Privacy & disclaimer

I. INTRODUCTION

At Pro-Duo we attach great importance to the protection of your personal data. This privacy policy sets out how we protect your personal data and who you can turn to for more information or to invoke your legal rights.

If you provide us with personal data of other persons, such as your collaborators, please do inform these persons of our privacy policy before entrusting us with their personal data. From our side we will use all opportunity we have to inform and reassure you and these persons that personal data are safe with us.

We reserve our right to amend our privacy policy from time to time, if legislation or our internal practices so require. At all times you can find the current version of our privacy policy on our website www.pro-duo.be.

II. CONTENT OF OUR PRIVACY POLICY

1. The controller of the processing
2. Purposes and legal basis for the processing of personal data
3. The personal data processed and the case being, the necessity of the provision thereof
4. Duration of the processing and retention of data
5. Categories of recipients and transfer of personal data
6. Your rights in relation to the processing of your personal data
7. Contact Pro-Duo in relation to data processing

I. The controller of the processing

The legal entity controlling the processing of your personal data is Pro-Duo NV. Pro-Duo is a Belgian company with limited liability whose registered office is located at Traktaatweg 1, 9000 Ghent, Belgium. Pro-Duo is registered with the Register for Legal Entities in Belgium under number 0465.784.102.

Pro-Duo NV is the controller of the processing of your personal data because it has determined the purposes and means of the processing, and this although this processing may be performed for the benefit of either Pro-Duo NV, either any of the following affiliated companies: Vigox BVBA, Kapperscentrale Bauwens NV, Pro-Duo France SAS, Pro-Duo Spain SL, Sally Beauty Netherlands BV and Pro-Duo Deutschland GmbH.

However, for processing operations performed for legal reasons (such as after sales warranty), compliance (such as post-marketing surveillance of cosmetic products) or tax and accounting reasons, Pro-Duo NV is not the sole controller. In that case, Pro-Duo NV and the affiliated companies are to be considered joint controllers.

Pro-Duo NV and the affiliated companies are hereafter referred to as “Pro-Duo”, “us” or “we”.

II. Purposes and legal basis for the processing of personal data

Pro-Duo processes personal data of its customers and suppliers, as well as of contact persons of its customers and suppliers, and of visitors to its websites, for the following purposes:

1. Processing of personal data of customers, contact persons of customers and potential customers for the purpose of conveying offers, invoicing, after sales, management of the customer or sales relationship (including in the context of e-commerce) as well as legally required purposes that are linked to that purpose;
2. Processing of personal data of customers, contact persons of customers and potential customers for direct marketing;
3. Processing of personal data of suppliers, contact persons of suppliers and potential suppliers for the purpose of purchasing, after sales, management of the supplier relationship as well as legally required purposes that are linked to that purpose;
4. Processing of personal data of visitors of our websites that fill out the contact page, for the sole purpose of responding to the visitor’s request sent to us via the contact page.

Additionally, on some websites we may use cookies. For more information in relation to cookies, please revert to the cookie policy to be found at the respective website.

The legal basis for these processing operations is respectively:

1. For the processing of personal data of customers, contact persons of customers and potential customers for the purpose of sales;

   • To the extent that you are a natural person customer of whom the personal data are processed for the performance of the contract, our legal basis for the processing of your data is: the necessity for the performance of our contract with you.

   • To the extent that you are a collaborator of our customer or potential customer and your contact details have been provided by the customer or the potential customer for the performance of the contract with the customer or for communicating with or giving follow up to an offer to the customer, our legal basis for the processing of your data is: the necessity for the purpose of the legitimate interests pursued by Pro-Duo and the customer to organize, and interact in relation to, the conclusion or performance of a contract.

   In our view, given the limited use made of your contact details, such interests are not overridden by your interests or fundamental rights and freedoms. Should you consider otherwise, please revert to title VI below on Your legal rights in relation to privacy.

2. For the processing of personal data of customers, contact persons of customers and potential customers for direct marketing, our legal basis is either: The necessity for the purpose of the legitimate interests pursued by Pro-Duo to promote sales, reinforce the relationship with the customers, enhance customer loyalty, etc.

   For processing activities which are in general considered little intrusive (e.g. promotion sent by regular mail), such interests are in our view not overridden by your interests or fundamental rights and freedoms. Should you consider otherwise, please revert to title VI below on Your legal rights in relation to privacy.

   We may also invoke the same legal basis of our legitimate interest, for newsletters sent by e-mail to our own customers if your e-mail contact details were received directly from you in the context of a sale, and are only used for the promotion of Pro-Duo’s own similar products. Every newsletter however carries a link allowing you to unsubscribe from the newsletter.

   Either: Your consent.

   For marketing initiatives such as calling you or sending you text messages, we will always first ask your consent. The same is true for e-mail newsletters that do not comply with the aforementioned conditions.

   Your consent will be asked at the moment that we receive your personal data (e.g. on the website or if you visit a shop). This will normally take the form of a little menu with different consent boxes to tick:

   “I would like to receive:
   [] e-mail newsletters [define by title ‘Procom’, subject matter]
   [] promotional SMSs for [define products]
   [] calls to inform me on promotions for [define products]”

   You may revoke your consent at any moment in accordance with title VI below.

3. For the processing of personal data of suppliers, contact persons of suppliers and potential suppliers for the purpose of purchasing, after sales, management of the supplier relationship our legal basis is:

   • To the extent that you are a natural person supplier of whom the personal data are processed for the performance of the contract, the following legal basis can be invoked: Necessity for the performance of our contract with you.

   • To the extent that you are a collaborator of the supplier and your contact details have been supplied by the supplier or the potential supplier for the purpose of the performance of the contract or for communicating with or giving follow up to an offer of or sale from the supplier: Necessity for the purpose of the legitimate interests pursued by Pro-Duo and the supplier to organize, and interact in relation to, the conclusion or performance of a contract.

     In our view, given the limited use made of your contact details, such interests are not overridden by your interests or fundamental rights and freedoms. Should you consider otherwise, please revert to title VI below on Your legal rights in relation to privacy.

4. We may also process your personal data if required for legal reasons (such as after sales warranty), compliance (such as post-marketing surveillance of cosmetic products) or tax and accounting reasons. The legal basis of our processing is then to be found in European or national law.

5. For the processing of personal data of visitors of our websites that fill out the contact page, for the sole purpose of responding to the visitor’s request, our legal basis is: Necessity for the purpose of the legitimate interests pursued by Pro-Duo to treat and give follow up to your request.

   Given your initiative to send your request via the contact page (which we assume you want us to reply to) and the limited use made by us of your contact details to reply, such interests are in our view, not overridden by your interests or fundamental rights and freedoms. Should you consider otherwise, please revert to title VI below on Your legal rights in relation to privacy.

III. The personal data processed and the case being, the necessity of the provision thereof

For customers

• Name of the natural person customer or of the company customer*⁽¹⁾⁽²⁾
• Address*⁽¹⁾⁽²⁾
• Customer account number⁽¹⁾⁽²⁾
• For a company customer: contact persons*⁽¹⁾⁽²⁾
• Kind of customer (professional customer, retail customer, student, direct sales customer) and justification thereof (e.g. VAT number, declaration of employer, diploma or certificate, student card)*⁽¹⁾⁽²⁾
• For direct customers: closing days* and stores visited⁽¹⁾⁽²⁾
• Ticket information linked to address by customer account number⁽¹⁾⁽²⁾
• Customer wishes in relation to direct marketing⁽²⁾
• Analysis data based on purchases⁽²⁾
• E-mail address*⁽¹⁾⁽²⁾
• Telephone and/or mobile number*⁽¹⁾⁽²⁾
• Date of birth⁽²⁾
• Language*⁽¹⁾⁽²⁾

And the case being:

• Customer participation to trainings or promotions⁽²⁾
• Customer complaints and details of the complaints⁽¹⁾ (Complaints may include health related information. This data will only be processed to handle your complaint and comply with our regulatory obligations pursuant to EU Regulation (EC) N° 1223/2009 on cosmetic products, and not for any other purpose. We take appropriate safeguards, e.g. by limiting the persons having access to these data and using pseudonymization where possible.)
• Recordings of telephone calls to customer services⁽¹⁾

The personal data⁽¹⁾ are processed for the purpose of sales and legally required purposes linked to that purpose. The personal data⁽²⁾ are processed for direct marketing purposes.

The aforementioned personal data indicated with a * have to be provided, if the customer wants to benefit from the status of a professional customer, student or direct sales customer or wants to obtain a loyalty card or purchase online. For (other) retail customers that purchase in a store, the provision of personal data is entirely on a voluntary basis.

Pro-Duo may reserve specific promotions to segmented customers, e.g. based on history of purchases, kind of customer, date of birth or customer wishes.

For suppliers

• Name of the natural person supplier or of the company supplier
• Address
• For a company supplier: contact persons
• Contract related information
• E-mail address
• Telephone and/or mobile number
• Language

The provision of all aforementioned personal data is mandatory for suppliers. The data are processed for the purpose of purchasing and legally required purposes linked to that purpose.

For visitors to the websites

• Name
• Contact details
• Data filled out on the contact page
• Response to request

The provision of these data is entirely on a voluntary basis. However, if you decide to submit a request, you have to fill in a name and electronic contact details. The data are only processed to properly deal with your request.

IV. Duration of the processing and retention of data

For customers:
We process your personal data for the purpose of sales, as long as your customer status is active. This means that you regularly purchase our products, visit our shops and/or participate in promotions. Personal data of inactive customers are retained for as long as necessary for legal, compliance or tax and accounting reasons or for as long as your purchases could give rise to legal claims.

We process your personal data for direct marketing purposes until you oppose to the processing of your personal data for that purpose, or if the processing was based on your consent, until you withdraw your consent.

For suppliers:
We process your personal data as long as necessary in the context of the contracts entered into with you. After termination of our active collaboration with you, your personal data are retained for as long as necessary for legal, compliance or tax and accounting reasons.

For visitors to the website that fill in the contact page:
We process your personal data as long as necessary to deal with and give follow up to your request. The data are not retained afterwards (unless the case being, in the context of another processing for another purpose as detailed in this privacy policy).

V. Categories of recipients and transfer of personal data

Pro-Duo is part of a larger group of companies affiliated to Sally Beauty Holdings Inc. Personal data of customers and suppliers may be shared within Sally Group for the purposes of Pro-Duo set out under titel II:

• As indicated under title I, Pro-Duo NV is the controller of the processing of personal data for itself and a number of affiliated companies in continental Europe. To the extent that these affiliated companies participate in some of the processing operations, they do so under Pro-Duo NV’s control (unless the affiliates qualify as joint controllers for legally required processings).
• Pro-Duo may communicate some personal data to other European Sally Beauty companies as the organizations in continental Europe and the UK collaborate closely on a management level. This communication is limited to what is necessary for the purposes.
• Pro-Duo may transfer personal data to the mother company in the US for the purposes, as the mother company is committed to supplying specific services for companies within its group (such as hosting).

To the extent that this communication of personal data would entail a transfer outside of the European Union to a country where there is no adequate level of data protection, which is currently the case for the US where our mother company is vested, Pro-Duo will make sure that there are adequate contractual safeguards in place to protect your privacy.

Apart from the communication of personal data within Sally Group, Pro-Duo may work with the following categories of third party processors: suppliers of IT and hosting services, consultants and providers of direct marketing services. Pro-Duo will make sure that all its processors have entered into appropriate processor contracts.

VI. Your rights in relation to the processing of your personal data

In relation to the personal data that are processed by Pro-Duo, you have a number of legal rights:

• You have a right to get access to your personal data and to have these data corrected.
• You may ask Pro-Duo to erase your personal data, or to restrict the processing thereof.
• To the extent that the processing is based on the legal basis of a legitimate interest or the processing is done for direct marketing purposes, you have the right to oppose to that processing.
• To the extent that the processing is based on your consent, you have the right to revoke your consent at any time.
• You may ask to receive the personal data which you have provided to us, in a structured, commonly used and machine-readable format and transmit these to another controller.

Within a duration of maximum 1 month after receipt of your request, we will act upon your request and reply. If for some reason we cannot accommodate your request, we will inform you of the reasons thereof. If we are not in a position to identify you properly, we may ask you to provide a proof of your identity as a prerequisite to accommodating your request.

VII. Contact Pro-Duo in relation to data processing

In order to invoke your rights under title VI, please contact us at our dedicated privacy e-mail address: privacy@pro-duo.com, or send us a letter at Pro-Duo NV, Privacy, Traktaatweg 1, 9000 Ghent, Belgium.

Alternatively, If your sole aim is to give or revoke your consent in relation to direct marketing or modify your direct marketing preferences, you can turn to your usual shop and ask the shop manager to adjust your privacy settings.

Alternatively, if your sole aim is to unsubscribe from a newsletter, text messages or live calls, you can also click the unsubscribe link in the newsletter, reply with “stop” on a text message or ask the live caller not to call you again.

If on the other hand you have any questions, remarks or complaints in relation to our privacy policy or how we process your data, do not hesitate to contact us by e-mail (privacy@pro-duo.com) or by sending us a letter at Privacy, Pro-Duo SA, Traktaatweg 1, 9000 Gent, Belgium.

If you have any complaints in relation to how Pro-Duo processes your personal data, you may file a complaint with the Supervisory Authority: www.dataprotectionauthority.be