PRIVACY POLICY - 18 DECEMBER 2024

1.General Information

1.1 Processing of Personal Data

The purpose of this privacy policy is to provide you with information concerning the processing of personal data when using our corporate and careers websites, and for related services if you are a service provider, business partner, or third-party vendor. This privacy policy applies to all websites or services that feature this privacy policy.

For more information about our data processing activities related to our application process, employees and contingent workers, please visit our dedicated Privacy Notice for Employees, Job Applicants and Contingent Workers, also available on our corporate careers website. 

For more information about our data processing activities related to our clients, clienteling activities and our e-commerce platforms, please visit our dedicated Privacy Policy, also available in all relevant languages depending on your region.

Personal Data refers to any information relating to an identified or identifiable natural person. This includes, but is not limited to, information such as name, address, email address, phone number, or any other data that can be used to directly or indirectly identify an individual. The definition and treatment of personal data are governed by applicable data protection laws and regulations in the relevant jurisdiction, which may include specific rules regarding the collection, processing, storage, and transfer of such data. 

1.2. Controller

Responsible for the processing of personal data is: 

La Prairie Group AG

Bellerivestrasse 36, 8008, Zürich Switzerland

Info[at]LaPrairieGroup.ch

+41 44 947 82 10

Contact details of the Data Protection Officer: 

Data.Privacy[at]LaPrairieGroup.ch, or under the postal address of the controller for the attention of the “Data Protection Officer”.

Specific data processing activities might occur under the responsibility of other controllers, including our local affiliates, in connection with local processing activities. It is indicated in the respective description of those activities below, where this is the case. For a list of contact details for all La Prairie affiliates, please visit our dedicated page here.

1.3. Rights of the Data Subject

As a data subject affected by the data processing activity, you have the following rights with regard to your personal data, subject to the applicable data protection laws and regulations in your relevant jurisdiction:

• Right of access;
• Right to rectification and to erasure;
• Right to restriction of processing;
• Right to data portability; and 
• Right to object. 

1.4 Recipients (general information)

Furthermore, you have the right to lodge a complaint with a supervisory authority concerning the processing of your personal data.

When we work on your above-mentioned right, we may ask you for proof of your identity. For more information on how we process your data in this context, see Section 3.1.

In addition to the recipients that are listed within the recipients paragraph of each section below, we transfer the collected data to the relevant internal departments for processing and to other affiliated companies within the La Prairie and Beiersdorf Group or to external service providers, contract processors in accordance with the purposes required. We also forward the data to the following recipients:

• Platform/hosting providers may have access to personal data from jurisdictions outside of your own. In such cases, appropriate safeguards are implemented, including legally binding agreements or contractual mechanisms that comply with applicable data protection laws and regulations. Where personal data is transferred to jurisdictions covered by specific adequacy decisions or similar rulings, those rulings will apply. For more information (such as a copy of the safeguards), you can contact us as outlined under Section 1.2.

• Analytical service providers may have access to personal data from jurisdictions outside of your own. In these instances, appropriate safeguards, such as legally binding agreements or other contractual mechanisms, are in place to ensure compliance with the relevant data protection laws and regulations. If the transfer is made to jurisdictions with recognized adequacy decisions or similar provisions, those rulings apply. For further details, including information about these guarantees, please contact us as mentioned under Section 1.2.

• IT support service providers may have access to personal data from jurisdictions outside of your own. To protect this data, legally binding agreements or similar mechanisms are used to ensure the protection of personal data in line with applicable data protection laws. In cases where an adequacy decision or equivalent applies, that decision will govern the transfer. More information, including copies of guarantees, is available upon request, as outlined in Section 1.2.

• Authorities: In the event of a legal obligation, we reserve the right to disclose your information if required to do so by competent authorities or law enforcement bodies in accordance with applicable data protection laws and regulations.

Further information can be found within the recipients paragraph of each section.

2. Collection and Processing of Personal Data when visiting our Website

When visiting and using our website we already collect personal data. You can find within this section more information about website specific processes and tools especially from external partners. Further information about processes which can also occur in an offline context can be found in Section 3.

2.1.Hosting

Purpose/Information:
When visiting and using our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server, which are technically necessary for us to display our website to you and to guarantee stability and security.

Used Cookies/Tools: Type A. More information can be found in the “Cookies/Tools” section.

Recipients:
-Platform/hosting providers

-IT support service providers

Further recipients can be found in the general recipients Section 1.4.

Deletion:
The deletion of the log files takes place after 7 days.

2.2. Login functionalities

Our careers website might provide different login functionalities as described below.

2.2.1 Career Opportunities Login Profile

Purpose/Information: 
Our careers website allows you to create a centralised login profile and includes a separate consent during the registration process: When registering, La Prairie Group AG provides you with the opportunity to create an account with a password (login profile). This login profile will be created within the centralised login profile database and shall verify that you are the valid owner of the account and/or email address. This login database is in general only connected to the service you are registering to and handles only the verification part of your login profile. You will be asked to read and agree to our Privacy Notice for job applicants, a copy of which is also available under Section 3.4. The login profile will therefore also be accessible to the respective local La Prairie affiliate company from which you are demanding the service.   

Used Cookies: Type A. More information can be found in the “Cookies/Tools” section.

Controller: 
See Section 1.2 above.

Recipients: 
Platform/Hosting providers

Further recipients can be found in the general recipients Section 1.4.

Deletion / Withdrawal:  
Your login profile will be automatically deleted as soon as you have deleted your account on our careers website, unless this conflicts with legal storage obligations or statutes of limitations. An automatic deletion of candidate accounts in general take place after 12 months of inactivity.  

2.3. Cookies/Tools

This website uses cookies or other technologies/tools like pixels, local storage, tags, IDs or external services (hereinafter referred to as “Cookies/Tools”) and are used on when visiting and using our website. Cookies are small text files that are stored by your browser on your device to save certain information or image files, such as pixels. The next time you visit our website on the same device, the information saved in the cookies will subsequently be accessed on your device and transmitted either to our website (“First Party Cookie”) or to another website to which the cookie belongs (“Third Party Cookie”). 

Through the information saved and returned, the respective website can recognise that you have already accessed and visited it with the browser you use on that device. We use this information to be able to design and display the website in an optimum way in line with your preferences. In that respect, only the cookie itself is identified on your device. Beyond this extent, your personal data will only be saved upon your express consent or if it is strictly necessary to be able to use the service offered to and accessed by you accordingly.

This website uses the following types of cookies/tools, the scope and functionality of which are explained below:

• Type A: Technical/Audience Measurement – to ensure that the demanded service can be provided including basic analysis. 
• Type B: Functional and Performance – Additional tools to measure the performance/attractiveness of our website and to provide further additional (personalised) functionalities.
• Type C: Marketing/Advertising – Cross websites tools for marketing profiling based on user behaviour.

You can find more information on in the description of the tools implemented on our websites in this privacy policy.

For additional cookies relevant to this website that are not listed below, please refer to our Privacy Preference Center which is accessible by clicking “Cookies Settings” at the bottom of the page. This will allow you to review and manage your cookie preferences, including detailed information about the types of cookies used, their purposes, and the ability to opt in or out of specific categories of cookies, where applicable.

Please note that the tools listed in the following subsection might not be constantly in use.

2.3.1 OneTrust Cookie Consent – Central cookie management platform

Purpose/Information:
This website is using the consent management tool “OneTrust Cookie Consent” (www.onetrust.com) to obtain consent for data processing and use of cookies or comparable functions. "OneTrust Cookie Consent“ stores information about the categories of cookies the site uses and whether visitors have given or withdrawn consent for the use of each category. This enables site owners to prevent cookies in each category from being set in the user’s browser, when consent is not given. 

By processing the data, OneTrust Cookie Consent helps us to fulfil our legal obligations (e.g. obligation to provide evidence). Our interests in processing lie in the storage of user settings and preferences with regard to the use of cookies and other functionalities. "OneTrust Cookie Consent" stores your data as long as your user settings are active.

The provision of your personal data is required for the performance of the contract or a situation similar to a contract. You are not obliged to provide your personal data. If your personal data is not provided, you cannot use the described service.

Cookies/Tools: Type A. More information can be found in the “Cookies/Tools” section.

Recipients:
Main service provider is OT Technology Spain, Passeo de la Castellana 77, 28046 Madrid, Spain.

Further recipients can be found in the general recipients Section 1.4.

Deletion:
The data will be stored for up to one year The choice you have made (consent/setting) will be stored for one year and can be viewed within the Cookie Settings. The Cookie Settings are located on the bottom of the main page. You can always delete your choice by deleting the cookies within your browser.

2.3.2 Google Analytics

Purpose/Information:
This website uses Google Analytics, a web analysis service of Google Ireland Ltd. (“Google”). 

Google Analytics uses a specific form of cookie, which is stored on your computer and enables an analysis of your use of our website. The cookies set by Google Analytics for measurement are first party cookies, which means that data subjects’ cookie values will be different for each customer (i.e. there is not a single Google Analytics cookie ID that is used on all sites using Google Analytics). The information about your use of this website generated by the cookie is generally transmitted to a Google server in the USA and stored there. 

Google uses this information on our behalf to analyse your use of this website in order to compile reports on website activities and provide additional services related to website and internet use. 

We use Google Analytics to analyse and regularly improve the usage of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. In addition, we gain information about the functionality of our site (for example to detect navigation problems).

In the configuration of Google Analytics, we ensured that Google receives this data as a processor and is therefore not allowed to use this data for its own purposes. The "Google Analytics Advertising Features" configuration is independent from this and is described in the appropriate section below, provided it is also used on this website. 

Cookies/Tools: Type B. More information can be found in the “Cookies/Tools” section.

Recipients:
Main service provider: Google Ireland Ltd., Ireland. 

Transfers of personal data to third countries as defined by applicable data protection legislation may occur. Where required, appropriate safeguards are implemented to ensure an adequate level of data protection. For countries covered by an adequacy decision under applicable data protection legislation, the adequacy decision applies. For more information, including details about applicable safeguards, you can contact us as mentioned in Section 1.2.

Further recipients can be found in the general recipients Section 1.4.

Deletion/Withdrawal:
You can deactivate this tool via the Cookie Settings. The Cookie Settings are located on the bottom of the main page.

Cookie lifetime: up to 24 months (this applies only to cookies which have been set by this website)

2.3.3 Google Analytics Advertising Features

This website also uses the extended functions of Google Analytics (Google Analytics Advertising Features) in addition to the standard functions. The Google Analytics Advertising Features implemented on this website include:

• Google Display Network Impression Reporting
• Google Analytics Demographics and Interest Reporting
• Remarketing Audiences based on specific behaviour, demographic, and interest data, sharing those lists with Google Ads
• Integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers
• Google Signals in order to receive more insights about you when you are signed in to your Google account in the browser with which you are accessing this website. This feature is only active if you have additionally consented within your Google settings to the data sharing/Ads Personalisation.

We therefore use first-party cookies (e.g. Google Analytics cookies) and Google advertising cookies and identifiers together in order to optimise our website.

Cookie/Tools: Type C. More information can be found in the “Cookies/Tools” section.

Information about Google Consent Mode:

Additionally, this website uses Google Consent Mode. Consent Mode sends statistical data via cookie-less pings about whether a user has clicked on an ad or link and has landed on our website (conversion). The statistical data is then used with a mathematical modelling to enhance the internal reporting. A ping contains by default technical information like the IP-address, platform type or screen resolution. As these data or the combination of it might theoretically be considered as personal data by Google Ireland Ltd, additional measures have been implemented to ensure that the ping data is not personal data: Certain information of the ping are being set to a default value by our server before sending it to Google analytics.

Recipients/Source:
Main service provider and source: Google Ireland Ltd., Ireland. 

Transfers of personal data to third countries as defined by applicable data protection legislation may occur. Where required, appropriate safeguards are implemented to ensure an adequate level of data protection. For countries covered by an adequacy decision under applicable data protection legislation, the adequacy decision applies. For more information, including details about applicable safeguards, you can contact us as mentioned in Section 1.2.

Further recipients can be found in the general recipients Section 1.4.

Deletion/Withdrawal:
You can deactivate this tool via the Cookie Settings. The Cookie Settings are located on the bottom of the main page. 

Cookie lifetime: event data is stored for up to 50 months; your personal data as a user is stored for up to 14 months (this applies only for cookies which have been set by this website).

2.3.4 Google Tag Manager

Purpose/Information:
This website uses the Google Tag Manager. This service allows website tags to be managed through an interface. The Google Tag Manager only implements tags. This means that no cookies are used and no personal data are stored. The Google Tag Manager triggers other tags, which in turn collect data if necessary. However, the Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, it remains valid for all tracking tags if they are implemented with the Google Tag Manager.

Cookie/Tools: Type A. More information can be found in the “Cookies/Tools” section.

Recipients:
Main service provider: Google Ireland Ltd, Ireland. 

Transfers of personal data to third countries as defined by applicable data protection legislation may occur. Where required, appropriate safeguards are implemented to ensure an adequate level of data protection. For countries covered by an adequacy decision under applicable data protection legislation, the adequacy decision applies. For more information, including details about applicable safeguards, you can contact us as mentioned in Section 1.2.

Further recipients can be found in the general recipients Section 1.4.

Deletion:
Aggregated event data is stored for up to 50 months; your personal data as a user is not stored in Google Tag Manager and therefore no retention period applies.

3. Further services offered (on- and offline)

In addition to the online use of our website, we offer various other services, for which we process your personal data also in an offline context. 

Contrary to Section 1.2, in some cases a legal entity within the La Prairie corporate group is the Controller for the services offered below; this will have already been identified within the communication itself. If reference is therefore made to sections of this privacy policy, and a Controller has already been named, e.g. in the footer/signature of an email or campaign card, this legal entity is the Controller in accordance with applicable data protection laws and regulations.  

3.1. Contacting/Communication/Collaboration

Purpose/Information:  
When communicating and/or collaborating with us, e.g. by email or via contact form on our website, or data exchange platform, be it e.g. as a business partner or customer, the data you provide (including but not limited to your email address, your name and your telephone number, or personal data submitted during the conversation) will be stored and processed by us in order to e.g. answer your questions, requests or for the purpose of business related correspondence.

With regard to the cooperation with our suppliers, we have implemented an internal evaluation process of due diligence which, in our legitimate interest, is intended to improve the business relationship. As a rule, we only process information about the company, but conclusions can be drawn about you as the contact person of that company, if the communication with suppliers is examined with regard to response times, reliability and transparency.

We may ask you when you contact us by telephone as a customer whether the telephone call may be recorded for quality assurance and training measures. If you agree to the recording, we will process all information that you share with us during the call (communication content, possibly also sensitive (health) data, as well as your phone number and other personal data).

When processing data arising in the course of communication, we have a legitimate interest in processing the data in accordance with legal requirements, for internal verification or in accordance with the respective communication request.

In certain cases, the provision of your personal data as a business partner or customer is required for the performance of the contract or a situation similar to a contract. Additionally, your personal data may be required for related purposes, such as compliance with legal obligations, responding to or conducting investigations, or handling legal or regulatory proceedings. You are not obliged to provide your personal data. If your personal data is not provided, you cannot use the described service. 

Recipients and sources:
If you are a business partner, we will regularly check your creditworthiness in certain cases (e.g. when concluding contracts). Our legitimate interest is the minimization of our financial risk. For this purpose, we cooperate with credit agencies from which we receive the necessary data. For this purpose we transmit your name and your contact data to the credit agencies.

If you are a business customer or partner, it may be necessary to transfer your personal data to prospective buyers as part of a company transaction. In the course of due diligence, usually anonymised data is processed. However, it may be necessary in specific individual cases to process personal data. Our legitimate interest lies in the execution of the company transaction.

We may transfer your collected data to our relevant internal departments for processing and to other affiliated companies within the La Prairie and Beiersdorf Group, to external service providers, contract processors, or, where necessary, to public authorities in compliance with legal obligations, regulatory requirements, or in response to lawful requests, all in accordance with the purposes required.

In the event of a legal obligation, we reserve the right to disclose information about you if we are required to surrender it to competent authorities or law enforcement bodies.

Additionally, we also forward the data to the following recipients:

• Platform/hosting providers;
• Analytical service providers; and/or,
• IT support service providers.

3.2. Job posting updates

For all recipients listed above, transfers of personal data to recipients in countries outside of the applicable jurisdiction may occur. Where required by law, appropriate safeguards, such as standard contractual clauses or other legally recognized mechanisms, are implemented to ensure adequate protection of personal data. For countries or entities subject to an adequacy decision, such a decision will apply. For more information or to request a copy of the relevant safeguards, please contact us at Data.Privacy[at]LaPrairieGroup.ch.

Further recipients can be found in the general recipients Section 1.4.

Deletion /Objection:
Your data will be retained only for as long as necessary to fulfil the purposes for which it was collected, unless statutory retention obligations exist or periods of limitation must be observed.

Call recordings are stored for a maximum of 90 days. 

You can object to these processes according to the requirements under Section 4.

Purpose/Information: 
Job posting updates provide candidates with notifications about new job opportunities and relevant updates tailored to their preferences. By subscribing to these updates, candidates receive notifications based on their selected interests and preferences, such as keywords for specific roles, locations, or departments.

The updates are customized based on the preferences candidates set in their profiles. Candidates can adjust the frequency of these notifications through their candidate profiles under “Job Alerts” to receive updates every set amount of days on a recurring basis.

Recipients: 
-Platform/hosting provider

Transfers of personal data to third countries as defined by applicable data protection legislation may occur. Where required, appropriate safeguards are implemented to ensure an adequate level of data protection. For countries covered by an adequacy decision under applicable data protection legislation, the adequacy decision applies. For more information, including details about applicable safeguards, you can contact us as mentioned in Section 1.2.

Further recipients can be found in the general recipients Section 1.4.

Deletion / Withdrawal: 
Candidates can unsubscribe from job posting updates at any time by logging into their candidate profile and updating their notification preferences. Job alerts and subscriptions will also be automatically deleted after 12 months of inactivity, at which point the entire candidate profile will be deleted.

3.3. Postal mailings

Purpose/Information:
As a selected customer or business partner, you may receive shipments from us by post (letter), including documents, products, or other materials necessary for the performance of a contract or based on our legitimate interests in facilitating business operations. These shipments are provided in the context of our professional relationship.

Recipients:
-Platform/hosting provider

-Communication service provider

-Shipping service provider 

Transfers of personal data to third countries as defined by applicable data protection legislation may occur. Where required, appropriate safeguards are implemented to ensure an adequate level of data protection. For countries covered by an adequacy decision under applicable data protection legislation, the adequacy decision applies. For more information, including details about applicable safeguards, you can contact us as mentioned in Section 1.2.

Further recipients can be found in the general recipients Section 1.4.

Deletion / Objection:
Your data will be deleted as soon as the purpose for the shipment has been fulfilled unless legal storage obligations or statutes of limitations require otherwise. You can object to further postal mailings as described in the Section 4 below. We further delete your personal data after the contractual relationship between us has been terminated.

3.4. Data Privacy Statement for applicants (recruitment)

For more information about the application process please go to our dedicated Privacy Notice for Employees, Job Applicants and Contingent Workers, also available on our corporate careers website. 

4. Objection or Withdrawal of your consent to the Processing of Personal Data

If you have given your consent to the processing of your data, you can withdraw your consent at any time. Such a withdrawal influences the permissibility of processing your personal data after you have given it to us. Withdrawing consent does not affect the lawfulness of any data processing that occurred prior to the withdrawal.

If we base the processing of your personal data on our legitimate interests, if relevant and as permitted by applicable law, you may object to the processing. This is the case if processing is not necessary in particular to fulfil a contract with you, which is described by us in the description of the functions/services. When exercising such objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and either stop or adjust data processing or point out to you our compelling reasons worthy of protection, on the basis of which we will continue processing. 

Of course, you can object to the processing of your personal data for purposes of advertising and data analysis at any time. You can inform us about your objection under the above-mentioned contact details for the controller.