Privacy Policy

LABORATOIRE DE LONGÉVITÉ CIBLE SKIN

Simplified Joint Stock Company (Sole Shareholder)

Registered office: 31 rue François 1er, 75008 Paris

SIREN 813 609 542 – RCS Paris

PRIVACY POLICY

www.cibleskin.com

Respect for privacy and the protection of personal data are a key factor in building trust, a value to which Laboratoire de Longévité Cible Skin is particularly committed, upholding the fundamental freedoms and rights of every individual. We recommend that you read this policy carefully: it contains important information about your personal data.

1. Data Controller

The website www.cibleskin.com (the "Site") is published and operated by Laboratoire de Longévité Cible Skin ("LLCS", "we"), a simplified joint stock company with a sole shareholder registered with the Paris Trade and Companies Register under number 813 609 542, whose registered office is located at 31 rue François 1er, 75008 Paris. LLCS is responsible for the processing of personal data described in this policy.

For any questions regarding your personal data or to exercise your rights, you can write to us at contact@cibleparis.com.

2. Scope

This policy describes the processing of personal data carried out via the Site and within the framework of our commercial relationship with you (account creation, orders, communications, customer service, newsletters). It does not apply to third-party sites to which the Site may refer, which are subject to their own policies.

3. Data we collect

– Identity and contact details: surname, first name, email address, postal address, telephone number, provided via our forms (account creation, order, newsletter subscription, contact).

– Account and purchase data: order history, products viewed, preferences.

– Payment data: your payments are processed directly by our secure payment service provider; we do not store your credit card numbers.

– Browsing data: IP address, device identifiers, operating system, browser type, pages viewed, collected using cookies and other trackers under the conditions described in section 7.

– Communications: content of your exchanges with our customer service, reviews of our products, interactions via social networks.

– Cosmetovigilance: reports of adverse effects related to our cosmetic products may contain data concerning your health; they are processed under the conditions described in section 4 and with enhanced safeguards.

4. Purposes, legal bases and retention periods

We process your data for the following purposes:

– Order, delivery and after-sales service management — legal basis: contract performance. Retention: duration of the commercial relationship, then archiving during the applicable legal prescription and retention periods (up to ten (10) years for accounting documents).

– Creation and management of your customer account — legal basis: contract performance. Retention: until account deletion, then archiving under the same conditions.

– Commercial prospecting and newsletters — legal basis: your consent or, for our customers and for similar products or services, our legitimate interest (see section 5). Retention: three (3) years from your last contact.

– Email opening measurement and personalization — legal basis: your consent or, for subscribers whose address was collected before April 14, 2026, the transitional provisions provided by the CNIL recommendation relating to tracking pixels, with a right to object (see section 6). Retention: thirteen (13) months.

– Management of product reviews — legal basis: your consent. Retention: duration of review publication.

– Cosmetovigilance — legal basis: compliance with our legal obligations under cosmetic regulations (Regulation (EC) No 1223/2009); health data potentially contained in reports are processed on the basis of Article 9, paragraph 2, i) of the GDPR. Retention: durations provided by applicable regulations.

– Accounting and tax obligations — legal basis: legal obligation. Retention: ten (10) years.

– Prevention of payment fraud — legal basis: our legitimate interest. Retention: strictly necessary duration for analysis, within the limits recommended by the CNIL.

– Store location — if you use a store or institute search function, your location is only used with your consent, expressed via your browser, and is not stored.

At the end of these periods, your data is irreversibly deleted or anonymized; anonymized data may be kept for exclusively statistical purposes.

5. Commercial prospecting

We send you commercial communications by email only if you have consented to it or, if you are already a customer, for products or services similar to those you have purchased, in accordance with Article L. 34-5 of the French Post and Electronic Communications Code. You can object at any time, without reason and free of charge, via the unsubscribe link present in each of our emails or by writing to us at the address indicated in section 1.

6. Trackers in our email communications

This section describes the use of trackers (tracking pixels) in emails sent by LLCS to its customers and subscribers, in accordance with the CNIL recommendation of April 14, 2026, relating to tracking pixels in emails. It complements the other sections of this policy, which remain applicable.

6.1. What is a tracking pixel?

A tracking pixel is an invisible, one-pixel image embedded in the body of an email. When the email is displayed, the loading of this image signals its opening. The information that may be collected on this occasion includes: email opening and its timestamp, the type of device and email client used, and an approximate IP address.

6.2. Purposes and legal bases

We distinguish two uses:

– Technical deliverability monitoring: to ensure the proper delivery of our emails and detect sending errors. This monitoring is strictly necessary for the provision of the communication service you have requested and is exempt from consent.

– Open rate measurement for marketing purposes: to understand what content interests you in order to adapt our communications, personalize our recommendations, and adjust the frequency of our mailings. The regime applicable to this monitoring depends on the date your address was collected, under the conditions described in section 6.3.

6.3. Your choice: consent and right to object

– If your address was collected on or after April 14, 2026: in accordance with Article 82 of Law No. 78-17 of January 6, 1978, open rate measurement for marketing purposes is subject to your prior consent, distinct from your consent to receive our emails. By default, tracking is disabled: it is only activated if you explicitly authorize it via your preferences space. You can withdraw your consent at any time, as simply as you gave it.

– If your address was collected before April 14, 2026: in accordance with the transitional provisions provided by the CNIL recommendation of April 14, 2026, open rate measurement may remain active. You have been informed of this by email and you can object to it at any time, simply, without reason and free of charge, via the objection link or the preferences space accessible from each of our emails. Your objection takes effect immediately.

In all cases, your choice has no impact on the receipt of our emails. We keep timestamped proof of your choice.

6.4. Recipients and Sub-processors

Data related to trackers is processed on our behalf by our emailing service provider Klaviyo, acting as a sub-processor within the meaning of Article 28 of the GDPR. This provider may process data in the United States; this transfer is governed by our provider's certification to the EU-U.S. Data Privacy Framework and, in the alternative, by the standard contractual clauses adopted by the European Commission. A copy of these safeguards can be obtained from the contact indicated in section 1.

6.5. Retention periods

– Opening data and associated statistics: thirteen (13) months from their collection. Beyond that, only aggregated statistics, which do not allow you to be identified, are retained.

– Proof of consent, refusal or objection: retained for the entire validity period of your choice, then archived for five (5) years.

7. Cookies and trackers on the Site

When you first visit the Site, a banner allows you to accept, refuse or configure, purpose by purpose, the deposit of cookies and other trackers: cookies strictly necessary for the operation of the Site (exempt from consent), audience measurement, personalization and advertising. Your choice can be modified at any time via the cookie management module accessible from the Site. The lifespan of trackers does not exceed thirteen (13) months and the information collected through them is kept for a maximum of twenty-five (25) months.

8. Recipients and sub-processors

Your data is accessible to our specifically authorized staff, in strict compliance with their duties, as well as to our sub-processors acting for the purposes described above: e-commerce platform and hosting, emailing provider (Klaviyo), payment service provider, logistics and transport providers, audience measurement and advertising tools. Each of these providers is bound by a contract compliant with Article 28 of the GDPR.

Your data may also be communicated to the competent authorities when a legal provision or a judicial or regulatory decision requires us to do so. In the event of a merger, acquisition or asset sale, you would be informed beforehand before your data is transferred or subject to a new privacy policy. Your data is never sold to third parties.

9. Transfers outside the European Union

Some of our service providers may process data outside the European Union. Any transfer is then framed by one of the mechanisms provided for in Chapter V of the GDPR: an adequacy decision by the European Commission (including, for the United States, the recipient's certification to the Data Privacy Framework) or standard contractual clauses, supplemented where appropriate by additional measures. The transfer to our emailing provider is described in section 6.4. You can obtain a copy of the applicable guarantees by writing to us at the address indicated in section 1.

10. Security and data breaches

We implement appropriate technical and organizational measures to ensure a level of security adapted to the risks, in accordance with Article 32 of the GDPR. In the event of a personal data breach, we carry out the required notifications to the CNIL and, when the breach is likely to result in a high risk to your rights and freedoms, we inform you under the conditions provided for in Article 34 of the GDPR.

11. Your rights

You have, under the conditions provided by the regulations, the following rights: right of access, rectification, erasure, restriction of processing, objection — including, concerning commercial prospecting, without having to provide a reason —, portability of your data, as well as the right to withdraw given consent at any time and the right to define directives concerning the fate of your data after your death (Article 85 of Law No. 78-17 of January 6, 1978).

You can exercise these rights by writing to contact@cibleparis.com. Proof of identity may be requested in case of reasonable doubt about your identity. We will respond within one (1) month, extendable by two (2) months in case of a complex request. You also have the right to lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr).

12. Minors

The Site is intended for an adult audience and our products are not for children. We do not knowingly collect data from minors under fifteen (15) years of age. If you are a parent or guardian and believe that a minor has provided us with data, please contact us at the address indicated in section 1 to request its deletion.

13. Modification of this policy

The current version of this policy is the one published on the Site, with its update date. In the event of a substantial modification, we will inform you by any appropriate means and, when required by regulation, we will seek your consent.

14. Applicable law and remedies

This policy is governed by French law, without prejudice to the mandatory provisions applicable in your usual country of residence if you are a consumer. In case of difficulty, we invite you to contact us beforehand to seek an amicable solution; you always retain the right to refer the matter to the CNIL or the competent courts.

Effective date: July 14, 2026 — this version replaces the one of October 31, 2022.