Baccarat at your service

SECURITY & PRIVACY INFORMATION

PREAMBLE

Baccarat has created this Privacy and Personal Data Protection Policy in order to describe its policy and practices regarding the collection, use and disclosure of your personal data. These data were obtained via this website, www.baccarat.com (hereafter the “Website”), via a data collection form you completed in one of our boutiques, via our Customer Service, via social networks, via our digital apps or at events. These data are used for our customer and prospect management in accordance with the rules defined in the French data protection law referred to as the “Loi Informatique et Libertés” of 6 January 1978, as amended, and Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereafter the “GDPR”).

Article 1. - Privacy policy

Because we respect your privacy, we have implemented procedures to ensure that your personal data are processed safely, securely and responsibly. The objective of this privacy policy is to explain our data collection practices and your rights. As we continue to develop and improve the services we offer to take advantage of technological advances, this Privacy Policy may be amended at any time. The applicable Privacy Policy is the one that is in effect on the date you use this Website or the one in effect on the date we offer our services or send communications to you.

Article 2. Definition of the Data Controller

Baccarat SA is the data controller, as defined by the personal data protection regulations, in particular the French data protection law referred to as the “Loi Informatique et Libertés” of 6 January 1978, as amended, and the GDPR.

Baccarat SA is a French public limited company (société anonyme) registered with the Company Register of Nancy under number 760 800 060.

Its registered office is located at: 20, rue des Cristalleries – Baccarat (54120) – France.

Its commercial headquarters is located at: 11, Place des Etats-Unis in Paris (75116) - France.

Article 3. The data we collect

“Personal data” means any information that identifies you directly or indirectly.

The data collected may include the following:

• Last name,
• First name,
• Address,
• Telephone number,
• Email address,
• Birthday,
• Password,
• Delivery and invoicing address,
• Product preferences,
• Purchases (in a boutique or online) and repairs,
• Gift occasions,
• Online browsing (on Baccarat’s websites or social network pages),
• Queries via our Customer Service or Communication Department,
• Baccarat events you attend or any other point of contact.

i. In general, you may browse through our Website without providing any information that identifies you personally. However, we may ask you to provide personal information that identifies you in certain parts of the Website. In some cases, if you choose not to provide the information requested, you may not be able to access all the Website’s functionalities or pages. With regard to our Website, and if you accept, Baccarat will create a database that compiles the data you provide in order to allow you to register and create a “user account”, to process and track your Order, and to communicate specific offers Baccarat proposes.

When you visit our Website, our web server automatically collects certain indirectly identifiable data, such as connection logs and IP addresses. We may use the information collected automatically for a certain number of objectives, for example to improve our Website design, product assortment, customer service and special offers.

Baccarat may also retain copies of communications and correspondence between us to monitor customer relations.

ii. Baccarat also offers you the opportunity to save one or more credit/bank cards (card number and expiry date, excluding the cryptogram) in order to facilitate your future use of our Website. The data thereby collected will be saved by a tokenization system supplied by our provider. Tokenization is a method to replace information on a credit card by a token, which has no extrinsic value and retains key card information without compromising the credit card’s security. The data thereby collected will be retained for three years, subject to the exercise of your rights in accordance with Article 9 of this Privacy Policy.

The retention period for credit/bank card data depends on the intended purpose:

• For a single payment, the data will be retained until full payment or receipt of the good;
• If the data are retained to facilitate future purchases, they may be retained up until consent is withdrawn and/or the expiry of the validity of the credit/bank card’s data;
• If the data are retained to manage claims, they may be retained for a maximum period of 13 months following the debit date or 15 months for deferred payment cards.

iii. In its boutiques, Baccarat may also offer to collect your personal data directly from you via a data collection form.

iiii. Regardless of the collection method, mandatory information is identified by an asterisk when you fill in the form. When optional data is collected, the potential consequences of failing to provide these data are indicated.

iiiii. With regard to a job application, the following information may be collected:

• Name and contact information
• Curriculum vitae and motivation letter

iiiiii. By creating an account on Baccarat’s website, you confirm that you are of legal age.

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Article 4. - Method to collect and receive your personal data

Your data may be collected and/or received via the following points of contact:

• Baccarat websites
• Boutiques
• Forms (in a boutique or online)
• Customer Service
• Baccarat events you attend
• Communication Department
• Digital apps
• Baccarat pages you visit, or comment or like on social networks
• Advertising on the internet and through search engines on which you click

Article 5. - Objectives of the collection of your personal data

These objectives may include the following:

• Processing your orders and deliveries
• Managing your payments
• Managing your profile

If you are a Baccarat customer, we use automatic processing based on your purchasing history to assign a customer segment to your profile. Customers may be targeted based on their purchasing history and visits to our Website. The objective is to improve our services and the relevance of our offers.

• Personalization of our communications to our customers and contacts
• Management of your enquiries regarding Baccarat
• Management of events for which you register and/or in which you participate
• Management of our websites and digital apps
• Management of your job application
• The fight against fraud
• Improvements to our products and services

The legal basis for the processing of data is, depending on the type of data, either a concluded sales agreement, a legal obligation, your explicit consent or Baccarat’s legitimate interest in improving its offering, better understanding its customers, optimizing its communication or fighting fraud. When the legal basis for processing is your explicit consent, you may exercise your right to withdraw your consent at any time by contacting our data protection officer or by clicking on the de-registration link indicated in all of our communications.

Article 6. - Retention period for your personal data

If you are a “customer” (i.e. if you have already purchased a Baccarat product in a boutique or online): in the framework of customer management, the data are retained for a maximum period of 10 years from the last commercial interaction in order to provide you with optimal service. This period will be renewed at the time of each new interaction with Baccarat.

If you are a “prospect” (i.e. you have never purchased a Baccarat creation but are interested in the brand): your data will be retained for a maximum period of three years as of the last time you contacted Baccarat. This period will be renewed each time you interact with Baccarat.

If you are in contact with the Communication Department: your data will be retained for a maximum period of 10 years from the time of your first contact; this period will be renewed at the time of each new interaction with Baccarat (for example, a request for information on Baccarat).

If you are a job applicant (i.e. you apply for a job Baccarat is offering or you send an unsolicited application): your data will be retained for a maximum period of two years from the time you applied.

When the maximum data retention period expires, we delete these data from our systems or anonymize them.

Article 7. - Recipients of your data

• Your data are intended for Baccarat’s Sales and Marketing Departments.

Only authorized persons may have access to your personal data for the purposes referred to above.

• Baccarat may communicate them to one of its subsidiaries (in Europe, China, Hong Kong, Japan and the United States), one of the companies that belongs to the same group as Baccarat, Baccarat hotels, restaurants and bars, including outside of the European Union, and recipients who are expressly authorized by the laws in effect, in order to provide you with similar personal service throughout the world.
• Baccarat may communicate your personal data to its trustworthy third-party providers who are processors acting under our instructions solely for Baccarat, as well as its non-commercial partners, in the framework of contracts that comply with the GDPR.

The data on Baccarat’s customers and prospects are centralized in our partner’s data warehouse. The protection of this data is strictly controlled and complies with the GDPR.

Furthermore, with regard to these third parties, you have the same rights as those indicated in Article 9 of this Privacy Policy, and the person responsible for personal data protection and Baccarat will transfer your request to said third parties.

• Baccarat may also communicate the information you provide if this disclosure is necessary to comply with the laws in effect or further to a subpoena or any other legal procedure. For example, Baccarat may disclose the information required to identify or contact a person or to initiate a legal action against a person or entity that may cause a prejudice or disturb other Website users.
• If Baccarat or all or part of its assets are acquired by a third party, the list of the Website users and/or its customer and prospect files may be included in the assets sold.

To ensure a sufficient level of protection when your data are transferred, they are governed by standard contractual clauses established by the European Commission that you may consult by contacting our data protection officer at the following address: DPO, 11, place des Etats-Unis – 75116 Paris, France, or by email at: dpo@baccarat.fr.

Your data are not transmitted to third parties for commercial purposes.

You may transmit your personal data to our partners, advertisers and affiliates by clicking on a link to and from their websites. These websites apply their own privacy policy.

Baccarat may also use your social network connection data. In this framework, your profile information is shared with Baccarat. The type of personal data shared depends on the configuration of the social network’s platform. These social networks also apply their own privacy policy.

Article 8. - Security

The personal data provided on the Website are transmitted via a secure server that uses the “Secure Socket Layer” (SSL) encryption technology. When the URL’s “http” letters turn into “https”, the “s” indicates that you are in an SSL-secured zone. Your browser may then display a pop-up message indicating that you are about to enter a secure area. We undertake to process your personal data in accordance with high security standards. We therefore take physical, electronic and administrative measures to ensure the security and accuracy of personally identifiable information that we collect, in particular by limiting the number of individuals who have physical access to our servers and databases (notably, password protection to prevent unauthorized access). Our Website uses encryption technology, such as Secure Sockets Layer (SSL), to protect your personal data when they are transferred. The SSL system encrypts the information on your order, such as your name, address and bank card number. Our Customer Service also uses a secure private network.

Article 9. - Your rights

Under the GDPR, your rights over your personal data are as follows:

• Right to be informed: you have the right to obtain clear, transparent and intelligible information on the manner in which we use your personal data and on your rights. This policy presents this information.
• Right of access: you have the right to access your personal data retained by Baccarat.
• Right to rectification: you have the right to have Baccarat correct your personal data if they are inaccurate and/or to complete them if they are incomplete.
• Right to erasure/right to be forgotten: you have the right to have Baccarat erase your data. In the following situations, this right may be limited: a legal obligation or Baccarat’s justified interest in retaining these data.
• Right to object to direct marketing: you may at any time ask to no longer receive communications or offers from us or refuse their personalization, in particular by clicking on the corresponding link in each email Baccarat sends you.
• Right to restrict processing: you have the right to have Baccarat restrict the processing of your data and to withdraw your consent regarding the processing of your data when this processing is based on your consent.
• Right to data portability: you have the right to move, copy or transfer the data you provide from our database to another database. In this case, the processing must be based on a contract or your consent, and performed using automated processes.
• You also have the right to contact the data protection authority in your country to file a claim against Baccarat’s practices regarding data protection.

In Article 10, you will find contact information should you wish to exercise these rights or for any question or query regarding the processing of your personal data.

Article 10. - Contacts

You may at any time ask Baccarat to exercise your rights referred to above or ask questions on the manner in which your personal data are processed and used:

o If you are a customer or prospect: Contact Baccarat’s Customer Service: 01 40 22 14 14 / baccarat_eu@baccarat.fr Or fill in the form on the website: www.baccarat.com/ Or contact the personal data protection officer at Baccarat at the following address: DPO, 11, place des Etats-Unis – 75116 Paris, France, or by email at: dpo@baccarat.fr.

Despite all our efforts to keep our databases up to date, you may continue to receive offers once you have sent us a request not to use your data for marketing purposes due to a time lag between the time the transmission of the offer is prepared and the time your request for erasure has been made.

o To contact the Communication Department: contact-presse@baccarat.fr.

o To send a job application: rh_paris@baccarat.fr.

Article 11. - Cookies, web beacons and how we use them

A "cookie" is a small data file stored by your browser on your computer's hard drive or on your portable device. It allows us to recognize a user at the time he or she connects to our Website. In general, a “cookie” records information on your browsing through the Website (pages visited, date and time of the visit, etc.) that Baccarat may read on your future visits. We use these “cookies” to improve our Website design, product assortments, customer service, the offers proposed and the transmission of targeted advertising with our partner 1000mercis (see privacy policy for 1000mercis). You may, of course, disable the cookies and web beacons on your computer by selecting this option in your preferences or your browser's option menu. However, some parts of our Website may not operate properly if you disable the “cookies”.

Article 12. - Links to other websites

Hypertext links on our Website may led you to the websites of different partners. It is to be noted that Baccarat has not verified all of the websites that may be linked to its own, nor their content and the information therein, and therefore declines all liability regarding the content of these websites and any use you may make thereof. In particular, some of Baccarat’s partner websites may ask you to agree to new general terms and conditions of sale or a specific privacy policy, which are completely unrelated to this privacy policy and are no way binding on Baccarat. The use of data you may provide third parties on other websites or that these third parties may collect from other websites is not governed by this Privacy Policy.

Article 13. - Further information

Questions? If you have questions regarding Baccarat’s Privacy Policy and practices regarding personal data protection, you may contact the personal data protection officer at Baccarat at the following email address: dpo@baccarat.fr or by postal mail at: DPO, Baccarat, 11, place des Etats-Unis – 75116 Paris, France.

Article 14. - Errors and inaccuracies

Our objective is to provide full, accurate and up-to-date information on our Website. Unfortunately, our Website may contain typographical errors, inaccuracies or omissions, some of which may relate to prices and availability. Some information may not be complete or up to date. We reserve the right to correct all errors, inaccuracies or omissions and to change or update the information at any time without notice. We decline all liability for these errors.

Article 15. - Exclusion of liability

Baccarat does not offer any express or implicit guarantee regarding the Website, its content or the information thereon. The Website is provided “as is”, with all of its defects. Unless provided otherwise by law, Baccarat, its subsidiaries, as well as its directors, executives, employees, agents, entrepreneurs, successors and their assigns, may not be held liable for any damage resulting from or related to the use of this Website or any other website linked thereto. This liability limitation applies to any direct or indirect damage (such as a loss of profits, a business shutdown, a loss of data or information) that you or others may suffer.

Baccarat reserves the right to suspend Website operations at any time.

Article 16. - Applicable law

This Privacy Policy is governed by French laws.