ORIFLAME PRIVACY NOTICE

GUEST SHOPPERS

Version: 1.0
Effective Date: 08/07/2026
Last Updated: 08/07/2026

What does this policy cover?

This Privacy Notice describes how Oriflame Holdings BV, registered at Hoogstraat 10B, 5462 CX Veghell. The Netherlands, registration number VAT: NL006687702B01 (“Oriflame”, the “Company”, “we”, “us” or “our”) processes your personal data when you use the Oriflame sales platform to purchase products as a guest customer without creating an account or joining the Oriflame Beauty Community (“Guest Shopper”).

Guest Shoppers do not create a permanent Oriflame customer account or Beauty Community profile when using guest checkout. Each guest purchase is processed independently.

This Privacy Notice applies only to Guest Shoppers. If you register as a VIP, Brand Partner or otherwise participate in the Oriflame Beauty Community, a separate privacy notice applies.

For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”) and the UK General Data Protection Regulation (“UK GDPR”), we are the controller of your personal data.

Guest Checkout is intended for individuals legally capable of entering into binding purchase contracts under applicable law.

What personal data is collected?

We collect and process personal data in connection with your use of Guest Checkout, including when you place orders, contact Customer Services, interact with our website or applications, or choose to receive marketing communications.

1. Personal data collected directly from you

  • full name;
  • billing and delivery address;
  • email address;
  • telephone number;
  • order details;
  • payment-related information;
  • information you provide when contacting Customer Services;
  • information you provide in relation to complaints, returns, refunds or other enquiries;
  • marketing preferences and consent choices, where applicable.

2. Personal data collected automatically

We may automatically collect:

  • technical information, including Internet Protocol (IP) address, browser type and version, device identifiers, operating system, time-zone setting and platform information;
  • information about your use of our website, applications and checkout process, including page interaction information, session information, browsing behaviour, products viewed, clickstream information and page response times;
  • information obtained through cookies and similar technologies, subject to applicable consent requirements.

3. Personal data received from third parties

We may receive personal data from:

  • payment service providers and payment intermediaries;
  • fraud prevention and security partners;
  • delivery and logistics providers;
  • customer support service providers;
  • analytics and survey providers;
  • Oriflame Group companies supporting our operations.

Payment card details are processed directly by our external payment service providers and are not stored by Oriflame.

Some personal data is required for us to process your order, deliver products, process payments, comply with applicable legal obligations and provide customer support. Without this information, we may not be able to complete your purchase or provide certain services.

Where information is optional, this will be made clear at the point of collection.

4. How is your personal data used, and what is the legal basis for this use?

We process your personal data for the following purposes:

Purpose Legal basis
To establish and fulfil a contract with you when you make a purchase, including verifying your order, processing payment, communicating with you, arranging delivery, providing customer services and handling returns, refunds or complaints. Contractual necessity
To send transactional and operational communications, including order confirmations, payment confirmations, delivery updates, customer service messages and information necessary to manage your order. Contractual necessity
To provide customer support and respond to enquiries, complaints, warranty claims or disputes. Contractual necessity; our legitimate interest in protecting and managing our business
To prevent, detect and investigate fraud, payment abuse, misuse of our systems, security incidents or unlawful activity. Our legitimate interest in protecting our business, systems, customers and transactions
To comply with applicable laws, including tax, accounting, consumer protection, product safety, regulatory, investigative and legal reporting obligations. Legal obligation
To establish, exercise or defend legal claims and protect our legal rights and business interests. Our legitimate interest in protecting our rights and interests
To analyse, monitor, improve, administer and protect our products, services, website, applications and IT systems. Our legitimate interest in improving and protecting our business
To invite you to provide feedback relating to your checkout or payment experience directly within the website or app after checkout completion. Participation in such surveys is voluntary. Our legitimate interest in improving our services and customer experience
To provide marketing communications, newsletters, product offers or promotional communications where you have separately chosen to receive them. Your consent
To manage your marketing preferences and respect your communication choices, including unsubscribe requests. Legal obligation; our legitimate interest in ensuring compliance with your preferences and applicable marketing laws
To personalise marketing communications, advertising or website features, where required by applicable law. Your consent
To analyse the effectiveness of our communications, advertising and services. Our legitimate interest in improving and managing our business; consent where required by law

Transactional and operational communications are necessary for the performance of your purchase contract and cannot be opted out of while your order is being processed. These communications do not constitute marketing communications.

Electronic marketing communications are sent only where permitted under applicable electronic communications and privacy laws.

Where we rely on legitimate interests, we ensure that our interests are balanced against your rights and freedoms and that processing is proportionate and limited to what is necessary.

You may withdraw your marketing consent at any time by using the unsubscribe link in our communications or by contacting us directly. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where you unsubscribe from marketing communications, we may retain limited information necessary to ensure we continue to respect your preferences.

Abandoned or incomplete guest checkouts

If you begin a guest checkout process but do not complete your order, we do not retain your personal data longer than necessary to maintain the technical functionality, security and integrity of the checkout process.

Where temporary records relating to incomplete guest checkouts are technically created, they will be deleted or anonymised after a short period unless retention is legally required or otherwise justified for security, fraud prevention or technical troubleshooting purposes.

5. Automated decision-making and profiling

We do not use fully automated decision-making that produces legal or similarly significant effects on you.

We may use limited analytics and profiling to:

  • analyse website and checkout performance;
  • detect fraud or misuse;
  • understand customer interactions with our services;
  • improve website functionality, products, services and customer experience;
  • personalise marketing communications where you have consented to marketing and such personalisation.

Where profiling or similar technologies are used for marketing or advertising purposes, we rely on your consent where required by applicable law.

6. Who will your personal data be shared with and where will it be sent?

We will make your personal data available only to those who require it for the purposes described in this Privacy Notice.

We may share your personal data:

A. Within the Oriflame Group

We may share your personal data with other companies within the Oriflame Group where necessary for the operation, administration and support of our business activities, including for:

  • IT systems administration, hosting, cybersecurity and technical support;
  • ecommerce platform management and digital operations;
  • customer service and support operations;
  • payment administration, finance, accounting and auditing;
  • logistics, delivery and order fulfilment;
  • legal, compliance, risk management and corporate administration;
  • analytics, reporting and operational support; and
  • marketing operations, customer relationship management, communication management and customer engagement activities.

B. With service providers, partners and third parties

We may also share your personal data with service providers, partners and other third parties supporting our business operations, including:

  • payment service providers and payment intermediaries;
  • logistics, delivery and fulfilment providers;
  • customer support service providers;
  • fraud prevention, security and cybersecurity providers;
  • IT, cloud hosting, software and infrastructure providers;
  • analytics, survey and customer experience providers;
  • accounting, audit, legal and professional advisers; and
  • marketing, customer relationship management and communication service providers.

C. With authorities and regulators

Where required by law or necessary to protect our legal rights, legitimate interests, customers, systems or business, we may disclose personal data to:

  • courts;
  • regulators;
  • supervisory authorities;
  • law enforcement agencies;
  • governmental or public authorities.

7. Corporate transactions and reorganisations

In the event of an actual or proposed sale, merger, acquisition, reorganisation, restructuring, transfer of assets, change of control, joint venture, financing transaction, outsourcing arrangement, dissolution or other corporate transaction involving all or part of our business or Oriflame Group activities, your personal data may be disclosed to our advisers, prospective transaction partners, investors, purchasers or other relevant third parties and transferred to any successor, affiliated or relevant entity involved in such transaction.

The same applies in the event of a reorganisation of Oriflame Group activities (including consolidation, outsourcing or changes to functions or responsibilities between Group entities), in which case your personal data may be shared with and transferred to relevant entities within or supporting the Oriflame Group.

Any such sharing or transfer of personal data will take place in accordance with applicable data protection laws and subject to appropriate safeguards where required.

8. International transfers

We process your personal data in your country, within the European Economic Area and the United Kingdom, but in some cases recipients may be located outside these territories, including in countries that may not provide a level of data protection equivalent to that provided under applicable European or UK data protection laws.

Where personal data originating from the United Kingdom is transferred internationally, we use safeguards recognised under UK data protection laws.

Where required by applicable law, we use appropriate safeguards for international transfers, including:

  • adequacy decisions;
  • the EU Standard Contractual Clauses;
  • the UK International Data Transfer Agreement or UK Addendum;
  • participation in recognised international transfer frameworks where applicable;
  • other lawful transfer mechanisms recognised under applicable law.
You may contact us for further information regarding applicable transfer safeguards.

9. What cookies and similar technologies are used?

Our website, applications and platforms use cookies and similar technologies to:

  • provide website functionality;
  • maintain security;
  • analyse website usage and performance;
  • improve user experience;
  • personalise content or advertising where permitted;
  • measure effectiveness of communications and services.

Where required by law, analytics, advertising and personalisation technologies are used only with your consent.

For detailed information, please read the Oriflame Cookie Policy.

10. Security of your personal data

We implement appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or other unlawful forms of processing.

11. Your rights

Depending on applicable law, you may have the right to ask us:

  • for access to your personal data, including a copy of your personal data;
  • to correct inaccurate, incomplete or outdated personal data;
  • to erase your personal data;
  • to restrict the processing of your personal data;
  • to object to processing based on our legitimate interests;
  • to object to direct marketing;
  • to receive your personal data in a structured, commonly used and machine-readable format and transmit it to another controller;
  • to withdraw your consent where processing is based on consent.

These rights may be limited in certain circumstances, including where we are legally required or otherwise permitted to retain or process personal data.

To exercise your rights or ask questions regarding this Privacy Notice, you may contact our Data Protection Officer at: privacy@oriflame.com.

You may also contact us at:

Oriflame Holdings BV

Hoogstraat 10B, 5462 CX Veghell. The Netherlands

VAT: NL006687702B01

info@oriflame.co.uk (UK) / info@oriflame.ie (ROI)

Customer Services at Phone: 0207 1180081 (UK) / 01485 1010 (IE) 

If you have unresolved concerns, you also have the right to lodge a complaint with a competent data protection authority. The relevant authority may be the supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement. For the United Kingdom, this is the Information Commissioner’s Office.

12. How long will we hold your data?

We retain your personal data only for as long as necessary for the purposes described in this Privacy Notice.

In particular:

  • order, payment, delivery and customer service records are retained for as long as necessary to fulfil your order and manage related customer service matters;
  • tax, accounting and transaction records are retained for the period required by applicable law;
  • information necessary to establish, exercise or defend legal claims may be retained for applicable limitation periods;
  • marketing consent and suppression records are retained as necessary to manage your preferences and demonstrate compliance;
  • incomplete or abandoned guest checkout records are deleted or anonymised after a short period unless retention is required for security, fraud prevention or legal purposes.

    Retention periods may vary depending on local legal requirements.

Changes to this Privacy Notice

Any changes we may make to this Privacy Notice in the future will be posted on our website and, where appropriate, notified to you electronically or otherwise.