or legal obligations to protect your Personal Data and to use it only for the purposes described above.
|
Actors |
Data Recipient Categories |
Purpose of the envisaged transfer |
|
Shopify |
Accommodation service provider |
Website Hosting |
|
BlackSwan |
Website development and management providers |
Administration of the website's "back-office" and management of the database containing customers' personal data. |
|
BlackSwan |
IT integrator and maintenance |
Remote maintenance of the Data Controller's information system, including the Website |
|
Klaviyo |
Email routing provider |
Sending newsletters |
|
Klaviyo |
Telephone flow manager |
Monitoring of various calls and telephone flows |
|
ClinReal |
Provider of support in managing customer vigilance and complaints |
Customer Complaint Management and Materials Safety |
|
/ |
Provider of auditing and regulatory compliance services |
Compliance of the information system with regulations on medical and cosmetic products |
|
/ |
Electronic document management provider |
Electronic invoice management |
|
Humming-bird |
Publisher of economic analysis software tools |
Sales forecasts |
|
/ |
Social networks and advertising services, including social network management |
Communication management and targeted advertising on the Facebook website and the Instagram mobile application |
|
Optimize matter |
SEO and statistical tools service |
Website SEO and Website Data Analysis |
|
Zee Agency |
Communication agency |
Communication consulting |
|
Axeptio |
Cookie management provider |
Collecting customer consent for the placement of cookies and subsequently recognizing the customer and their consent |
|
Stripe |
Payment service provider |
Payments on the Website |
|
BigBlue Wise Shopify |
Publisher of warehouse logistics management software |
Connecting the IT system to the warehouses |
|
BigBlue |
Parcel delivery service provider |
Shipping of products ordered by Customers |
9. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
9.1. The Data Controller endeavours to process the Client's Personal Data within the United Kingdom and/or the European Economic Area (EEA).
9.2. However, some Recipients who may be involved in the Processing may be located outside the United Kingdom and the EEA or process Personal Data from a third country.Â
9.2.1. Any transfer of Personal Data to a country outside the United Kingdom and/or the EEA is governed in accordance with the provisions of Chapter V of the UK GDPR and, where relevant, Chapter V of the EU GDPR.
9.2.2. These transfers can only take place:
⢠To countries in respect of which an adequacy decision or adequacy regulation has been adopted by the competent authority (for example, the UK government in relation to transfers from the UK, or the European Commission in relation to transfers from the EEA); or
⢠When appropriate safeguards to ensure a level of protection essentially equivalent to that in the United Kingdom and/or EEA have been put in place (for example, the use of standard contractual clauses or the International Data Transfer Agreement / Addendum approved by the UK Information Commissionerâs Office), and the Client has enforceable rights and effective legal remedies; or
⢠In the limited cases provided for by the UK GDPR and/or EU GDPR (for example, when the transfer is necessary for the performance of a contract concluded with the Client or when the Client has given explicit consent to the transfer).
9.2.3. The Data Controller shall in all cases ensure that appropriate technical, organisational and legal safeguards are implemented to ensure a level of protection substantially equivalent to that guaranteed in the United Kingdom and/or the EEA.
9.2.4. The Client can obtain further information on transfers outside the United Kingdom and/or the EEA or on applicable safeguards by contacting the Data Controller in accordance with the procedures set out in paragraph 12 - Exercising Specific Client Rights.
10. STORAGE TIMES
10.1. The Data Controller retains Personal Data only for the period necessary to achieve the Purposes for which it was collected.
10.2. Personal Data may be kept for longer periods in intermediate archiving when necessary for the management of litigation or to comply with a legal obligation.
10.3. For the purposes listed below, the Data Controller retains Personal Data for:
|
Purpose of the Processing |
Duration in active base |
Intermediate archiving period |
|
Customer Account Management |
3 years from the last contact with the Data Controller |
5 years for evidence in case of a commercial dispute |
|
Order management (purchase, delivery, after-sales service) |
Duration of the contractual relationship |
5 years for the civil statute of limitations |
|
Billing and accounting management |
10 years from the date of the order |
|
|
Bank card details stored on the Website (excluding the security code) |
Expiry date + 1 day (subject to the storage times indicated below) |
|
|
Bank card details, whether stored or not (excluding the security code), are used for the purpose of managing potential claims. |
|
|
|
Sales prospecting management |
3 years from the last contact with the Data Controller |
|
|
Cookies and trackers |
13 months from the date of consent |
|
|
Identity document provided in the context of exercising Specific Rights |
1 year from the date of receipt by the Data Controller |
10.4. At the end of these periods, Personal Data is deleted or anonymized, unless otherwise required by law.
11. SECURITY
11.1. The Data Controller shall implement appropriate technical and organizational measures, proportionate to the nature of the Personal Data processed and the risks involved in its Processing, in order to ensure its security and confidentiality. These measures shall aim in particular to prevent any alteration, loss, destruction, as well as any unauthorized access to Personal Data.
11.1.1. In this capacity, the Data Controller may implement, as needed, in particular:
-
Strict access control, limited to authorized staff members only, due to their functions;
-
Specific contractual measures, in particular when a Recipient processes this Personal Data on its own behalf;
-
Data Protection Impact Assessments (DPIAs) when these processing operations require it;
-
Regular reviews of internal practices and policies regarding the protection of Personal Data;
-
Physical and logistical security measures, including enhanced authentication, the use of firewalls and antivirus software, pseudonymization , encryption of Personal Data and any other appropriate measures aimed at ensuring the integrity, availability and confidentiality of Personal Data.
11.2. In accordance with the General Terms and Conditions, the Website uses the technology of the various payment companies offered on the Website, to secure the banking transactions of Customers.
11.2.1. Thus, when paying on the Website, the Client's bank details are transmitted in encrypted form to the relevant payment company.
11.2.2. To exercise his rights such as those identified in paragraph 12 â Specific Rights, relating to his bank card details, the Customer is invited to contact the relevant payment company directly.
12. RIGHTS OF CLIENTS AND HOW TO EXERCISE THEM
12.1. In accordance with the Personal Data Regulations applicable in the United Kingdom, in particular the UK GDPR and the Data Protection Act 2018, Customers whose Personal Data is processed by the Data Controller benefit from the following rights (together, the âSpecific Rightsâ):
⢠Right of access: you have the right to obtain confirmation as to whether or not we process Personal Data concerning you and, where that is the case, to access such Personal Data and to receive information about how it is processed (Article 15 UK GDPR);
⢠Right to rectification: you have the right to request the correction of inaccurate Personal Data concerning you and to have incomplete Personal Data completed (Article 16 UK GDPR);
⢠Right to erasure (âright to be forgottenâ): in certain cases, you have the right to request the deletion of your Personal Data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw your consent and there is no other legal basis for the Processing (Article 17 UK GDPR);
⢠Right to restriction of Processing: in certain cases, you have the right to request that we restrict the Processing of your Personal Data, for example while we verify the accuracy of the data or where you have objected to our Processing based on legitimate interest (Article 18 UK GDPR);
⢠Right to data portability: where the Processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the Personal Data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, or to ask us to transmit it directly to another controller where technically feasible (Article 20 UK GDPR);
⢠Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the Processing of your Personal Data which is based on our legitimate interests (Article 21 UK GDPR). We will no longer process your Personal Data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims;
⢠Right to object to direct marketing: you have the right to object at any time to the Processing of your Personal Data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. Where you exercise this right, we will no longer process your Personal Data for such purposes;
⢠Rights in relation to automated decision-making and profiling: you have the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in certain limited circumstances provided for by the UK GDPR (Article 22 UK GDPR). As indicated in paragraph 4.4 above, we do not carry out such automated decision-making;
⢠Rights in relation to Special Category Data (including health data): where we process your health data or other Special Category Data on the basis of your explicit consent, you may withdraw that consent at any time. This will not affect the lawfulness of the Processing carried out before your withdrawal, but we will stop the Processing concerned for the future unless another legal basis applies.
12.2. To exercise your Specific Rights, you may contact us at any time by using the following contact details:
⢠By email: [ADD: insert dedicated privacy / data protection email address, e.g. privacy@svr.com];
⢠By post: LABORATOIRES SVR, [ADD: Data Protection Officer / Privacy Team], 2 Rue de la Mare à Blot, ZAC de la Tremblaie, 91220 Le Plessis-PâtÊ, France;
⢠Via the contact form available on the Website, by selecting the appropriate subject (for example âPersonal Dataâ or âPrivacyâ).
12.3. For security reasons and in order to protect the confidentiality of your Personal Data, we may ask you to provide proof of identity or additional information to verify your identity before responding to your request.
12.4. We will respond to your request as soon as reasonably possible and in any event within the time limits prescribed by the Personal Data Regulations (in principle within one month of receipt of your request, which may be extended by two further months in complex cases, in which case we will inform you of the extension and the reasons for the delay).
12.5. In certain cases, in accordance with the UK GDPR, we may refuse or partially refuse to act on your request, for example where your request is manifestly unfounded or excessive, or where we need to retain certain Personal Data in order to comply with a legal obligation or to establish, exercise or defend legal claims. In such cases, we will explain the reasons for our decision.
12.6. Where you believe that the Processing of your Personal Data infringes the Personal Data Regulations, you also have the right to lodge a complaint with the competent supervisory authority. For Customers located in the United Kingdom, this is the Information Commissionerâs Office (ICO):
⢠Website: https://ico.org.uk/
⢠Telephone: +44 303 123 1113
⢠Postal address: Information Commissionerâs Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.
12.7. We encourage you to contact us first using the contact details above so that we can try to address your concerns directly before you contact the ICO or any other supervisory authority. END MODIFY]
(For legal references, the main rules are the UK GDPR and Data Protection Act 2018, available at:
-
UK GDPR as retained EU law:Â https://www.legislation.gov.uk/eur/2016/679/contents
-
Data Protection Act 2018:Â https://www.legislation.gov.uk/ukpga/2018/12/contents)
13. CHILDREN
13.1. Our Website and Products are primarily intended for adult Customers. We do not knowingly offer online sales to children under 18 without the involvement of a parent or legal guardian.
13.2. In the United Kingdom, where we rely on consent as a legal basis for the Processing of a childâs Personal Data in relation to information society services (for example, online services offered directly to a child), the minimum age at which a child can lawfully provide their own consent is 13. If a child is under 13, we will seek consent from the holder of parental responsibility, where applicable, in accordance with the UK GDPR.
13.3. If we become aware that we have collected Personal Data from a child under 13 in the United Kingdom without the appropriate parental consent, we will take reasonable steps to delete such data or to obtain the necessary parental authorisation.
13.4. Parents or legal guardians who believe that their child has provided Personal Data to us without their consent may contact us using the details set out in paragraph 12 to request the deletion of such data.]
14. COOKIES AND TRACKERS
In order to improve the browsing experience and to offer services tailored to the interests of its Clients, LABORATOIRES SVR uses Cookies and other trackers.
The operating procedures of these tools, the purposes pursued, the retention periods as well as the means made available to the user to accept, refuse or configure these cookies are detailed in the Site's Cookie Policy.
The user is invited to consult this Cookie Policy at any time by clicking on the following link: https://uk.svr.com/pages/cookie-policy-2026Â
Use of the Site implies acceptance of the terms of use of cookies as defined in said Charter
Â