1. Introduction

Oriflame is responsible for collecting reports about serious undesirable effects of cosmetics and communicating this information to relevant stakeholders. Providing reports of serious undesirable effects and sharing this information makes cosmetics safer and is an important aspect in the protection of public health.

This Privacy Notice outlines how we collect and use your personal information when you submit an Adverse Reaction Claim. We are committed to protecting your privacy and complying with applicable data protection laws.

This Privacy Notice is addressed to:

  • Individuals reporting adverse events, providing safety information concerning our products, requesting medical information, and submitting product quality complaints;

  • Individuals that are the subject of adverse events, medical information queries, and product quality complaints.

References in this notice to you and your shall mean a user of Oriflame products when an adverse reaction claim relating to an adverse reaction such user have had (Adverse Reaction Claim) is filed. 

Personal Information or Personal data:

means any information relating to an identifiable person who can be directly or indirectly identified from the information

  1. Who are we? 

We are Oriflame Research and Development Limited (Oriflame, we, us, our) and we are a "data controller" which means that we are responsible for deciding how and why your personal information is processed for the purposes described in this Privacy Notice. 

Our registered office address is 1 Stokes Place, St. Stephen's Green, Dublin 2, D02 DE03. 

 

  1. Data Collection

We collect personal information directly from you when you submit an Adverse Reaction Claim or from another person (for example a Brand Partner who sold you Oriflame product) if they submit a claim on your behalf. The types of information we collect include:

  • Contact Information: Address, email address, phone number

  • Identification Information: Name, year of birth, gender, skin type

  • Sensitive Information: Health data, including details of adverse reactions, treatment, hospital/doctor attendance, medical diagnosis, and healthcare provider contact information.

 

  1. Purposes of processing your personal information

We process personal data for the following purposes:

  • monitoring the safety of our products, which includes detecting, assessing, following up on, and preventing adverse events, and reporting adverse events to relevant authorities;

  • responding to quality complaints regarding our products, such as any fault of quality and/or effectiveness, stability, reliability, safety, performance, or usage; answering other questions or requests and improving our products and services; complying with our policies and local legal, national / international regulatory, and compliance requirements; 

  • to communicate with you about your Adverse Reaction Claim;

  • conducting audits and defending litigation.

We will only use your personal information for the purposes for which we originally collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an incompatible purpose, we will notify you and we will explain the legal basis which allows us to do so. 

  1. Legal basis for processing your personal information

We process your personal information based on the following legal grounds:

  • Compliance with a legal obligation: To fulfil our reporting obligations under the European Cosmetic Regulation No. 1223/2009 or other legal regulations.

  • Public interest: To protect public health by investigating and reporting adverse reactions.

  • Your consent: Where you have given us consent to use your personal information. 

  • We need to protect vital interests (yours or someone else's).

  1. What are your responsibilities? 

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. Please note that if you fail to provide certain information when requested, we will not be able to process your Adverse Reaction Claim. 

  1. Who do we share your personal information with? 

As part of complying with our legal obligations, we will have to share information about your Adverse Reaction Claim (including your year of birth, gender, country of residence and medical details) with the relevant competent authority to fulfil our reporting obligations under Article 23 of Regulation (EC) No 1223/2009 on cosmetic products.

We will share your personal information with any member of the Oriflame Cosmetics group and other companies which may be added to our group from time to time to the extent such sharing is necessary for our internal administration of Adverse Reaction Claims and reporting purposes.

We may share your personal information with the Oriflame company that sold you a product that (potentially) caused adverse reaction in case it is necessary for handling any legal claims related to such sale.

We may have to share your personal information with third parties, including third-party service providers (and their designated agents):

(a) who need to know information about your Adverse Reaction Claim; 

(b) where required by law; 

(c) where it is necessary to administer our relationship with you; or 

(d) where we have another legitimate interest in doing so. 

We require third parties to respect the security of your personal information and to treat it in accordance with the law. 

We may also share your personal information with third parties for regulatory and legal reasons (including adverse reaction reporting as noted above). An example of this is where we need to share your information with a medical expert to evaluate our findings. We may also share your personal information with third parties in the event that our business or substantially all of its assets are acquired by a third party. 

  1. Will we transfer your personal information outside of the European Union? 

We may need to transfer your personal information to countries where they may not have data protection laws providing the same level of protection as those in the European Economic Area. For example, we may need to transfer your personal information to India where our IT support services are located and we will need to transfer your personal information to our customer services teams in your country of residence who will contact you regarding your Adverse Reaction Claim.

We shall ensure that any such transfers are lawful and backed by strong contractual undertakings approved by the relevant regulators and that your personal information is always kept secure. If you would like further information about the protective measures in place, please contact our Data Protection Officer at privacy@oriflame.com.   

  1. How long will we keep your personal information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Normally, we will keep information related to adverse reactions for a period of 10 years following the date on which the last batch of the cosmetic product relating to the Adverse Reaction Claim was placed on the market but we may need to retain it for longer if it is subject to a legal claim and if so we will keep such information until such time as the claim and any related claims are resolved. To the maximum possible extent such retained information is pseudonymised or anonymised. 

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. 

  1. What are your privacy rights? 

By law you have the right to:

  • Access your personal information. Please send all data subject access requests in writing. You will not have to pay a fee to access your personal information, however, we may charge a reasonable fee if your data subject access request is clearly unfounded or excessive. We may need to request specific information from you to help us confirm your identity. 

  • Rectification of your personal information that we process about you. This enables you to have any incomplete or inaccurate information we process about you corrected.

  • Erasure of your personal information. This enables you to ask us to delete or remove personal information.

  • Object to processing of your personal information pursuant to this notice. 

  • Restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example, if you want us to establish its accuracy.

  • Portability of your personal information. You may ask us to provide you with the personal information that we hold about you in a structured, commonly used and machine-readable format to another party. 

  • Withdraw consent if you have given us consent to use your personal information, you can withdraw your consent at any time. 

  • Make a complaint about our data processing activities by contacting us at privacy@oriflame.com.  Alternatively, you may make a complaint to the Irish Data Protection Commissioner online at https://forms.dataprotection.ie/contact, by writing to Office of the Data Protection Commissioner, 21 Fitzwilliam Square South Dublin 2, D02 RD28, Ireland or by calling +353 (01) 765 01 00 or +353 1800 437 737

 

If you want to exercise any of your rights in respect of your personal information, please contact us using the details located at section 17 of this notice. 

  1. Security

We treat all your personal information in confidence and we will take all reasonable steps to keep your personal information secure once it has been transferred to our systems. We implement appropriate security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. 

  1. Changes to this privacy notice

We may update this Privacy Notice. We will notify you of any material changes..

  1. Contact us 

If you have any questions about this privacy notice or how we handle your personal information, please email our Data Protection Officer at privacy@oriflame.com.