Update 11/27/2025
Sothys Paris attaches great importance to the protection of your privacy and personal data and, to this end, has implemented this policy.
This policy describes how Sothys Paris, in its capacity as data controller within the meaning of EU Regulation No. 2016/679 of the European Parliament and of the Council of April 27, 2016, known as the "GDPR," uses your personal data, collected when you use the www.sothys.fr website (hereinafter the "Site"), as well as when you view our communications or interact with us (hereinafter collectively the "Services"). The purpose of this policy is to provide you with a summary of all the situations in which Sothys Paris may collect your personal data. However, you may not be affected by all the situations described below.
This policy applies to all Services offered by Sothys Paris, referred to interchangeably as "Sothys Paris," "We," or "Our."
This policy does not apply to sites and services that have a separate charter or policy that does not incorporate or refer to this policy.
By using our Services, you agree to provide us with accurate and verifiable information about yourself.
What is personal data?
This refers to any data capable of identifying a natural person either directly (e.g., a name) or indirectly (e.g., an identifier, a code).
What data do we collect?
In the context of your interactions with us, we may collect personal data about you. This data varies depending on the nature of our interactions.
You can provide us with your personal data in different ways, as specified in the table below:
- either directly: notably through a form;
- or indirectly: cookies.
We do not collect personal data from third parties.
We take care to collect only the data strictly necessary in order to provide you with an experience that is as pleasant and adapted to your needs as possible, and to provide you with the desired Services.
For this purpose, and if necessary, your consent will be required.
In cases where your data is collected via a form, we ensure that the necessary legal notices as well as a reference or link to this policy are included on that medium. Fields that must be filled out are marked with an asterisk. Failure to provide information in the fields marked with an asterisk may impact our ability to offer you the desired Services or manage your requests.
The personal data that may be processed, the purposes we may pursue, the applicable legal bases for processing, and the retention periods for your data are as follows, depending on the situations giving rise to their collection:
| Situation that may give rise to the collection of personal data | Nature of data collected | Purpose(s) of processing (performed by us or our subcontractors) | Legal basis/bases for processing | Data retention period |
|---|---|---|---|---|
| Creation of a customer account on the Site | Last name, first name, email address, login data | Customer relationship management and sending of personalized offers Statistical data (Site audience) |
Performance of a contract (to be able to provide the service you subscribed to) Legitimate interest |
3 years in an active database from the end of the commercial relationship 2 years from the date of collection |
| Information request via a contact form on the Site | Last name, first name, postal and email addresses, telephone number, and message content | Processing your request | Consent | 3 years in an active database from the date of collection or your last contact |
| Request to receive a newsletter | Email address | Sending information about the brand | Consent | 3 years in an active database from the last contact or until unsubscribing |
| Request to receive commercial communications | Email address | Sending commercial communications | Consent | 3 years in an active database from the last contact or until unsubscribing |
| Reporting a case of cosmetovigilance (outside the United States) | Last name, first name, age, profession, telephone number, postal and email addresses, health data | Management and monitoring of a cosmetovigilance case | Legal obligation | 2 years in an active database from the registration of the cosmetovigilance case (subject to the closure of said case; otherwise, until the closure of said case). |
| Reporting a case of cosmetovigilance in the United States | Name, postal and email addresses, telephone number, date of birth, age, gender, weight, race, ethnicity, skin type, health data, retailer name, retailer postal address | Management and monitoring of a cosmetovigilance case | Legal obligation | Duration necessary for the purpose of this operation |
| Registration in the Sothys Academy™ model registry via Microsoft Forms | Last name, first name, email address, phone number, age group, availability, medical information, aesthetic care preferences | Management and monitoring of the Sothys Academy™ model registry. Management and monitoring of a cosmetovigilance case |
Legitimate interest Legal obligation |
3 years in an active database from the last contact. See cosmetovigilance case reporting. |
| Customer relationship management via Social Networks | Last name, first name, pseudonym | Management and moderation of social networks Customer relationship management via social networks, including Sothys brand image |
Legitimate interest | In accordance with the personal data policy of each Social Network |
| Participation in a promotional activity (e.g., prize draw) | Last name, first name, postal and email addresses, participants' telephone numbers, social network page(s) | Participation in the commercial operation Execution of the commercial operation |
Consent Performance of a contract |
Duration necessary for the purpose of this operation |
| Request to exercise personal rights | Last name, first name, email address, content of the request, identity document (if verification is necessary) | Management of requests to exercise personal rights under the GDPR | Legal obligation | 5 years from the date of the request or the closure of the request processing. |
| Product recalls | Last name, first name, email address, postal address, phone number | Management of product recalls for customers affected by the products subject to recall Maintaining the claims register |
Legal obligation and Reason of public interest | 10 years from the date of the recall |
| Browsing (data collected by cookies) | (For these points, see the dedicated cookie policy) | |||
It should be noted that the retention periods indicated cover storage in an active database and intermediate archives. Beyond the stated periods, your personal data will be anonymized or deleted, in accordance with our personal data life cycle management policy.
Who is the data controller?
The data controller is the person who determines the purposes and means of processing. They are directly responsible for compliance with personal data protection obligations.
Sothys Paris is the data controller.
Who are the recipients of your data?
Your personal data is intended exclusively for authorized and determined recipients, for the sole purpose of executing the desired Services.
Thus, in addition to internal members of our company, certain data may be processed by the following subcontractors (hereinafter "Subcontractors"):
- for Site hosting: to the company Amazon Web Services EMEA SARL;
- for promotional operations: to the company Sothys International;
- for cosmetovigilance: to the company Soredec, managing cosmetovigilance activity on behalf of our company; to the technical service providers used by said company, and in this capacity, for cosmetovigilance cases in the United States, to the company Registrar Corp: https://www.aers.me/privacy-policy/; to third parties whose product might be involved; to health professionals; to notified bodies in charge of product evaluation; to national or foreign public bodies in charge of vigilance within the framework of their missions; to international health authorities or agencies;
- for registration in the Sothys Academy™ model registry: to the company Microsoft, in its capacity as developer and host of the Microsoft Forms form: https://privacy.microsoft.com/fr-fr;
- when using social network buttons: to the relevant social network in accordance with its terms of use, which we invite you to consult directly on their site;
- to any third party involved in one of the aforementioned purposes in the context of their missions, including in particular the technical service providers used by the aforementioned recipients, third parties whose product might be involved in the context of cosmetovigilance, health professionals, notified bodies in charge of product evaluation, public bodies in charge of vigilance and transparency obligations, and national and/or international health authorities or agencies.
In this capacity, we inform you that your personal data may be transferred outside the European Union, particularly to the United States, in the context of services provided by our Subcontractors.
In all cases, we ensure that our Subcontractors comply with the applicable European regulation on the protection of personal data and that the transfers are carried out in accordance with said regulation.
How is the security of your personal data ensured?
Your personal data is protected by technical and organizational measures that comply with French and European legal and regulatory requirements, ensuring its security and confidentiality.
In particular, Sothys Paris uses protective technologies, such as encryption systems.
Sothys Paris ensures, through written commitments, that its service providers and Subcontractors provide sufficient guarantees and implement appropriate security measures to ensure the protection of the personal data entrusted to them for processing, in accordance with the requirements of personal data protection legislation.
What are your rights?
In accordance with current regulations, you have a right to information (receiving concise, transparent, understandable, and easily accessible information in clear and simple terms), a right of access to your personal data, as well as rights of rectification, objection, erasure, portability, and restriction of processing, by contacting us at: dpo@sothys.net.
In case of doubt about your identity, we may ask you for a copy of your identity document.
In the event of the exercise of your right to object and/or erasure and/or portability of data concerning you:
- we may be unable to perform certain Services;
- we will be unable to comply when the legal basis of the processing in question is compliance with a legal obligation (e.g., cosmetovigilance).
You have the option to withdraw your consent to the collection and processing of your personal data at any time.
You also have the right to object to telephone canvassing by registering for free on the telephone canvassing opposition list accessible on the website Bloctel - Consumer Space, or by writing to Bloctel - 6, rue Nicolas Siret - 10000 Troyes. You will no longer be contacted by telephone by us, except in the context of and for the performance of a current contract, in accordance with the provisions of Article L 223-1 of the Consumer Code.
You also benefit from the right to file a complaint with the CNIL:
- on the CNIL website at: https://www.cnil.fr/fr/plaintes; or
- by mail by writing to: CNIL - Service des Plaintes - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.
and/or to pursue any judicial remedy.
Update
This policy may be updated at any time, particularly to reflect any new personal data processing or regulatory, legal, or technological changes. The update becomes effective as soon as it is published online.