LE PETIT PLANET PRIVACY POLICY

WHO WE ARE AND IMPORTANT INFORMATION

We’ll always protect your privacy

At Le Petit Planet Limited (“we”, “us”, “our”), we respect your privacy and are committed to protecting your Personal Data*. Le Petit Planet Limited is the controller for the purposes of the General Data Protection Regulation 2016 (the “GDPR”) as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018, and the UK Data Protection Act, 2018 (referred to here as “the UK GDPR”), a company registered in England and Wales (Company No. 13134447), registered with the ICO under number C1079152 with its registered office located at Evolution House, Iceni Court, Delft Way, Norwich, Norfolk, NR6 6BB.

"Personal Data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identification number, location date, an online identifier or to one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.

This Privacy Policy helps you to understand how we use your personal information, who we share it with and the rights that you have. For more information, head straight to the “Your Rights” section (Go to Section).

The terms of this Privacy Policy will be updated from time to time. If we make any material changes, we will take steps to bring it to your attention. The last updated date is shown at the beginning of the document.

We operate to the highest standards when protecting your personal information and respecting your privacy. Our Data Protection Officer is Agnese Gallarati. Questions about your personal information, or how we use it, can be emailed to her at Agnese@lepetitplanet.com or in writing at Le Petit Planet Limited, c/o Farnell Clarke, Evolution House, Iceni Court, Delft Way, Norwich, Norfolk, NR6 6BB.

Third-party apps, websites and services

Our website can contain links to and from the websites of our partner boutiques and vendors (collectively our “Partners”), advertisers, and affiliates, among others. If you follow a link to any of these websites, this Privacy Policy does not apply to those websites. We are not responsible or liable for the privacy policies or practices of those websites. Please check their policies before you submit any Personal Data to those websites.

If you use any third-party apps, websites or services to access our services, your usage is subject to the relevant third party's terms and conditions, cookies policy, and privacy notice. For example, if you interact with us on social media, your use is subject to the terms and conditions and privacy notices of the relevant social media platform (for example, Facebook). The same stands if you use third-party services, like Amazon's Alexa, as your use of the service is subject to their applicable terms and conditions. We may be required to share customer information relating to transactions and use of such third-party services with that third party.

YOUR RIGHTS RELATING TO YOUR PERSONAL DATA

You have certain rights relating to your Personal Data, which we have set out below. More information can also be found at the Information Commissioner’s Office: www.ico.org.uk.

The right to access the Personal Data we hold about you. This enables you to receive a copy of the Personal Data we hold and to check that we are lawfully processing it. In the account dashboard customers have access to their identity, contact, transaction and financial data.

The right to request the correction of inaccurate Personal Data we hold about you. If you think any of your personal information that we hold is inaccurate, you have the right to request it is updated.

The right to request that we delete your data (also known as the ‘Right to be Forgotten’) and the Right to restriction of processing. This enables you to request that we stop processing or delete all Personal Data that we hold on you. If you exercise this right, it won’t prevent us from processing any new information you provide to us subsequently.

The right to data portability. You have the right to ask us to electronically move, copy or transfer your Personal Data in a machine-readable format.

Rights relating to automated decision-making, including profiling. We may sometimes use your Personal Data to make decisions by automated means. This involves us analysing your account activity such as applications, orders, payments. We do this to confirm your identity, prevent and detect crime.

The right to withdraw Consent. Where we are relying on your consent for processing you can withdraw or change your consent at any time.

The right to restrict Processing to Storage Only.You have a right to require us to stop processing the Personal Data we hold about you other than for storage purposes in certain circumstances. Please note, if we stop processing your Personal Data, we may use it again if there are valid grounds under data protection law for us to do so (e.g., for the defence of legal claims or for another’s protection).

Listed below are the cases where you may request we stop processing, and only store, the Personal Data we hold about you:

• You believe the Personal Data is not accurate for the period it takes for us to verify your claim.
• You wish us to erase the Personal Data, as you believe the processing we are doing is unlawful, but you want us to retain the Personal Data for storage only and stop processing it.
• We wish to erase the Personal Data as it is no longer necessary for our purposes, but you require it to be stored for the establishment, exercise or defence of legal claims.
• You have objected to us processing Personal Data we hold about you on the basis of our Legitimate Interest and you wish us to stop processing the Personal Data whilst we determine whether there is an overriding interest in us retaining such Personal Data.

Objection:at any time, you have the right to object to our processing of data about you in order to send you promotions and special offers, including where we build profiles for such purposes, and we will stop processing the data for that purpose. You can do this by changing your marketing preferences in your Le Petit Planet Account, selecting 'unsubscribe' at the bottom of our marketing emails. Please note, you will still receive emails related to the orders you make through our website or updates to our Terms & Conditions and Privacy Policy.

You also have the right to object to our processing of Personal Data about you. We will consider your request in other circumstances as detailed below:

We are processing the data we hold about you (including where the processing is profiling) on the basis of our, or a third party’s, Legitimate Interest and you object to such processing. Please provide us with details as to your reasoning so that we can assess whether there is a compelling overriding interest in us continuing to process such data or if we need to process it in relation to legal claims. You may exercise your right to request that we stop processing the data while we make the assessment on an overriding interest.

The above rights may be limited in certain circumstances, for example, if fulfilling your request would reveal personal information about another person, if you ask us to delete information which we are required to have by law, or if we have compelling Legitimate Interests to keep it. We will inform you if this is the case and will then only use your information for these purposes. If you want us to stop processing your personal information, you may be unable to continue using our services.

If you want to exercise any of your rights, please contact agnese@lepetitplanet.com. We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

THE LAWFUL BASIS WE USE TO PROCESS DATA

We will only ever use your Personal Data for the purposes for which we collected it as listed below, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your Personal Data for an unrelated purpose, we will update this Privacy Policy and will explain the legal basis which allows us to do so.

The legal bases we rely on are:

Contract: This is where we process your information to fulfil a contractual arrangement, we have made with you.

Consent: This is where we have asked you to provide explicit permission to process your data for a particular purpose.

Legitimate Interest: This is where we rely on our interests as a reason for processing. Generally, this is to provide you with the best products and service in the most secure and appropriate way.

Legal Obligation: This is where we have a statutory or other legal obligation to process the information, such as for the investigation of crime.

THE DATA WE COLLECTION ABOUT YOU AND HOW WE USE YOUR PERSONAL DATA

We collect and use the information that you provide to use directly, for example, when you register for an account; we also use cookies and other similar technologies to collect information from your devices when you interact with our advertising or use our website (you can find out more information in our cookie policy); we keep records when you speak to our customer care teams; and we take personal information from a number of third parties to help us manage your account and improve your shopping experience. The below outlines how we use your personal information, together with our identification of the most appropriate legal basis in each scenario:

To manage orders and returns (Contract)

• We take payment details to process payment for any credit or debit card orders you place with us. We share these details with our chosen payment processors (for example, Stripe or PayPal).
• Passing your information to vendors/boutiques for them to process your order and any associated returns.
• We use your account information plus your chosen delivery address to deliver your order and keep you informed of its status, and the processing of any returns including (where appropriate) collecting the item from you.
• Our chosen payment processors store your payment card details at your request to speed up your checkout in the future (consent).

To register and manage your account on the website (Contract)

• To register an account with us we capture information such as your name, date of birth, contact and delivery information, a password to protect your account and other additional details you may wish to share, like a phone number, addresses and gender (account information). We use the same information on an ongoing basis to manage and provide secure access to your account and provide you with the services you request.
• To record the details of prior purchases in your closet which will facilitate the process of listing them for re-sale if you choose, we record details of your name, contact and delivery information, a key that relates to your certificate and any additional information you may share. We use the same information on an ongoing basis to manage and provide secure access to your account and provide you with the services you request.

To provide customer support to you (Legitimate Interest)

• We record calls and keep correspondence (customer care records) when you contact our customer care teams or interact with us on social media. We use these records to manage your queries or complaints effectively, for quality monitoring and to continually improve our services and your customer experience.

To personalise and improve your experience when you shop (Legitimate Interest)

• We keep a record of how you interact with our website and any marketing you are exposed to. We use this data, along with purchase history, demographics, account information and third-party information, to show you products and offers that we think you will be interested in and to tailor your experience.
• We use your account information, information on the devices you use to access our websites and your interactions with us to operate personalised features across our website and communications.

To prepare and send you communications about products and services that may interest you (Legitimate Interest)

• We use technologies such as cookies within digital marketing networks, ad exchanges and social media networks such as Facebook’s Custom Audience to get relevant marketing messages across to you and other customers. We share aggregated and anonymised information about the customer segments we’re interested in reaching with advertising Partners, so they can focus on showing adverts to those who are most likely to be interested in our products, services and offers, and to prevent them showing you irrelevant or repetitive advertisements.
• We share limited information with selected suppliers to enable them to identify new prospective customers on our behalf and to prevent us repeatedly advertising products or services you have already bought.
• We receive information on how you interact with our adverts and content on third-party websites and social media platforms (such as Google or Facebook), which we use to tailor the information that is displayed to you. For example, customers who bought this also bought this.

To manage our loyalty programmes (Legitimate Interest)

• We collect your name, email, phone number, addresses, date of birth, purchase history, browsing history and behaviour, device information, shopping preferences, nickname, cookie identifiers, internal identifiers, country and tier level. Each tier is defined by a set variety of rewards, services and benefits, which increase in value as a customer’s progress through the tiers. This is to allow us to run our business efficiently and improve your shopping experience.

To provide you with personalised recommendations and enhance your experience (Legitimate Interest)

• We collect your name, email, phone number, addresses, date of birth, purchase history, browsing history and behaviour, device Information, shopping preferences, nickname, cookie identifiers, internal identifiers, country, tier level. Each tier is defined by a set variety of rewards, services and benefits, which increase in value as a customer’s progress through the tiers. This allows us to run our business efficiently and improve your shopping experience.

To stay in touch with you (Legitimate Interest)

• When you register for an account and shop with us, we start to keep you up to date with news of products and services including offers, promotions and sale information, unless you tell us you don’t want us to through your account or using the link in every email that we send to you.
• When we send you communications, we use records of how you interact with our website and any other marketing we’ve sent to you, along with purchase history, to tailor the messages to include information you are most likely to be interested in.
• We use your account information to notify you about important service messages, such as material changes to this policy, product recalls or information about your account.

To ensure the Website and the services we offer you operate properly (Legitimate Interest)

• We use cookies and other similar technologies to keep track of your preferences when using our website.
• We use other cookies and similar technologies to help us understand how you use the website. This allows us to optimise your shopping experience and continually improve our website.
• We gather information about the devices you use to access our websites (desktop and mobile), for example, your IP address and device type, to ensure the website is secure and works across multiple platforms.
• We use information for logistics planning, demand forecasting, management information, dealing with errors on our website, and general research and development.

To develop and improve our products, range and services (Legitimate Interest)

• We share insights about our customers (in an anonymised and aggregated format) with the companies whose products we sell. This helps them better understand the different profiles of our customers, focusing on those who buy their products or are interested in them.
• We may contact you to take part in customer satisfaction surveys. If you respond we collect your feedback and contributions (customer feedback). We use this information to develop the services we offer.
• We work with information providers that specialise in consumer profiling. These organisations provide demographic or other data to help better understand customers' demographics, lifestyles or shopping behaviours, usually linked to the areas where people live.
• We use information about how you browse and engage with our website to improve our websites.
• We use all information, including third-party data in the development of new products, services and systems to ensure they work as expected and will be useful to our customers.

To ensure compliance, fraud prevention and safety (Legitimate Interest/Legal obligation)

• We use your account information, order history and payment history to assist in monitoring for suspicious or fraudulent transactions or suspected money laundering.
• When you register an account, or contact our customer care we use your account, application and purchase history information to confirm your identity.
• We use device identifiers and IP addresses in fraud prevention and investigation, and to maintain network and data security.

To fulfil our legal obligations (Legal Obligation)

• We use your data to ensure we comply with any requirements imposed on us by law or court order, including disclosure to law or tax enforcement agencies and authorities or pursuant to legal proceedings.
• We will share data with regulatory and other official bodies if they make formal requests.
• We will maintain records to meet regulatory and tax requirements.
• We will use your account information to contact you in connection with product recalls or other similar product quality issues and to comply with our legal obligations.

To advertise and retarget advertising of our and our Partners’ products and services (Legitimate Interest)

• We collect your email, cookie identifiers and device information. The legal basis is our Legitimate Interests in running our business efficiently and effectively.

To produce aggregated statistical reports (Legitimate Interest)

• We use your order history, provided that the result of such reports does not identify you to assist in running our business and improving our website.

KEEPING YOUR INFORMATION

We’ll hold on to your data for as long as we consider you a customer and thereafter for such period as you may have questions or a claim in relation to our services.

We consider you a customer

• where you have a Le Petit Planet account with us and for two years from the point you last made a purchase from our website; or
• during any time, we are managing a customer service request from you.

In addition, we will retain such data in accordance with any superior retention period that we may be obliged to observe in accordance with legal requirements applicable to us.
In some circumstances, you can ask us to delete your data as set out above. (Go to Section). After you have terminated your use of our services, we may store your information in an aggregated and anonymised format.

THIRD PARTIES WE SHARE DATA WITH AND RECEIVE DATA FROM

We work with a number of trusted third parties to provide you high-quality goods and services. Anybody we work with is subject to stringent security and data privacy assessments before we begin to do business with them and on an ongoing basis.

We always make efforts to anonymise data and only pass over Personal Data that is absolutely necessary for the purposes it is being processed. We always do so securely.

We have contracts in place with all suppliers that help us to ensure security and privacy of your Personal Data. These are reviewed and updated regularly and always in line with data protection laws.

To do this, we may share your information with these third parties in the following limited circumstances:

Our partner boutiques and vendors from whom you purchase products: we rely on carefully selected Partners that supply the products that you see on our website.

Third-party service providers for business purposes: to function, we rely on a number of carefully chosen third parties to provide us with services and products. We permit these companies to use your Personal Data only to the extent necessary to provide us with their services and products. Below you can find examples of the types of third parties we use:

• We utilise courier companies to deliver the products to you and, as such, they need to have access to your order information, including your name and address. These providers have a global outreach, with many local companies that can be engaged depending on your shipping address.
• We use payment providers to process your payment information (including your credit/debit card details), so that we can collect payment from you. These are based in the European Economic Area (EEA).
• Our marketplace software and apps providers. These third parties transmit your order details and prepare the labelling information that our boutique uses to send you your orders.
• Anti-fraud and credit check providers to keep us and you secure. They have access to and process your information and associated orders to check for any suspicious or fraudulent behaviour.
• Analytics and search engine providers, like Google, to assist us in the improvement and optimisation of the website. These providers are based in the US and EEA.
• Customer care management providers allow us to provide our customer care and improve and manage your customer experience. Our current provider is based in the US.
• Marketing tools providers that enable our marketing. These providers are based in the US.
• Performance marketing and recommendations providers that help us deliver advertising and recommendations of Le Petit Planet products tailored to your interests and needs. These providers are based in EEA (mostly in the UK) and in the US.
• Research companies that we can engage to help us carry out surveys regarding your use of our website and services. These providers are mostly based in EEA (mostly in the UK) or in the US.
• IT/technology providers that we use to support, maintain and provide our technology and IT infrastructure that supports our website and the storage of your information. This includes AWS that we use to host your information, Big Commerce, Shippypro and Jetti. These providers are based in EEA (mostly in the UK).

Advertisers for marketing purposes: we can provide your information to our advertising and social media Partners that you select (including Facebook and Twitter), where they require the data to select and serve relevant adverts about ours and our Partners’ products and services to you and others.

Third-party service providers to enrich data: we may enrich, match or combine information we hold about you with data from other sources, for instance by sharing some of your Personal Data with selected business Partners. We do this to better understand your customer profile and interests, so that we can deliver customised offers and other personalised services.

To comply with legal requests: on occasion, we may be required to liaise with various regulators and law enforcement agencies in a number of different countries, whether as a result of law, a court order, or another legal process. Although we dispute requests wherever suitable, in some cases we may have to share your information with the regulators or law enforcement agencies. Where we consider it appropriate, and provided we are not prohibited from doing so by law or court order, we will attempt to notify you of these legal demands.

Aggregated information with third parties: we may aggregate your information with the information of other customers, creating a dataset of information about the usage of our website, purchase of products, and other general, grouped information about our customers. The legal basis is our Legitimate Interest to understand the usage of our service and demand for our product. Although this dataset is aggregated and anonymised, meaning it cannot identify you as an individual, it provides a valuable insight into the use of our website, and we may therefore share it with select third parties. These parties may include providers of plugins or similar technologies (to help measure traffic), our Partners and other providers (to allow them to better stock products), and our investors.

INTERNATIONAL TRANSFERS

By using our website and our services, you acknowledge and accept that your Personal Data will be processed in the United Kingdom.

To provide our website and our services, in accordance with the purposes set out above, we may transfer and store the Personal Data that we collect from you to a destination outside of the UK or the EEA, mostly to the US, either to one of our Partners or to one of the third parties with which we work with, as stated below:

We transfer the Personal Data to one of our Partners outside the UK/EEA, to the extent such transfer is needed to fulfil the contract between you and the Partner which you are ordering the products from.

When transferring Personal Data to a third party as set out above, we rely on different adequacy measures, as set out below:

If and when this is the case, we take steps to ensure there is an appropriate level of security, so your personal information is protected in the same way as if it was being used within the UK/EEA.

Where we need to transfer your data outside the UK or EEA, we will use one of the following safeguards:

• The use of ICO and/ or European Commission (“Commission”) approved standard contractual clauses in contracts for the transfer of Personal Data to third countries.
• Transfers to a non-UK or non-EEA country with privacy laws that give the same protection as the UK/ EEA.
• Model clauses: we rely on the ICO / Commission’s model contracts for the transfer of Personal Data to third countries (i.e., the standard contractual clauses).

You can find out more about the above data protection safeguards on the Commission website.

How we use cookies and other tracking or profiling technologies.

We use cookies, pixels, and other similar technologies (collectively, “cookies”) to recognize your browser or device, learn more about your interests, provide you with essential features and services, and for additional purposes, including:

• Recognizing you when you sign in to use our offerings. This allows us to provide you with recommendations, display personalized content, and provide other customized features and services.
• Keeping track of your specified preferences. This allows us to honour your likes and dislikes, such as your language and configuration preferences.
• Conducting research and diagnostics to improve our offerings.
• Preventing fraudulent activity.
• Improving security.
• Delivering content, including ads, relevant to your interests on AWS sites and third-party sites (see the Interest-Based Ads notice for how we use cookies in serving interest-based ads).
• Reporting. This allows us to measure and analyse the performance of our offerings.

Some AWS cookies are deleted at the end of your browsing session, while others persist between sessions. Essential AWS cookies remain on your device for up to 365 days from your last visit to our site. Other AWS cookies remain on your device for up to 365 days from their last use.

Information we collect through cookies

Examples of the information we automatically collect through cookies include:

• Network and connection information, such as the Internet protocol (IP) address used to connect your computer or other device to the Internet and information about your Internet service provider
• Computer and device information, such as device, application, or browser type and version, browser plug-in type and version, operating system, or time zone setting
• The location of your device or computer
• Authentication and security credential information
• Content interaction information, such as content downloads, streams, and playback details, including duration and number of simultaneous streams and downloads
• The full Uniform Resource Locators (URL) clickstream to, through, and from our site (including date and time) and AWS Offerings, content you viewed or searched for, page response times, download errors, and page interaction information (such as scrolling, clicks, and mouse-overs)

HOW WE USE COOKIES

Cookie preferences on AWS sites

Our cookies allow you to take advantage of some essential and useful features. Blocking some types of cookies may impact your experience of our sites. You can change your cookie preferences at any time by clicking Cookie preferences in the footer of the AWS site.

Browser settings

You can manage browser cookies through your browser settings. The 'Help' feature on most browsers will tell you how to remove cookies from your device, prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, how to disable cookies, and when cookies will expire. Check the support site for your browser to understand privacy settings available to you.

If you block or reject some of our cookies through your browser’s settings, you might not be able to use certain offerings that require you to sign in to an account and some features and services may not work. You might also have to manually adjust your preferences or settings every time you visit AWS sites. If your browser includes Intelligent Tracking Prevention (ITP), preferences specific to our sites may reset on an ongoing basis. These resets are managed by your browser, not by us.

Third party cookies

Approved third parties may also set cookies when you interact with our offerings. Third parties include search engines, providers of measurement and analytics services, social media networks, and advertising companies. These third parties use cookies in the process of delivering content, including ads relevant to your interests, to measure the effectiveness of their ads, and to perform services on behalf of AWS.

Below is a list of the third parties that may set cookies when you use AWS Offerings. You can learn more about how these third parties use information collected through cookies by reviewing the privacy policies on their sites.

We also embed features from third parties on our sites, and those third parties may set cookies if you engage with those features. For example, we embed chat functionality from Salesforce and videos from Vidyard or our official YouTube channel using YouTube’s privacy-enhanced mode. These experiences set cookies on your device once you click on a chat link or video player.

KEEPING YOUR PERSONAL DATA SAFE

Keeping you and your Personal Data secure is very important to us. We take several reasonable steps to try and protect the Personal Data that you provide, including:

• We use Secure Socket Layer to establish an encrypted link between a server and a client. Stripe uses TLS (SSL) for credit card data.
• Requiring you to establish a unique username and password to access your Le Petit Planet account and ‘closet’ on our website.
• Not keeping details of your credit or debit card that would enable any third party to transact using that credit or debit card (such as your CVV number).
• Regularly monitoring our servers and IT systems for possible vulnerabilities and attacks. Unfortunately, despite this, the transmission of information via the Internet is not completely secure. We cannot guarantee the security of your Personal Data transmitted to or through our website, and any such transmission is at your own risk. In particular, please keep in mind that if you voluntarily disclose Personal Data through other means of communication than the website in a non-protected environment (such as through email, SMS, online messages) then that information can be collected and used by others outside of our or your control.

WHAT HAPPENS WHEN YOU DO NOT PROVIDE NECESSARY PERSONAL DATA?

Where you fail to provide Personal Data that we need to process based on contract or for the purposes of Compliance with a legal obligation, we may not be able to perform the contract we have or are trying to enter into with you (for example, we may not be able to open your account, we may have to close your account, we may not be able to procure the fulfilment of your order or process a return).

HOW YOU CAN GET IN CONTACT

If you have any questions or concerns about this Privacy Policy, please contact us:

• by emailing us at agnese@lepetitplanet.com; or
• by writing to the Data Protection Officer, at Le Petit Planet, Evolution House, Iceni Court, Delft Way, Norwich, Norfolk, NR6 6BB.

This is without prejudice to your right to make a complaint to the Information Commissioner’s Office (www.ico.org.uk) or the data protection supervisory authority in the EU country in which you live or work where you think we have infringed data protection laws.

UPDATES TO THIS POLICY

Any changes we may make to this Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back regularly to keep informed of updates or changes to this Privacy Policy.