20 June 2011
At The Body Shop, we take the protection for your Personal Information (such as name; address; phone number; date of birth; e-mail address; credit card number; gender; language preference; and merchandise category preferences) very seriously.
We collect Personal Information that you provide to us voluntarily and process it for the following purposes ("Purposes"):
- To complete transactions with you and manage your membership of our
customer loyalty scheme where applicable
- to direct market to you
- to understand and analyse our sales, and your needs and preferences
- to develop, enhance, market and provide products and services to meet your needs
- to enable you to participate in promotions and contests
- to enable you to participate in customer research or focus groups
- to process exchanges or product returns
- to improve our shops; and
- to respond to requests or complaints.
We may hold or process such Personal Information securely anywhere in the world, for as long as is necessary for thePurposes and we may only share it with franchisees, subsidiaries and subcontractors of The Body Shop and with other businesses in the L'Oréal group. We use Secure Sockets Layer (SSL) technology to protect your credit card information online.
We may communicate with you through a variety of channels, including through our stores, our customer loyalty schemes, and through the internet, and through a variety of means such as post, email, phone, fax, or text message, subject to your preference. You may unsubscribe
at any time by writing to us in the manner explained in our communications.
Table of Contents:
1. Our Approach to Privacy
2. About Information Collection
3. Personal Information
4. Non-Personally Identifiable Information
5. When Is Personal Information Collected and How Is It Used?
6. Customer Consent (Opt In – Unsubscribe)
7. Accuracy of Information
8. Accessing and Updating Personal Information
10. How Do We keep Your Information Secure?
11. Matters specific to the Internet
11.1 Links to Other Websites
11.2 Cookies – Beacons
13. Compliance with the Law
14. Contacting Us
1.6. We take every measure to provide a comparable level of protection for Personal Information should the information be Processed by a Vendor.
2.2. We provide you with information that explains why the Personal Information is needed and how the Personal Information will be processed.
3.1. We at The Body Shop limit the amount and type of information that we collect to that which is necessary for the identifiedPurposes and do not collect your Personal Information unless you (directly or indirectly) provide it to us voluntarily.
3.2. Although the precise details of the Personal Information collected will vary according to the specific purpose, we may typically collect the following Personal Information from or in relation to you:
4.1. Where we collect information through our Web Sites, as is the case with many other web sites, we automatically collect certain non-personal information regarding web site use that does not identify you. Examples include the Internet Protocol (IP) address of your computer, the IP address of your Internet Service Provider, the date and time you access the web site, the internet address of the web site from which you linked directly to our Web Site, the operating system you are using, the sections of the web site you visit, the web site pages read and images viewed, and the content you download from our Web Site.
4.2. We may use non-personal information to compile tracking information reports regarding site user demographics, site traffic patterns, and site purchases. None of the tracking information in the reports can or will be connected to the identities or other Personal Information of individual users.
4.3. In this way, your visit to our Web Site will be logged; however, you will remain anonymous to us unless you specifically choose to share information with us. We use this information about the way in which our customers use our Web Site to better understand which features are most popular and best meet the needs of our visitors.
5.1.1. to complete transactions with you and to administer sales and to manage your membership with our customer loyalty scheme (if you become a member);
5.1.2. to direct market to you;
5.1.3. to understand and analyse our sales, and your needs and preferences;
5.1.4. to develop, enhance, market and provide products and services to meet your needs;
5.1.5. to enable you to participate in promotions and contests;
5.1.6. to enable you to participate in customer research or focus groups;
5.1.7. to process exchanges or product returns;
5.1.8. to improve our Shops;
5.1.9. to respond to requests or complaints
5.1.10. to enable you to participate in our customer loyalty schemes and manage your membership thereof.
5.2. We only keep Personal Information for as long as is necessary to satisfy the specified Purposes, for which it was collected. We retain Personal Information in accordance with our own guidelines, procedures and principles and in line with applicable legislation in any Relevant Jurisdiction.
5.4. We may disclose your Personal Information if we are required to do so by law or requirement of a competent authority.
5.5. In addition to the above, we may from time to time work on specific initiatives with carefully selected third party companies/organisations (outside of The Body Shop) to share opportunities with you. If we do this, we will inform you at the time of such initiatives that, if you decide to submit any Personal Information, it will be shared with those selected companies/organisations and we will only do so with your prior consent.
5.7. If you do consent (opt in) to receive these communications you may unsubscribe
at any point in the future by contacting us as provided at section 6.4 below.
5.9. As we develop our business, we might sell or buy shops or assets. In such transactions, Personal Information may be one of the transferred business assets. Also, in the event that The Body Shop or substantially all of its assets are acquired, data files containing Personal Information will be one of the transferred assets.
6.1. Opt In: We at The Body Shop will not use your Personal Information for a purpose that has not previously been specified, unless we have previously obtained your consent or unless such purpose is required by law.
6.2. Consent to provide Personal Information is not a condition for our selling a product to you, unless the information requested is required to fulfill an explicitly specified and legitimate purpose.
6.3. In particular we will generally seek your explicit prior consent (opt in) before sending to you marketing communications (see 5.1.2 above) unless the exception stated in section 6.6 below applies.
6.5. If you have previously opted into receiving commercial communications from us pursuant to 6.3 above, while also becoming a member of our loyalty scheme, should your membership to such scheme comes to an end for whatever reason, we will not take this to imply an automatic request to unsubscribe
, and we will assume that we have your continued consent, unless you specifically unsubscribe, as is provided for in section 6.4.
6.6. Similar Products or Services (Soft-opt-in): In certain jurisdictions (including in the UK) it is permissible to send commercial communications by email even in the absence of explicit prior consent (opt-in) where the recipient's details have been collected in connection with the sale or negotiation for sale of products or services, irrespective of the conclusion of a contract, provided always that the sender’s identity is clearly stated and an unsubscribe option is given. This is usually referred to as the "Similar Products or Services exception", or as the "Soft-opt-in rule". Where this rule applies we may rely on it in order to send to you marketing communications that we think may be of interest to you, but we will make sure that this is made clear and that you are given the opportunity up-front to opt out from receiving such communications from us, whilst you will also always be given the opportunity to subsequently unsubscribe pursuant to section 6.4.
7.2. You are responsible for informing us about changes to your Personal Information and for ensuring that such information is accurate and current.
8.1. Dependant on the legislation of any Relevant Jurisdiction, some customers have a qualified right to access, rectify, delete, or object (to the processing of) your Personal Information stored by us and to receive an account of its use and disclosure. Where there is no such right provided by law, we may still allow access to such information. We recommend that all customer requests for access to Personal Information held by The Body Shop be made in writing, although we will not impose a formal requirement in this regard. However, we may require you to provide us with additional information reasonably necessary for us to satisfy your request.
8.2. Responding to a customer request (under section 14 below) for information will usually be done at no or minimal cost to the customer. However, subject to the laws of any Relevant Jurisdiction, a fee for reasonable costs incurred may be charged in responding in writing, provided the customer is informed of the fee in advance, which will not exceed the maximum amount permitted by the legislation of the Relevant Jurisdiction. The Personal Information requested is provided to the customer in a form that is generally understandable.
8.3. We amend the Personal Information contained in our database or elsewhere as required when an individual successfully demonstrates the inaccuracy or incompleteness of the Personal Information. An amendment may involve the correction, deletion or addition of information and notification to third party to whom the data have been disclosed. However, we may be unable to amend past purchase information or return transaction information.
10.1. We at The Body Shop protect Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification with security safeguards appropriate to the sensitivity of the Personal Information, regardless of the format in which it is held.
10.2. We use various methods to safeguard Personal Information. They include:
10.2.1. physical measures: locked filing cabinets, restriction of access to offices, and company alarm systems.
10.2.2. technical tools: passwords and encryption, using generally industry best practices.
10.2.3. organisational controls: confidentiality agreements, limiting access on a need-to-know basis, staff training and security clearances.
10.3. Online security is also a priority. The
Body Shop incorporates security measures such as encryption and
authentication tools to protect your Personal Information from unauthorized use.
Firewalls are utilised to protect our servers and network from unauthorised
users accessing and tampering with files and other information that we store.
10.4. We use Secure Sockets Layer (SSL) technology to protect your credit card information online. Upon entering the checkout page your computer will begin communicating with our server in secure mode. You will be able to tell that you are in secure mode because the "http" in the web address on your browser will change to "https".
10.5. In particular, with regard to credit card information, The Body Shop as a global retailer has signed up to and aims to comply – to the extent relevant to its type of business – with the Payment Card Industry Data Security Standard (PCI DSS) which is managed by the PCI Security Standards Council (which has been founded by American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International) and in order to improve credit card security for our customers. The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures with a view to achieving ongoing development, enhancement, storage, dissemination and implementation of high security standards for account data protection. For more details on PCI DSS please refer to: https://www.pcisecuritystandards.org/
11.1.1. The Web Site or any of The Body Shop's various other Web Sites may contain links to other third party owned and operated web sites or internet resources. When you click on one of those links you are contacting another web site or internet resource. We have no responsibility or liability for or control over those other web sites or internet resources or their collection, use and disclosure (processing) of your Personal Information.
11.1.2. We encourage you to read the privacy policies of those other sites to learn how they collect and use information about you.
11.2.4. You may choose to decline cookies if your browser permits, but doing so may affect your use of our Web Site and your ability to access certain features of the site or to engage in transactions.
11.2.5. Tracking tags/Beacons: Each web page in our Web Sites contains tracking pixels that allow us to follow your progress through the various pages within the web site. This information is then aggregated (de-personalised) before being analysed.
12.1. We will never knowingly collect or solicit Personal Information from individuals under the age of sixteen (16) without first obtaining verifiable parental consent. If you are under the age of 16 you should not provide information to us. If we become aware that a person under 16 has provided Personal Information to us without verifiable parental consent (as may be the case where the information is provided via one of our Web Site), we will remove such Personal Information from our files.
13.1. The Body Shop has procedures in place in order to receive and respond to enquiries about The Body Shop’s policies and practices relating to its handling of Personal Information. Any complaint or enquiry should be made in writing and addressed as shown in section 14 below.
13.2. The Body Shop investigates all complaints. Requests will be forwarded to the appropriate Information Officer in the Relevant Jurisdiction. If the complaint is found to be justified, The Body Shop will take appropriate measures to resolve the matter, including, if necessary, amending its policies and practices