Privacy Policy

1Who is responsible

The controller of personal data on vauzel.com is Onda Invest, société par actions simplifiée à associé unique, 50 avenue des Champs-Élysées, 75008 Paris, France. Questions about this policy go to privacy@vauzel.com.

2Consumer health data

We do not collect consumer health data.

The Skin Diagnostic asks about menopause and skin. Its result is calculated in the browser. No answer is stored, sent to a server, linked to an email or passed to Meta, and the answers disappear when the page closes.

The optional question on the thank-you page concerns cosmetic preferences only: dryness, firmness, radiance, sensitivity or fine lines.

A message to the house about a reaction to a product holds what its author chooses to write. We use it to answer and to meet our safety duties as a cosmetics company, and it never serves advertising. It goes straight to the mailbox of the house, and it never passes through the tool that delivers the letters. A report of a reaction is kept for 6 years, in line with American law on cosmetics.

3What we collect, why, and for how long

The list

Data

A first name, an email, a reserved number, where the sign-up came from (this site, a link in an advertisement or from a creator, or a form on Facebook or Instagram), and the proof of consent: date, time, exact text of the form, version of this policy.

Purpose

To hold the number, to send the letters of the house and to announce the opening.

Legal basis

Consent, GDPR Article 6(1)(a).

Kept

An address left unconfirmed is deleted after 30 days. A confirmed address is kept until it unsubscribes, or until 24 months pass without a letter being opened. The proof of consent is kept for as long as the address stays on the list, and for 5 years after that, in order to show that it was given.

Joining from Facebook or Instagram

Data

A first name and an email, typed into a form of Meta, with the box of the same consent, ticked.

Purpose

The same as the list. A letter then asks to confirm the email, and the number is given at that moment.

Legal basis

Consent, GDPR Article 6(1)(a).

Kept

As for the list. Meta also holds the answers to its form, under its own policy.

The letter of confirmation, and the click

Data

The first name and the email given, for the letter that asks to confirm the email. Then, at the click on Confirm my email, the email again, sent by the browser of the person to the tool that delivers the letters, which receives with it the connection address and details of that browser. When the service of the letter of confirmation cannot take it, past its daily limit or during an outage, the tool that delivers the letters sends the same letter instead, and so receives the first name and the email at the sign-up.

Purpose

To ask for the confirmation, and to put the address on the list of the house only once it is confirmed. An address left unconfirmed reaches the tool that delivers the letters only when that tool sends its letter of confirmation, and is deleted there after 30 days without a click.

Legal basis

Consent, GDPR Article 6(1)(a).

Kept

The service that delivers the letter of confirmation keeps a record of its sending under its own terms. Sent by that service, the letter of confirmation carries no tracking pixel, and no link in it is counted. Sent instead by the tool that delivers the letters, it carries the tracking pixel of the other letters, described in Article 3. The click is kept as the rest of the list.

Text messages

Data

A mobile number, given only by those who want a text, and the proof of this separate consent: date, time, exact text of its box, version of this policy.

Purpose

Two texts at most: one when the priority of founding members opens, one on its last day. No text is sent before the house opens. The SMS Terms set them out.

Legal basis

Consent, GDPR Article 6(1)(a), given in its own box, unticked, apart from the letters. Consent is not a condition of purchase.

Kept

Every number is deleted the day after the last day of priority, or earlier if the address leaves the list. A reply of STOP ends the texts at once. The proof of this consent is kept for 5 years after that, in order to show that it was given.

Knowing that a letter was opened

Data

Each letter delivered by Klaviyo carries a small invisible image, called a tracking pixel, on every device where it is read: every letter sent once the email is confirmed, and the letter of confirmation when Klaviyo sends it instead. When the image loads, Klaviyo records that the letter was opened, with the date and time, the connection address when available, and details of the device.

Purpose

To stop writing after 24 months without an opening. The house uses it for that alone, and never for a profile or for advertising.

Legal basis

Consent, GDPR Article 6(1)(a), and Article 82 of the French data protection law. The box on the form and the line under it cover the letters and this image together, and the letters cannot go without it.

Kept

At Klaviyo, as long as the address stays on the list. Leaving the list deletes it there. The house itself keeps no more than the day of the last opening it has checked.

The two questions on the thank-you page

Data

One word, chosen by the person from five: dryness, firmness, radiance, sensitivity, fine lines. And how she heard of the house, from five answers: Instagram, Facebook, a creator, a friend, other.

Purpose

To write letters that are useful to her, and to know which channels bring the list.

Legal basis

Consent, GDPR Article 6(1)(a). Both questions are optional.

Kept

As long as the address on the list. The word about skin stays on the servers of the site, and never reaches the tool that delivers the letters.

Four questions about price

Data

Four prices in dollars, given by a woman on the list who chooses to answer a letter of the house about the price of Le Duo, and the date of her answer.

Purpose

To set the price of Le Duo before the house opens. The answers are read together, never one by one for a profile or for advertising.

Legal basis

Consent, GDPR Article 6(1)(a). Answering is optional.

Kept

With her place on the list, in the tool that delivers the letters, as long as the address stays on the list.

A letter that does not leave

Data

The email of a woman, the time and where she joined from, when the tool that delivers the letters has not sent within 30 minutes the letter that holds her number, or the letter of confirmation it sent in the place of the usual service.

Purpose

To deliver the letter she asked for. For a woman who has confirmed her email, and for her only, the site first asks the tool that delivers the letters to lift a hold placed by its protection against robots, then sends her letter again. If it still does not leave, the founder of the house is warned, and can release an address held back by mistake. Her letter then leaves again, once.

Legal basis

Legitimate interest in delivering the letter she asked for, GDPR Article 6(1)(f).

Kept

The site keeps this follow-up for three days at most. The alert is deleted from the founder’s mailbox once the address has been dealt with.

Protecting the forms from robots

Data

A coded fingerprint of the connection address, which cannot be read back.

Purpose

To hold each connection to 20 attempts an hour, so that a robot cannot take the numbers.

Legal basis

Legitimate interest in protecting the first edition, GDPR Article 6(1)(f).

Kept

48 hours at most.

Messages to the house

Data

An email address and what the message says.

Purpose

To answer.

Legal basis

Legitimate interest in answering, GDPR Article 6(1)(f). For a report of a reaction, the legal duties of a cosmetics company, Article 6(1)(c).

Kept

A message reaches the mailbox of the house directly, and the site stores nothing. The mailbox keeps it for 3 years after the last exchange, and a report of a reaction for 6 years.

Measuring advertising campaigns

Data

The page opened, browser details, the connection address as Meta receives it, and the fact of joining the list, with no name, no email and no number.

Purpose

To measure campaigns, with the Meta Pixel.

Legal basis

Consent, GDPR Article 6(1)(a). The pixel loads only after a click on Accept, and never on pages about skin and health. The Cookie Policy names them.

Kept

The choice lasts six months. Meta’s own periods are set out in the Cookie Policy.

Orders, when the house opens

Payment will go through the hosted page of a payment provider, and card details will never pass through this site. This policy will set out orders, payments and deliveries before the house opens.

4Who receives the data

Hosting and forms

Netlify, Inc., which runs the site and the services behind its forms.

Email

Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, United States, which delivers the letters of the house, and will send the texts. It receives an email once it is confirmed, from the browser of the person at the click, with the connection address and details of that browser, or at the sign-up when it sends the letter of confirmation in the place of the usual service; then a first name, a number, where the sign-up came from, the proofs of consent, the mobile number of those who give one, the answer to how they heard of the house, and the answers of those who reply to the four questions about price. It records the openings described in Article 3. It receives no answer about skin and no message to the house.

Letter of confirmation

ZeptoMail, the transactional email service of Zoho Corporation, which delivers the letter that asks to confirm the email, from maison@vauzel.com. It receives the first name, the email and the link of that letter, and counts no opening and no click. Past its daily limit, or when it does not answer, Klaviyo, Inc. sends the same letter instead.

Mailboxes

Zoho Mail, from Zoho Corporation, which hosts the mailboxes of the house and so receives the messages sent to them. It also carries the alerts of the house to its founder, at an address of Google LLC (Gmail). An alert about a letter that did not leave names the address concerned.

Advertising

Meta Platforms Ireland Limited, and Meta Platforms, Inc. in the United States, after a click on Accept only. For the collection and transmission of this data, the house and Meta Platforms Ireland Limited are joint controllers, under the Controller Addendum of Meta’s Business Tools Terms. Meta alone decides what it does with the data afterwards.

Forms on Facebook and Instagram

Meta Platforms Ireland Limited, which collects the answers to its form and passes them to the house.

We do not sell personal data for money. With consent, the Meta Pixel can count as sharing under California law, and Your Privacy Choices turns it off at any time.

5Transfers outside the European Union

Some of these providers are based in the United States: Klaviyo holds the data of the list there, and Zoho delivers the letter of confirmation from there. Each transfer relies on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses of the European Commission. A copy of these safeguards is available from privacy@vauzel.com.

6How the data is protected

Every connection uses HTTPS. Names and emails are encrypted when stored, with a key kept outside the code of the site. Access is limited to the founder of the house. A backup is made every week, it stays encrypted, and only the last 4 are kept.

After a data breach, the house informs the CNIL within 72 hours where the law requires it, and the people concerned as the law of their country or state requires.

7Rights in the European Union

Anyone can ask to see their data, to correct or delete it, to limit its use, to receive a copy in a common format, and to object to its use. A consent can be withdrawn at any time, as easily as it was given, and each letter carries a one-click way out. French law also allows anyone to leave directions about their data after their death.

Requests go to privacy@vauzel.com. The answer comes within one month. For a complex request, this can extend by two more months, and the house says so within the first month.

A complaint can go to the French data protection authority: CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France, or online at cnil.fr.

8Rights in the United States

California

The house collects identifiers, a first name, an email and, for those who give one, a mobile number, directly from the person or through a form of Meta that she fills in. With consent, the Meta Pixel adds internet activity on the pages named in the Cookie Policy, and the tracking pixel in the letters adds the record of their opening. The purposes and periods are those of Article 3. The house collects no sensitive personal information and sells no personal data.

California residents can ask to know what is held, to correct it, to delete it, and to opt out of sharing for advertising. Using a right never changes the price or the service. An authorized agent can act for someone, with written proof.

The house confirms a request within 10 business days and answers within 45 days, with one extension of 45 days if needed, and says why. It may check an identity by writing to the address concerned. An opt-out takes effect at once on the browser that makes it.

Do Not Track and Global Privacy Control

Browsers can send a Do Not Track signal. No common standard exists for it, and the site gives it no particular response. The site does respond to Global Privacy Control, which counts as a refusal of advertising measurement. With or without either signal, no advertising script runs before a click on Accept.

Other states

The house answers residents of other states in the same way and within the same time. Where a state law gives the right, a refusal can be appealed by replying to the answer, and then taken to the attorney general of that state. Residents of Washington and Nevada will find the position on consumer health data in Article 2.

To ask for a correction of what is held, or to learn how this policy changes, write to privacy@vauzel.com.

9Adults only

This site is for adults, 18 and over. The house does not knowingly collect data from anyone younger.

10Changes to this policy

The date at the top shows the last update. The version in force is recorded with each consent. The house writes to the list before a change that matters.

11Contact

privacy@vauzel.com, or by post to Onda Invest, 50 avenue des Champs-Élysées, 75008 Paris, France.