Yves Rocher (Thailand) Co., Ltd. (“Yves Rocher” or the “Company”) recognizes and understands that by using Yves Rocher products or services and applying for membership, you entrust the Company with the security of your transactions and the preservation of your personal data.

Accordingly, the Company has prepared this Privacy Notice (“Notice”) to inform you of our management of the personal data collected from you to ensure it is accurate, fair, and transparent, as well as to outline your rights regarding personal data in accordance with the Personal Data Protection Act B.E. 2562 (“Law”). This is to ensure your confidence that the processing of your personal data is protected under legal standards. Please read and understand this Notice for your own benefit.

1. What Personal Data Does Yves Rocher Process, Disclose, or Transfer?

   In conducting its business, the Company will collect, use (“Process”), and disclose or transfer your personal data, directly or indirectly, only as necessary for the purposes notified. The categories are as follows:
   1. General Personal Data: Such as name, surname, date of birth, gender, address, national ID number, photographs, email, phone number, bank account, social media accounts, purchase transaction data, payment data, technical computer data, marketing/promotion subscription data, and communication data.
   2. Sensitive Personal Data: Such as voice recordings, medical treatment history, skin/hair health analysis results, medical certificates, and photo or video records.

2. Processing, Disclosure, or Transfer of Personal Data

   The Company will process and disclose or transfer your data only as necessary, for specified purposes, and as permitted by law in electronic formats stored on servers and/or in hard copy. For processing that requires consent under the law, you must provide explicit consent through physical actions such as ticking a box, clicking “Agree,” or other equivalent methods.

   The Company may disclose or transfer your data to third parties, both in Thailand and abroad, strictly for operational support and as permitted by law. We ensure these third parties comply with privacy policies and legal security standards. These third parties may include:

   1. Headquarter in France.
   2. Data Processors: Including technical/IT providers, website/app developers, logistics/warehouse providers, research/analysis agencies, marketing/advertising agencies, cloud service providers, and OTP verification services.
   3. Business Partners: In banking, payment systems, marketing, retail/wholesale (online/offline), and data analysis.
   4. Professional Advisors: Such as auditors.
   5. Legal Authorities: Regulatory bodies or officers as required by law.

3. Purposes of Processing, Disclosure, or Transfer as Permitted by Law

   Yves Rocher (Thailand) Co., Ltd. (“Yves Rocher” or the “Company”) recognizes and understands that by using Yves Rocher products or services and applying for membership, you entrust the Company with the security of your transactions and the preservation of your personal data.

Purposes	Legal Basis
Product/service delivery Refund/return by conditions Communicating Providing services under membership conditions	Contractual Basis
CCTV recording for asset protection at branches, including photos/videos for public relations at events. Research, analysis, and surveys to develop products or services.	Legitimate Interest
Compliance with orders from officials or as permitted by law.	Legal Obligation
Marketing communications Third-party data disclosure/transfer Health checks	Consent




4. Security of Your Personal Data

   The Company maintains your data using appropriate Technical and Organizational Measures to prevent data breaches and unauthorized access or disclosure. We regularly update these standards and require all personnel and third parties to maintain strict confidentiality.

5. Retention and Personal Data erasure

   The Company retains your data only as long as necessary for the purposes or as required by law. We will delete your data within 30 days once the purpose ends, upon membership cancellation, upon consent withdrawal, or if there is no transaction for a continuous period of 2 years. Deletion is conducted by removing data from servers and shredding paper documents.

   1. Treatments purchased for 1-2 sessions are valid for a maximum of 3 months from the date of purchase.
   2. Treatments purchased for 3-5 sessions are valid for a maximum of 6 months from the date of purchase.
   3. Treatments purchased for 6 or more sessions are valid for a maximum of 12 months from the date of purchase.
   4. You must book and complete all sessions within this validity period. The company reserves the right not to extend the validity period.

6. Cookies

   Our website uses Cookies to remember your preferences and provide relevant content. You can manage cookie settings through your browser. Cookies can be categorized by functions as follow:

   1. Essential Cookies: Necessary for website operation.
   2. Preference Cookies: Remember settings like language and location.
   3. Analytics Cookies: Used to offer relevant products and services.
   4. Advertising Cookies: Tailor advertisements to your interests.
   5. Third-Party Cookies: Set by providers such as Google Analytics.

7. Data Subject Rights

   The Company respects your rights under the law. To exercise your rights, please contact us according to Section 9. We reserve the right to refuse or charge a fee as permitted by law.

8. Changes to this Privacy Notice

   The Company may update this Notice periodically to reflect legal or operational changes, and such changes will be clearly announced.

9. Contact Information

   For inquiries or to exercise your rights, please contact our Data Protection Officer (DPO) with the subject “Inquiry about Privacy Notice for Yves Rocher Members”:

   Yves Rocher (Thailand) Co., Ltd.

   Address: 188 Spring Tower, Room 1-3, 19th Floor, Phayathai Road, Thung Phayathai, Ratchathewi, Bangkok 10400

   Email: yrdpo-asia@yrnet.com