Privacy Policy

Last modified : August 25, 2026

FLC GROUP, a simplified joint-stock company with a single shareholder and a capital of 1,072 euros, registered with the Paris Trade and Companies Register under number 898 585 294, with its principal place of business at 8 rue François 1er – 75008 Paris, registered with ADEME under the unique identifier (IDU) FR404352_01PJYK (the “ Company ”) is the company responsible for the marketing of products under the Laboratoires Botanique Avancée, available for purchase on its website available at www.laboratoires-botanique-avancee.com (the “ Website ”).

The Company carries out, as part of the exercise of its business, processes Personal Data belonging tousers of the Website and of its customers (collectively, the “ Users ”), and acts in this capacity as the Data Controller, as defined by applicable regulations.

The Company is committedto to protecting your Personal Data, and makes every effort to ensure thehighest highest level of protection, in compliance with applicable regulations. To this end, the Company has implemented this privacy policy regarding Tprocessing of Personal Data collected and processed in the course of its business (the “ Policy ”).

For the purposes of this document, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “ GDPR ”) and the French Data Protection Act :

− Tterm “ Personal Data ” means any information relating to an identified or identifiable natural person (the “ Data Subject ”); a natural person is deemed to be identified or identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity;

− The term “ Processing ” refers to any operation or set of operations, whether or not performed by automated means, applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

− The term “ Data Controller ” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the Processing; and

− The term “ Processor ” means the natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of the Data Controller.

CATEGORIES OF PERSONAL DATA PROCESSED

The Personal Data processed by the Company is presented, by purpose, as follows: Tprocessing, in the table at the end of the Policy.

The Company collects and processes only the Personal Data strictly necessary to achieve the intended purposes. Consequently, the disclosure of suchPersonal Data is essential for the implementation of the Tprocessing operations in question. As an exception, twhether the collection of Personal Data is mandatory or optional is indicated by an asterisk (*).

VYour Personal Data may be collected by the Company in the following situations, among others:

When your browsing and use of the the Website, including through cookies and other trackers ;

When purchasing a pproduct on the Website or from a ppartner of the Company ;

When your participation in any event, a loyalty , a promotional campaign, or any other marketing campaigng organized by the Company ;

LWhen you fill out a form to collect data on the Site ; or

When communicating with the Company, particularly via email, telephone, mail, or any other means of communication.

Personal Data tprocessed by the Company include, in particular, the following categories :

Information regarding your civil identity and/or that of the recipients of a gift item (last name, first name, date of birth, gender, nationality);

Your contact information (address, phone number, and email address);

TInformation regarding orders placed (order contents and total amount, order date, payment methods);

Tinformation regarding your preferences (skin type, beauty routine, interests, etc.);

TTechnical relating your navigation on the Site and its use, collected via cookies and similar technologies (IP address, browser and device used, preferences, cookie choices, location information, interests, etc.) ;

If applicable,information regarding your participation in our loyalty program (loyalty program membership numberor or another partner program) ;

TResponses to the satisfaction surveys, studies, and polls ;

The information contained in the communications you send us (including in the event of a claim, complaint, or request to exercise your GDPR rights).

PURPOSES AND LEGAL BASES FOR THE PROCESSING OF YOURPERSONAL DATA

In accordance with applicable regulations, the Company processes your Personal Data only when it has a legal basis authorizing it to do so, from among the following :

The performance of a contract to which you are a party or pre-contractual measures taken at your request (for example, the performance of a sales contract);

The compliance with a legal obligation to which the Company is subject;

The pursuit of the Company’s legitimate interests, provided that such interests do not infringe upon your rights and freedoms;

Your consent, when required, for one or more specific purposes.

We process your Personal Data only for specificthe specified purposes and in accordance with the legal bases set forth in the table at the end of the Policy.

SHELF LIFE OF YOURYOUR PERSONAL DATA

Personal Data is retained in an active database for a period no longer than is necessary to fulfill the purposes for which it was collected.

At the end of this period, when the Personal Data is no longer necessary to fulfill these purposes but must be retained to comply with a legal obligation, to enable the exercise or defense of legal rights, or is still of administrative interest, it is archived. During this archiving period, the Data are accessible only on an ad hoc basis, for a justified reason, and solely by specifically authorized individuals.

For each processing purpose, the retention periods for active data and archived data are specified in the table at the end of the Policy.

USE OF COOKIES

When visiting the Site, cookies may be stored on the User’s device. A cookie is a text file designed to collect information regarding browsing and the User’s use of the Site theUUser. Thecookies used on the Site are generally capable of collecting Personal Data regarding Users.

When the Personal Data is collected and processed by the Company in its capacity as DData Controllerthe D, they are processed in accordance with this Policy, for the purposes listed in the table at the end of the Policy.

When third-party cookies allow our partners to collect and process Personal Data about you, we encourage you to review their pPrivacy Policy to learn about the conditions under which your Personal Data will be processed. The complete list of partners authorized to place cookies on the Site , as well as a link to their privacy policies, is available in the “ Cookie Management ” tab on the Site.

Several categories of cookies may be stored on your device:

Essential cookies, such as functionality, session, authentication, and security cookies, which are essential for the proper functioning and security the Site and are strictly necessary for providing the services you wish to access throughthe Site. They are enabled by default on the Site.

Tracking and analyticsaudience measurement and analytics cookies that allow us enable us to compile traffic statistics (for example, the number of visits, the most visited pages, etc.) to understand how visitors interact with the Site and improve the quality of our services and the user experience of the Site. The placement of these cookies is subject to your prior consent. If you do not accept these cookies, we will not be able to include your browsing activity in our performance statistics and audience metrics, nor will we be able to adapt theSite according to your preferences.

Adadvertising cookies that are used to track Users across third-party websites and that allow the Company and its partners to display ads that are relevant and interesting to the User. The placement of these cookies is subject to your prior consent. If you do not accept these cookies, we will not be able to take your preferences into account in order to display personalized ads on third-party websites.

When you visit the Site, a cookie banner appears, allowing you to accept or reject all cookies, or to make your selection by category for cookies that require your prior consent (strictly necessary cookies are enabled by default). Until you give your consent, these cookies are disabled by default and are not installed on your device.

You can change your cookie preferences at any time by clicking on the “ Cookie Management Cookies" tab, which is accessible from every page on the Site.

Your choices regarding whether to accept or reject cookies on the Site are stored for six (6) months, after which you will be asked again to express your consent, refusal, or cookie settings.

SECURITY MEASURES FOR YOURYOUR PERSONAL DATA

The Company is committed to protect the Personal Data in its possession. To this end, the Company ensures to take all necessary physical, technical, and organizational measures to prevent any unauthorizedunauthorized or unlawful processing, as well as any accidental loss, destruction, or damage tothe DPersonal Personal Data.

RECIPIENTS OF YOUR PERSONAL DATA

The Company may be requiredto to disclose yourPersonal Data to the following categories of recipients :

The eemployees of the Company, provided that these employees are informed of the applicable regulations and are required to comply with this Policy. Your Personal Data is disclosed only to those employees who need to know itin connection with the relevant processing ;

The Company’s Processors who collect and process your Personal Data solely on our behalf and in accordance with our instructions. These Subprocessors include ourour technical service providers, including our hosting providers and the providers who support the operation of our Site, such as Shopify.

The Company's Partners, including:

Our payment service providers payment providers, who collect payment information (such as bank account information, credit or debit card information, and billing address) to process your payment and fulfill your orders ;

When you visit our Site, open or click on emails we send you, or interact with our Services or our advertisements, we—or third parties with whom we work—may automatically collect certain information using online tracking technologies such as pixels, web beacons, software development kits, third-party libraries, and cookies.

Any information we receive from third parties will be handled in accordance with this Privacy Policy.

The Personal Data Processed may also be shared in order to comply with any legal or regulatory obligation. In such a case, the Company will use its best efforts to limit the Personal Data that the Company may need to share to what is strictly necessary.

When the Company transferssyour Personal Data outside the European Union, it ensures that such transfer is based on one the transfer mechanisms recognized under applicable regulations, such as the European Commission’s standard contractual clauses or an adequacy decision by the European Commission. Please contact us at the addresses listed in the “ Contact Us ” section of the Policy for more information on whether your Personal Data is transferred and the safeguards in place to ensure its protection in the event of a transfer.

The Company does not sell the Processed Personal Data to third parties.

The Company may be required to disclose your Personal Data in connection with any sale, acquisition, merger, restructuring, bankruptcy, or other legal transaction involving the Company. In such a case, the Company will take reasonable measures to ensure that Personal Data is processed in accordance with this Policy.

RIGHTS OF DATA SUBJECTS

Subject to the conditions set forth in the applicable regulations, you have the following rights regarding your Personal Data :

The right of access means that you may ask us at any time to inform you whether we process Personal Data about you and, if so, to tell you what that Personal Data in question, as well as the characteristics of the Pprocesses carried out.

The right to correction means that you can ask us to correct your Personal Data if it is inaccurate. You may also request that that your Personal Data, if incomplete, be supplemented to the extent that this is relevant to the purpose of the Tprocessing in question.

The right to erasure means that you can request that your Personal Data, particularly when: (i) their retention is no longer necessary for the purposes for which they were collected ; (ii) your Personal Data are processed based on your consent, you wish to withdraw that consent, and there is no other legal basis that could justify the Tprocessing ; (iii) you have objected to the Tprocessing of your Personal Data and, as a result, you wish to have them erased (iv) your Personal Data has been subject to a unlawfulunlawful processing; (v) your Personal Data must be erased to comply with a legal obligation under either European Union law or French law.

The right to restriction means that you can ask us to restrict the Trprocessing of your Personal Data when: (i) you contest the accuracy of your Personal Data for a period of time sufficient for us to verify its accuracy ; (ii) following a Tprocessing found to be noncompliant, you prefer to restrict the Tprocessing to the complete erasure of your Personal Data; (iii) we no longer need your Personal Data for the purposes of TProcessing but you still need it to establish, exercise, or defend legal claims; (iv) you have objected to the Pprocessing of your Personal Data and you wish to restrict the Tprocessing for the period necessary for us to verify whether the legitimate ground you have invoked is justified. The restriction of Pprocessing means that the Tprocessing of your Personal Data will then be solely storage. We will no longer perform any other operations on the Personal Data inin question.

The right to object means that you can object to the Tprocessing of your Personal Data, when such Tprocessing is based on the pursuit of the legitimate interest of the Company. The right to object may be exercised provided you can demonstrate a legitimate reason related to your particular situation. We will then cease the Tprocessing in question, unless there are legitimate and compelling reasons justifying its continuation in accordance with applicable regulations.

The right to set guidelines regarding what happens to your data after your death allows you to specify your instructions regarding the retention, deletion, and disclosure of your Personal Data after your death.

The right to data portability means that you may ask us, subject to the conditions set forth in applicable regulations, to receive your Personal Data in a structured, commonly used, and machine-readable format, and to have us provide them to you, or to ask us to transmit them directly to a third party of your choice when this is legally and technically feasible.

The right to withdraw your consent at any time, when we process your Personal Data based on your consent. However, withdrawing your consent does not affect the validity of the Tprocessing carried out prior to such withdrawal.

These rights may be exercised at the addresses listed in the “ Contact Us " section below.

If you have any questions regarding this Policy or wish to exercise your rights, you may contact the Company :

By email to the following address: info@laboratoires-botanique-avancee.com ; or

By mail by mail to the following address : FLC GROUP, 8 rue François 1er 75008 Paris

If you are not satisfied with the response you receive, you have the right to file a complaint with the National Commission for Information Technology and Civil Liberties (“CNIL”).

POLICY UPDATE

The Company reserves the right at any time to modify or update, in whole or in part, this Policy, due to changes in applicable regulations regarding the protection of Personal Data or processing carried out.

We recommend that you review this Policy regularly to ensure you are fully informed of our commitments regarding the protection of your Personal Data.

DETAILS OF THE PROCESSING OF PERSONAL DATA

Purpose of Processing	Legal Basis for Processing	Categories of Personal Data	Retention Periods
Purpose of Processing	Legal Basis for Processing	Categories of Personal Data	Active Base	Archiving
Account Creation and Management uuser accounts on the Site	Consent	Civil Identity Contact Information Order Information Information About Your Preferences	2 years from the last login to the account or until the user withdraws consent	--
Management, processing, and tracking of orders for pproducts and/or pproducts cgifts	Performance of a Contract	Civil Identity Contact Information Order Information Information About Your Preferences	Term of the Contractual Relationship	5 years from the end of the contractual relationship
Bookkeeping	Compliance with a Legal Obligation	Civil Identity Order Information Financial Information and Accounting Documents	Term of the Contractual Relationship	10 years from the end of the fiscal year
Loyalty Program Management	Performance of a Contract	Civil Identity Contact Information Order Information Information About Your Preferences Information Regarding Your Participation in the Loyalty Program	Term of the Contractual Relationship	5 years from the end of the contractual relationship
Claims and Complaints Management	Performance of a Contract	Civil Identity Contact Information Order Information Details of Your Claim	Term of the Contractual Relationship	5 years from the end of the contractual relationship
Conducting satisfaction surveys, studies, and polls	The Company's Legitimate Interest	Civil Identity Contact Information Order Information Responses to surveys, studies, and polls	The time required to achieve the purpose of the survey or until the right to object is exercised	--
Electronic Sales Prospecting	Consent (Prospects) Legitimate Interest of the Company (customers)	Civil Identity Contact Information	Until consent is withdrawn or 3 years from the date of the individuals' last contact with the organization	--
Compilation ofsales statistics	The Company's Legitimate Interest	Order Information	The time required to achieve the purpose for which the statistics are collected or until the right to object is exercised	--
Improving the Company's Products and Services	The Company's Legitimate Interest	Order Information RResponses to satisfaction surveys, studies, and polls	Time required to achieve the study's objective to improve products/services or until the right to object is exercised or consent is withdrawn	--
Management of events, programs, and marketing activities organized by the Company	The Company's Legitimate Interest	Civil Identity Contact Information	Until consent is withdrawn or 3 years from the date of the individuals' last contact with the organization	--
Handling Requests to Exercise GDPR Rights	Compliance with a Legal Obligation	Civil Identity Contact Information Contents of the Request to Exercise a Right All data relevant to the request	Time Required to Process a Request to Exercise a Right	5 years from the date the application is closed
Litigation and Dispute Management	The Company's Legitimate Interest	Civil Identity Contact Information Facts of the Case	Data on pre-litigation matters : Time required to handle pre-litigation matters Data on litigation : Time required to manage litigation	Data Related to Pre-Litigation Proceedings : retained until the statute of limitations applicable to the claim expires Data related to litigation : retained until a final decision is obtained and enforced, or for 10 years from the date the decision is rendered if it is not enforced
Website Navigation and Security Management: providing basic functionality and access to secure areas, and saving preferences and purchase history	The Company's Legitimate Interest	Technical information regarding navigation and use of the Site (essential cookies)	12 months from the date of data collection	--
Audience measurement on the Site to help us understand how Users interact with the Site and optimize its performance	Consent	Technical information regarding navigation and use of the Site (analytical cookies)	12 months from the date of data collection	--
Displaying personalized ads to users on various websites	Consent	Technical Information Regarding Browsing and Use of the Site (Advertising Cookies)	12 months from the date of data collection	--