Privacy Policy

Preamble

Guinot SAS would like to thank you for visiting its website www.guinot.com (hereinafter the ‘Website’).

Guinot SAS undertakes to process your personal data in accordance with the General Data Protection Regulation (‘GDPR’) and the French Data Protection Act.

This processing of personal data is governed, in particular but not exclusively, by the following standards:

• The European General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council or ‘GDPR’), applicable since 25 May 2018;

• and Act No. 78-17 of 6 January 1978 on data processing, files and civil liberties (known as the ‘Data Protection Act’), as amended by the Health Act of January 2016, the Law for a Digital Republic of October 2016 and Law No. 2018-493 of 20 June 2018 on the protection of personal data are founded on the principle of protecting human identity, human rights, privacy and individual or public freedoms.

This policy (hereinafter the ‘Policy’) informs any data subject (customer, prospective customer, visitor to the Website) of how Guinot SAS processes personal data, as well as the rights available to that person and how to exercise them.

1 – What is personal data?

Personal data (hereinafter ‘Data’ or ‘Personal Data’) refers to any information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more factors specific to that person. Examples include surname, first name, telephone number and email address.

2 - Who are the data subjects?

The categories of data subjects affected by the processing are Users of the Website.

3 - Who collects your Data?

The Data Controller is Guinot SAS, represented by its legal representative.

This personal data processing policy sets out the policy of Guinot SAS, a simplified joint-stock company (SAS) with a share capital of 10,200,000 euros (€), whose registered office is situated at 120, avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, registered with the Nanterre Trade and Companies Register under number 632 041 877, regarding personal data.

This Policy applies to all Personal Data and information that you provide to Guinot SAS, in particular when browsing the Website, subscribing to newsletters or placing an order via the Guinot SAS e-commerce platform.

You may exercise your rights by writing to us at: Guinot SAS – DPO – 120, Avenue Charles De Gaulle, 92200 Neuilly-sur-Seine, or by email to: dpo@guinot.com.

4 - What Data is collected?

When you browse our website, log in to your account, make enquiries, and/or log out, we collect the following categories of Personal Data, including in particular:

• Your browsing data: we receive and record information from your computer and browser, including your IP address, your software and hardware, and the page you request. For further information, please refer to our cookie policy set out in paragraph 15 of this Policy.

This data is processed automatically and stored in Guinot SAS’s information system and database.

When you register on our website, log in to your account, make enquiries, and/or log out, we collect the following categories of Personal Data, including in particular:

• Your identity (title, surname, first names);

• Your contact details (postal and/or email address, telephone numbers, comments);

• Your professional details when you submit job applications (CV, covering letter);

• Your registered salon;

• Your order details (products ordered, quantity);

• Your order history;

• Your location data.

This data is processed automatically and stored in Guinot SAS’s information system and database.

You may not submit any form to Guinot SAS without first having read this Policy.

Should you provide the contact details and personal data of a third party, for example when placing an order for a product, you warrant to Guinot SAS that the third party is aware that you have provided their data to Guinot SAS and that they have consented to such disclosure.

5 - Is the provision of Personal Data mandatory?

The Personal Data requested in the forms is strictly necessary for our departments to process your requests – whether, for example, a request to be contacted or the creation of your customer account – and is therefore mandatory.

Consequently, if these fields are left blank, your request cannot be processed.

As regards cookies, you have the option to accept or refuse them, except for certain cookies that are strictly necessary for the website to function. We therefore invite you to consult our cookie policy set out in paragraph 15 of this Policy.

6 - Why do we collect your data?

We collect your data in order to manage our services and your enquiries as effectively as possible.

• Processing is based on the performance of pre-contractual and contractual measures where the purpose of collection is to:

. Create and manage customer and prospect accounts to enable us to process your requests;

. Manage your requests regarding your rights;

. Personalize our services and respond to your individual needs;

. Monitor customer and prospect relationships, in particular when managing your complaints and requests;

• Processing is based on your consent where the purpose of data collection is to:

. Provide personalized advertising content;

. Send you newsletters, updates and promotional offers.

• Processing is based on our legitimate interest, namely improving our services and the security of our website and IT network, where the purpose of data collection is to:

. Improve our website;

. Improve customer and prospect service and the handling of your enquiries;

. Administer promotions, surveys and competitions;

. Analyze your comments and reviews left on our website and social media pages.

On this last point, by leaving reviews or comments on our websites or by engaging with us on our social media pages regarding our offers, products or events, you may be providing us with content and Personal Data. This information enables us to better meet your expectations and improve the quality of our products and services.

It may be reproduced and displayed, in particular on our websites, for information purposes, and used to compile anonymized statistical studies that provide us with insights into your habits and behavior in relation to our products.

It will not be collected or used for any other purposes.

• The processing is based on the following e-commerce activities:

- Creating your account on our website

- Order management (processing and tracking orders, deliveries, invoices, payments and accounts)

- Managing customer contacts and sending notifications relating to the creation of an account on the Website and/or the status of an order;

- Delivering orders placed;

- Managing the relationship with the partner salon;

- Managing remote complaints and after-sales service (ASS);

- Management of the loyalty program;

- Management of user reviews of products and services;

- Marketing activities, namely enabling the sending of information, in particular commercial communications from Guinot SAS, such as newsletters, new offers or news updates;

- Management of your IP address location for access to the Website’s services;

- Managing cookies as set out below, namely:

o Managing the personalization of the website display and customer preferences;

o Managing abandoned basket reminders;

o Managing the payment module;

o Compiling statistical analyses of products ordered.

7 - Privacy

Your Personal Data will not be sold, exchanged, transferred or disclosed to any other company for any reason without your consent, except where necessary to fulfil a request and/or transaction in accordance with the Purposes set out above.

8 - Who receives the Data?

We do not sell, exchange or transfer your Personal Data to third parties. This does not include trusted third parties or contractors/partners who assist us in operating our website or conducting our business, provided that such parties agree to keep this information confidential.

The website is hosted by: SHOPIFY INTERNATIONAL LIMITED, an Irish Private Company Limited by Shares, registered in the Irish Companies Register under No. 560279, with its registered office at 2nd floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Intra-Community VAT number IE 3347697KH.

In connection with the management and dispatch of orders, your data may also be transferred to our service providers, such as:

• Our carrier for delivery;

• Our payment service provider for online payments made via our website;

• Our email marketing service provider;

• For the management of our franchise network, the reference body is designated by the Customer.

In connection with the management of our website, your data may also be transferred to our cookie service providers, as set out in our cookie policy set out in paragraph 15 of this Policy.

In certain situations, we are under a legal, regulatory and/or judicial obligation to share information in connection with investigations, preventative measures and/or decisions concerning illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, breaches of our terms of use, or where required by law.

9 - What safeguards are in place in the event of a transfer outside the European Union?

We guarantee that, in the event of your Data being transferred abroad – and in particular outside the European Union – we will implement all appropriate measures to ensure an adequate level of protection for your data, such as:

• Prioritizing countries recognized as having an adequate level of protection by the European Commission, i.e. those offering protection equivalent to that guaranteed by the European Union;

• Seeking the necessary authorizations from the supervisory authority (for example, the Commission Nationale de l’Informatique et des Libertés – CNIL in France) prior to any data collection, should this be required by the relevant country;

• Obtaining security and confidentiality guarantees from data processors by imposing strict contractual clauses and reserving the right to monitor them regularly, for example by conducting audits.

The SHOPIFY e-commerce platform may need to transfer some data outside the EU in accordance with the procedures explained at this link: Shopify Help Centre | International transfers of personal data

10 - How long is your data been retained?

Your Personal Data is stored with the website’s hosting provider, SHOPIFY INTERNATIONAL LIMITED (Private Company Limited by Shares), and is retained for a period not exceeding twenty-four (24) months following the last update made by the registered user, unless the data is anonymized or there is a legal obligation to retain certain data for a longer period.

Your Data is retained for a limited period corresponding to the purposes for which it was collected, in accordance with current regulations and in compliance with legal, contractual, tax and social security obligations, and to safeguard the legitimate interests of Guinot SAS, namely five (5) years from the end of the contractual relationship; this period corresponds to the applicable statutory limitation period in the event of a dispute.

Your data is also retained in the context of e-commerce for a period not exceeding that necessary for the following purposes, namely:

• Regarding customer relationship management, online complaints and after-sales service: for the period strictly necessary to process the order, the complaint and the after-sales service, plus three (3) years from the end of the commercial relationship. Furthermore, data may be retained in accordance with a legal obligation for the period necessary to fulfil that obligation;

• Regarding the delivery of products: from the time the order is placed until delivery and payment have been completed, and for as long as any outstanding issues remain (unpaid invoices, disputes, legal proceedings, etc.);

• Regarding customer reviews of products and services: for the duration that the product is on the market;

• Regarding the management of the loyalty program: for the duration of your membership of the program ;

• Regarding marketing: three (3) years after your last response to a marketing communication;

• Regarding the management of cookies: thirteen (13) months from the date of your initial express consent.

You acknowledge that the data you provide to us and which is stored in our information systems is accurate and constitutes proof of your identity.

11 - What are your rights regarding your data?

Pursuant to Articles 14 to 22 of the GDPR, any natural person using our website is entitled to exercise the following rights:

• Right of access: you may request a copy of the data relating to you personally;

• Right to rectification: you may request the correction of any inaccurate data concerning you;

• Right to object: you may object to our processing of your data; if your request to object does not relate to marketing, we may, depending on the circumstances, justify a refusal on the grounds that there are legitimate and compelling reasons for processing the data, or that the data is necessary for the establishment, exercise or defense of legal claims, or that you have given your consent – in which case you must withdraw that consent rather than object – or that we are bound by a contract, or that we are under a legal obligation to process your data, in particular;

• Right to erasure: you may request that we erase data relating to you;

• Right to determine the handling of your data after death: You may set out instructions regarding the retention, erasure and disclosure of your Personal Data after your death, in accordance with Article 40-1 of Law No. 78-17 of 6 January 1978;

• Right to restriction of processing: you have the right to request that the processing of your data be suspended for a certain period, for example whilst we examine a complaint you have made regarding the use of your data or a request to exercise your rights;

• Right to data portability: you have the right to request that Data collected via a form with your consent or under a contract be provided to you in a readily reusable format and transferred to a third party of your choice, subject to technical feasibility.

Furthermore, when a person gives their consent to the processing of their Personal Data, they are entitled to withdraw that consent at any time.

Finally, where a Personal Data breach is detected that is likely to result in a high risk to your rights and freedoms, you will be notified of this breach as soon as possible.

These rights and guidelines may be exercised by writing to us at: Guinot SAS – DPO – 120 Avenue Charles De Gaulle – 92200 Neuilly-sur-Seine or by email to: dpo@guinot.com

To enable us to identify with you quickly and respond to you, please include with your request any information necessary to verify your identity (in particular, if the request is made via your customer account or by email). A response will then be sent to you within one month of receipt of the request. In certain cases, due to the complexity of the request or the volume of requests, this period may be extended by two months.

You may also contact the Commission Nationale de l’Informatique et des Libertés (CNIL), the regulatory authority responsible for enforcing data protection regulations in France, online at https://www.cnil.fr/fr/agir or by post at the following address: Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy - TSA 80715, 75334 PARIS CEDEX.

12 - What security measures are in place?

Guinot SAS has taken the necessary steps to put in place all the technical and organizational measures required to ensure the security and confidentiality of the personal data processed and to prevent it from being distorted, damaged, destroyed or accessed by an unauthorized third party. All the security measures in place are state-of-the-art, particularly with regard to information systems.

These measures include:

• Identification of cyber risks;

• Access control and authorization management;

• Data encryption;

• A secure IT environment.

As Guinot SAS cannot control all risks associated with the operation of the internet, it draws your attention to the existence of potential risks inherent in its use and operation.

Guinot SAS will report any personal data breaches to the competent data protection supervisory authority within the statutory time limits and will notify you if such breaches are likely to result in a high risk to the rights and freedoms of individuals.

13 - Creating an account on www.guinot.com

By creating an account on the website www.guinot.com, you consent to us collecting, using and disclosing your Personal Data for purposes related to your enquiry. The information collected is processed electronically to facilitate communication between you and Guinot SAS.

By submitting your contact details and message via your account, you undertake to write objectively and never in an excessive manner. Do not include any information relating to sensitive data (health, racial or ethnic origin, sexual orientation, political opinions, etc.). Particular attention must be paid to the sensitive data referred to in Article 8 of the Data Protection Act.

Guinot SAS reserves the right to remove a contact form on the grounds of non-compliance with the French Data Protection Act and reserves the right to take legal action against any person who fails to comply with these commitments.

14 – How do I unsubscribe?

We use the email address you provide to send you information and updates relating to your enquiries, contact requests, information about our products, etc. If at any time you wish to unsubscribe and no longer receive emails, please send us an email to dpo@guinot.com with the subject line ‘unsubscribe’.

15 - What are cookies?

A cookie is a small computer file, a tracker that enables the analysis of users’ behavior when visiting a website, reading an email, or installing or using software or a mobile app.

The cookies we use are listed below. These are text files stored and used to record personal and non-personal information relating to your browsing activity on the website.

There are two types of cookies:

- a). Guinot/third-party analytics and marketing cookies

- b). Native Shopify cookies and other trackers, such as tracking pixels, are used by certain Shopify applications (Meta, Google Ads, TikTok, Pinterest, etc.), for which you will find the link below and set out below; Shopify’s Cookie Policy – Shopify France

Guinot SAS may use these or other technologies that may collect or store Personal Data in order to improve the services provided to you.

You will be notified the first time you receive a cookie via a banner displayed at the bottom of the page you are viewing, and you may choose to accept or refuse cookies on a case-by-case basis or refuse them altogether, at any time.

You can choose to disable cookies by adjusting your browser settings or via the cookie manager.

Please note that certain cookies, which are necessary for the website to function, cannot be refused.

Guinot SAS would like to remind you that your settings may affect your access to its content and services that require the use of cookies.

Your prior consent to the use of cookies and trackers is valid for a maximum of thirteen (13) months, in accordance with the recommendations of the French Data Protection Authority (CNIL) in 2020. You will, however, be asked to give your consent or refuse the placement of these cookies every six (6) months.

The SHOPIFY e-commerce platform uses certain cookies in addition to those mentioned above:

Shopify’s cookie policy – Shopify France

As a reminder, the following cookies are exempt from the consent requirement according to the CNIL (September 2020 guidelines):

• Trackers that retain the choice expressed by users regarding the placement of trackers

• Trackers intended for authentication with a service, including those designed to ensure the security of the authentication mechanism, for example by limiting automated or unexpected access attempts

• Trackers intended to store the contents of a shopping basket on an e-commerce site or to bill the user for the product(s) and/or service(s) purchased

• Trackers used to personalize the user interface (for example, for the choice of language or the presentation of a service), where such personalization is an intrinsic and expected part of the service

• Trackers used for load balancing of equipment contributing to a communications service

Trackers enabling paid websites to limit free access to a sample of content requested by users (a predefined quantity and/or for a limited period)

For further information, you may contact Guinot SAS via the following channels:

By post:

• Guinot SAS, Data Protection Officer (DPO)

120 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine

• By email at the following address: dpo@guinot.com

16 - Updates to the Policy

This Policy may be amended at any time by Guinot SAS, in particular to comply with any changes in French and European legislation and regulations. Updates are published online without notifying the user and are deemed to have been accepted without reservation when you access the Website or log in to your user account.

Effective from october 21th 2026