Online Privacy Policy

Last Updated: August 2024 Welcome to this website (“Site”), which is owned or operated by diptyque SAS (“Diptyque”). Diptyque is also referred to in this Privacy Policy as “we”, “us” or “our”. Diptyque values its customers and respects their privacy. Your visit to the Site and your use of any of the services or features we provide is subject to our Terms and Conditions. This Privacy Policy (together with our Terms and Conditions, Cookies Policy and any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. We are the data controller in respect of your personal data. Please read this Privacy Policy carefully to understand our views and practices regarding your personal data and how we will treat it. Our Site is not intended for, and should not be used by, children under the age of 14 or under the age required by applicable data protection law. We do not knowingly or intentionally collect any information from children under the age of 13. This Privacy Policy does not cover information that you submit on any other websites. For example, if you post something on third party sites such as Facebook, Twitter, Instagram or YouTube (""Third Party Sites""), that information is governed by the privacy policies on those websites, and is not governed by this Privacy Policy. Similarly, if you post something on another website operated by any member or brand within our group (""Associated Sites""), that information is governed by the privacy policies on those Associated Sites and is not governed by this Privacy Policy. You should always check the Terms and Conditions and Privacy Policies posted on Third Party Sites and Associated Sites.

1. HOW/WHEN WE COLLECT PERSONAL DATA FROM YOU

Information you give us: You may give us personal data about you when you: • visit our Site; • fill in forms on our Site or instore; • visit us instore (e.g. personal data collected through our use of CCTV in our stores and premises) or when you attend one of our events, master classes or workshops or when you otherwise correspond with us by phone, e-mail or otherwise; • set up an online account (which you must do if you would like to use some of the services and features we offer on our Site), subscribe to our services (including any loyalty programmes), or place an order on our Site; • submit enquiries, feedback, suggestions, ideas or other information; • participate in our customer satisfaction surveys or other market research; and/or • communicate with us via social networking websites, third party apps or similar technologies. Information we receive from other sources: we may receive information about you if you use any of the other websites we (or any member or brand within our group) operate or other services we provide. In this case we will have informed you when we collected that data that it may be shared internally and combined with data collected on this Site. We are also working closely with third parties (including, for example sub-contractors in technical, payment and delivery services, advertising networks, marketing services, analytics providers, search information providers, credit reference agencies, etc.) and may receive information about you from them.

2. Personal data we collect about you

We may collect and process the following personal data about you, that you submit to us, such as: • contact details (such as your name, address, email address and telephone number); • demographic information (such as age, nationality, gender and/or other information that may identify you as an individual); • passwords and other authentication information; • responses to any customer satisfaction surveys or market research (unless these are provided anonymously); • financial and credit card information; and/or • your marketing preferences. We may also collect information from you automatically. For example, if you contact us with a complaint or query, we may keep a record of any phone number used to call our customer service number as well as the correspondence and the period of time it took for us to deal with a query or any request you had. We may also record your levels of satisfaction with the services we have provided. We will also collect and store your purchase history. We may also automatically collect personal data from you using cookies and other similar technologies. A cookie is a small file of letters and numbers that we may set on your device. You can find more information about the individual cookies we use and the purposes for which we use them in our Cookie Policy. This type of information may include the following: • technical information, including the Internet protocol (IP) address used to connect your computer to the Internet; • your login information; • browser type and version, time zone setting, browser plug-in types and versions; • operating system and platform; and • information about your visit including the full Uniform Resource Locators (URL) clickstream to, through and from our Site (including date and time); products you viewed or searched for; page response times; download errors; length of visits to certain pages; page interaction information such as scrolling, clicks, and mouse-overs; methods used to browse away from the page.

3. Use made of your personal data

We may use personal data held about you in the following ways: • to fulfil your order (including acknowledging your order and communicating with you if there is any issue regarding the fulfilment of your order); • to make sure your order is delivered correctly; • to maintain your account and provide you with the related benefits (including to invite you to our events, master classes and workshops, or to provide you with gifts and samples); • for accounting, billing, reporting and audit purposes; • for credit checking or screening; • for authentication and identity checks and to distinguish you from other users; • for credit, debit or other payment card verification and screening; • for debt collection; • to maintain safety and security throughout our operations (including the safety and security of our stores and premises); • training, legal and administrative purposes and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes; • for customer care support; • services such as identifying your shopping preferences and requirements; • to monitor your use of our Site to improve the user experience and to ensure that content is presented in the most effective manner for you and for your device; • to improve your shopping experience with us and tailor any marketing or advertising so that it is more relevant to you, for example to keep you up-to-date on our latest fragrance, perfumes, candles, cosmetics, makeup, leather and body care products, promotional offers and events and to send you our newsletter; • to operate and administer any loyalty programmes (including the provision of related rewards); • to notify you of any changes to our services; and/or • to conduct marketing analysis to allow us to assess trends and the effectiveness of our advertising and marketing campaigns (including using your personal data to evaluate, analyse or predict certain personal aspects relating to you, such as your preferences, economic situation, interests, and/or location) for example, to build a picture of your interests so that we may tailor our communications to you to ensure they are relevant and of interest to you and so that when you visit our Site we can tailor your experience so that it is easier to shop with us. We may also match or combine the information we collect from you and the information you provide to us with information we receive from other sources (such as social media platforms). We may use the combined information for the purposes set out above (depending on the types of information we receive). This may include your contact details, demographic data, your social media interactions, preferences, shopping habits, interests, geographic location and age or age range. We may use this personal data to tailor and show advertisements more relevant to you either on our Site or on third party websites (including social media platforms) and/or where you are a VIP customer, we may use this personal data to provide a more personal and informed customer service based on data about your preferences, behaviours and purchases.

4. Legal basis for processing

We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the purposes for which we have collected and use your personal data. In almost every case the legal basis will be one of the following: • Consent: For example, where you have provided your consent to receive certain marketing from us. You can withdraw your consent at any time, including by clicking on the “unsubscribe” link at the bottom of any marketing email we send you. • Our legitimate business interests: Where it is necessary for us to understand our customers, promote our services and operate effectively, provided in each case that this is done in a legitimate way which does not unduly affect your privacy and other rights. For example, we will rely on this legal basis when we conduct certain market analysis to understand our customers in sufficient detail so we can create new services and improve the profile of our brand. • Performance of a contract with you (or in order to take steps prior to entering into a contract with you): For example, where you have purchased a product from us and we need to use your contact details and payment information in order to process your order and send the product to you. • Compliance with law: Where we are subject to a legal obligation and need to use your personal data in order to comply with that obligation.

5. Opt-Out of direct marketing

You can at any time tell us not to send you marketing communications (i) by email by clicking on the unsubscribe link within the marketing emails you receive from us or through your account if you have one and depending on where you are located; (ii) by SMS by following the “STOP” instructions provided with the message; (iii) by postal mail by following the instructions that may be included in a particular promotion; or (iv) by contacting our customer services team (who will then direct you to where you can unsubscribe). If you have registered with us, you may also opt out of receiving postal mail from us by logging into your account and amending your preferences.

6. Disclosure of your information

We may share your personal data with any member or brand within our group, which means our parent undertaking, Manzanita US Investments LLC and all of its subsidiary undertakings in the fields of luxury beauty, fragrance, cosmetics, home and lifestyle products. Please visit www.manzanitacapital.com for more information about our group and brands. They may use the information in accordance with their privacy policies for purposes such as: financial reporting and analysis; strategic planning; the development of customer segmentation and metrics to provide a consistent view of our customer base; the creation of inspiring content and editorial features, and the development of new products and collaborations to enhance your experience as a customer of Diptyque or other brands within the group. From time to time we retain the services of other carefully selected and monitored companies and individuals to perform functions on our behalf in connection with the successful operation and continuous improvement of this Site and our services. We may share your information with selected third parties including: • Suppliers and sub-contractors for the performance of any contract we enter into with them or you (e.g. in order to process your order and maintain your account, including the authorisation and validation of credit or debit card transactions, the provision of delivery services, the operation and administration of any loyalty programmes and the analysis of data, etc.). These companies or individuals may be provided with access to your personal details in order to fulfil their function but may not use such information for any other purpose. • Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. Online retargeting is a form of online advertising that allows us and some of our advertising partners to show you advertising based on your browsing patterns and interactions with our Site. For example, when you have visited our Site then moved to another site, you may start seeing our adverts displaying special offers or reminding you of the products you were browsing on our Site. The technology behind these adverts is based on cookies. More information about how we use cookies and how you can, if you wish, turn off cookies is included in our Cookie Policy. This processing constitutes profiling under the UK/EU GDPR. We process your personal data in this way as it is in our legitimate interest to offer you a personalised experience on our Site and to provide you with personalised advertising and marketing, and depending on the mode that such personalized advertising and marketing are conducted, subject to your consent for the use of your personal data for direct marketing if/where applicable. • Analytics and search engine providers that assist us in the improvement and optimisation of our Site. We do not provide your personal details to other companies or individuals for their marketing purposes unless you have indicated when you registered that you wish to receive information about other companies’ products, offers and services in areas including luxury beauty, fragrance, cosmetics, home and lifestyle products. We may also disclose your personal data to third parties: • In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets; • if Diptyque (or its ultimate holding company and its subsidiaries) or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets. We may share your personal data where we are under duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our other terms and conditions or other agreements, or to protect our rights, property, or safety (or the rights, property, safety of our customers or others). This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

7. Where we store and process your personal data

The personal data that we collect from you may be transferred to, and stored at, a destination outside of the country in which it was originally collected including countries, which have less strict, or no data protection laws, when compared to those in the EEA. The reason for this transfer is that some of the operations we need managed in order to complete our contract with you are located outside of the EEA, for instance, it may be processed by staff working outside of the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. Where your personal data is transferred in this way, we will take all steps reasonably necessary to ensure that adequate safeguards are in place to protect your personal data and to make sure it is treated securely and in accordance with this Privacy Policy. In these cases, we rely on approved data transfer mechanisms (such as standard contractual clauses) to ensure your information is subject to adequate safeguards in the recipient country. If you are located in the EEA, you may contact us for a copy of the safeguards which we have put in place to protect your personal data and privacy rights in these circumstances.

8. Security and passwords

We have security measures in place to make sure that personal data we collect and store (including all transactional information) is protected. Transactional information includes any credit or debit card details, your personal contact information together with any other names and addresses you provide when you place an order for delivery to another address, and your purchasing history. If you have given your consent prior to entering the details required for the ordering process, our Site will retain your Diptyque account details such as your name, address, email address and purchasing history. Each time you log into your Diptyque account to create a new order you must re-enter your credit card details. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our Site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

9. Third Party Websites

Our Site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

10. Data Retention and Destruction

We store data for as long as it is necessary to provide products and services to you and others as long as we are legally required to do so. We may also keep a record of correspondence with you (for example if you have made a complaint) for as long as is necessary to protect us from a legal claim.

11. Rights of Data Subjects

You have certain rights in relation to your personal data. These include: the right to object to the processing of your information for certain purposes, the right to access your personal data, and the ability to erase, restrict or receive a machine-readable copy of your personal data. To the extent the processing is based on your consent, you may withdraw your consent at any time. We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you wish to exercise any of these rights, please contact us using the contact details below. You may also have the right to complain to a data protection authority if you think we have processed your personal data in a manner which is unlawful or breaches your rights. If you have such concerns, we request that you initially contact us (using the contact details below) so that we can investigate, and hopefully resolve, your concerns.

12. Changes to our Privacy Policy

Any changes we may make to our Privacy Policy in the future will be posted on this page. Please check back frequently to see any updates or changes to our Privacy Policy.

13. Contact

Questions, comments or requests regarding this Privacy Policy are welcomed and should be addressed by email to the following: • If you are located in Germany: Kundenservice@diptyqueparis.com • If you are located in Spain: servicioalcliente@diptyqueparis.com • If you are located in Italy: servizioclienti@diptyqueparis.com

14. UK data protection representative

Representative in the United Kingdom: Saint Germain Limited 43 Great Marlborough Street, London, W1F 7JL