Last modified on May 22, 2018.
This Data Privacy Notice describes the collection and further processing of personal data by com-panies of the Swarovski Group and its affiliates (together SWAROVSKI) as far as they are not cov-ered by other data protection policies or are evident from the circumstances or are provided for by applicable law. The term personal data shall include all information relating to an identified or identi-fiable person.
This Data Privacy Notice describes in Section I processing of personal data by SWAROVSKI in general. Section II contains specific provisions for specific applications (e.g. online-shop, newsletter and banner advertisment).
If you provide SWAROVSKI with personal data of other persons, for example data about the re-ceiver of a gift, please provide their personal data to SWAROVSKI only if you are allowed to do so pursuant to applicable data protection laws and only if the other person would agree to you provid-ing its personal data to SWAROVSKI for the purposes the data are collected and the processing of its personal data according to our data privacy notice.
1. CONTROLLER, DATA PROTECTION OFFICER
The respective subsidiary or affiliate is the controller in case SWAROVSKI communicates through other means of communication (email, letter, telephone, in person, etc.) and the communication does not fall within an activity for which SWAROVSKI has appointed a specific controller within this Data Protection Notice or otherwise.
Should a SWAROVSKI company or affiliate disclose personal data to another SWAROVSKI com-pany or affiliate for certain purposes of the receiving company or affiliate, such company or affiliate is the controller. A list of the main companies and affiliates of SWAROVSKI can be found in ANNEX 1, which will be updated from time to time.
SWAROVSKI has not appointed a data protection officer according to article 37 GDPR save for SWAROVSKI companies and affiliates in Germany and Principality of Liechtenstein. The data pro-tection officer can be contacted at:
For Germany: Swarovski (Deutschland) GmbH, Data Protection Officer, Hüttenstrasse 27, DE-87600 Kaufbeuren, email: email@example.com.
For the Principality of Liechtenstein: Swarovski Aktiengesellschaft, Data Protection Officer, Dröschistrasse 15, FL-9495 Triesen, email: firstname.lastname@example.org.
Furthermore, any inquiry, claim or concern regarding data protection at SWAROVSKI (all companies and affiliates) can be addressed to the following contact points:
The representative of companies and affiliates of SWAROVSKI domiciled outside of the EU or EEA respectively according to article 27 GDPR is D. Swarovski KG, Legal Department, Swarovskistrasse 30, AT-6112 Wattens, email: email@example.com.
2. PROCESSING OF PERSONAL DATA
SWAROVSKI collects and processes personal data of
The personal data of CUSTOMERS is generally collected directly by SWAROVSKI during the course of using the WEBSITE, as well as in stores or at events of SWAROVSKI or during direct communi-cation via email, telephone or in any other way. However, personal data can also be collected indi-rectly, like for example when SWAROVSKI requests third parties to act as processors, such as for example SWAROVSKI’s PARTNERS (as defined further below, including wholesalers, dealers, re-tailers, suppliers and further business partners such as customer services vendors) and also namely when the CUSTOMER making the purchase does not correspond with the person benefitting from the purchase or if the purchase is shipped to a different person (e.g. as a gift), based on the rec-ommendation of a third party (e.g. recommendation by family or friends of the CUSTOMER) or through further acquisition of supplementary information from third party data sources (e.g. social media).
In particular, the following categories of personal data is processed by SWAROVSKI:
together CUSTOMER DATA.
In addition, SWAROVSKI collects:
Within the framework of their business relationship, CUSTOMERS will be required to provide CUS-TOMER DATA necessary for the establishment and execution of the contractual relationship and the fulfilment of the associated contractual obligations or required by law. Without this data, SWA-ROVSKI will generally not be able to conclude or execute the contract with the respective CUS-TOMER. This also applies analogously to the PARTNER DATA as far as business relations with the wholesalers, dealers, retailers, suppliers and business partners of SWAROVSKI are concerned; these in principle cannot be concluded and processed without information on their employees and other contacts. As any access to the WEBSITE is logged, connection data (such as the IP address) will always be logged; this is done automatically during the use and cannot be deactivated for indi-vidual VISITORS or CUSTOMERS.
3. PURPOSE OF PROCESSING AND LEGAL GROUNDS
3.1. PURPOSE of the processing
In accordance with applicable law, SWAROVSKI may process CUSTOMER DATA namely for, but not limited to, the following PURPOSES:
(together the PURPOSE OF CUSTOMER DATA PROCESSING).
3.2. LEGAL GROUNDS of processing
SWAROVSKI uses the CUSTOMER DATA for the PURPOSE OF CUSTOMER DATA PROCESSING based on the following LEGAL GROUNDS:
In accordance with applicable data protection laws, SWAROVSKI may namely process VISITOR DATA for the purpose of maintaining and developing the WEBSITE (including the provision of func-tions which require identifiers or other personal data), for statistical analysis regarding the use of the WEBSITE as well as for combating abusive conduct, for purposes of legal investigations or pro-ceedings and for the response to inquiries of public authorities. The VISITOR DATA shall be pro-cessed in accordance with the principles set out for CUSTOMER DATA above.
In accordance with applicable data protection laws, SWAROVSKI may process PARTNER DATA namely for the purpose of entering into and performance of contracts and other business relation-ships with PARTNERS, promotions, advertisement and marketing, communication, invitation to events and participation in promotions for PARTNERS, organization of joint activities, compliance with legal and regulatory requirements and internal rules of SWAROVSKI, enforcement and exploi-tation of legal rights and claims, defense against legal claims, litigation, complaints, combating abu-sive conduct, engaging in legal investigations and proceedings and responding to inquiries of pub-lic authorities, for the sale or acquisition of business units, companies or parts of companies and other corporate transaction and related transfers of PARTNER DATA. The PARTNER DATA shall be processed in accordance with the principles set out for CUSTOMER DATA above.
All the purposes of processing shall be applicable for the whole SWAROVSKI group, i.e. not only for the company which initially collected the personal data. Personal data of CUSTOMERS, VISI-TORS and PARTNERS is collected for the purpose of all SWAROVSKI companies subject to appli-cable data protection laws.
4. TRANSFER AND DISCLOSURE OF DATA
In accordance with applicable data protection laws, SWAROVSKI may transfer CUSTOMER DATA, VISITOR DATA and PARTNER DATA to the following categories of THIRD PARTIES who process PERSONAL DATA in accordance with the PURPOSE OF DATA PROCESSING on behalf of SWA-ROVSKI or for their own purposes:
(together THIRD PARTIES).
SWAROVSKI may disclose CUSTOMER DATA, VISITOR DATA and PARTNER DATA within SWA-ROVSKI as well as to THIRD PARTIES and in every country worldwide, including namely all coun-tries in which SWAROVSKI is represented by Group companies, affiliates or other offices and repre-sentatives (see ANNEX 2, as updated from time to time) as well as to countries in which service providers of SWAROVSKI process their data (see ANNEX 2, as updated from time to time). If data is disclosed to countries that do not guarantee adequate protection, SWAROVSKI will ensure ade-quate protection of data disclosed by CUSTOMERS, VISITORS or PARTNERS by way of putting adequate contractual guarantees in place, namely on the basis of EU standard clauses, or it bases the transfer on the exceptions of consent, conclusion or performance of contract, the determination, exercise or enforcement of legal claims, overriding public interests or it discloses the data in order to protect the integrity of these individuals. The CUSTOMER, VISITOR or PARTNER can obtain a copy of the contractual guarantees from or will be advised where to obtain such copies by the contact points named above (see para. 1 above). SWAROVSKI reserves the right to redact such copies for reasons of data protection or secrecy reasons.
5. RETENTION OF DATA
In general, SWAROVSKI keeps personal data for no longer than it is necessary for the purposes for which the personal data are processed. However, SWAROVSKI may process personal data for longer periods subject to the following rules and obligations: SWAROVSKI retains personal data as long as SWAROVSKI (i) is obligated to do so (by way of contract, law or other provisions) or (ii) has an interest in them (namely an interest for reasons of proof in case of claims, documentation of compliance with certain legal or other requirements, an interest in non-personalized analysis). Devi-ating rules are reserved namely with respect to anonymization or pseudonymization of personal data subject to applicable law.
As a rule for contract related CUSTOMER DATA and PARTNER DATA (including business records and communication) SWAROVSKI retains personal data as long as the contractual relation is ongo-ing and for ten years after the termination of the contractual relationship unless (i) a shorter or long-er statutory storage obligation is applicable on a case-by-case basis, (ii) the retention is required for reasons of proof or another valid reason based on applicable law, or (iii) the deletion of the data is required earlier (namely because the data is no longer required or SWAROVSKI is required to de-lete the respective data).
As a rule for operational data containing CUSTOMER DATA, VISITOR DATA or PARTNER DATA (e.g. protocols, logs), SWAROVSKI retains personal data for a period of 3 - 12 months.
6. COOKIES, GOOGLE ANALYTICS AND SOCIAL PLUG-INS
In accordance with applicable law, SWAROVSKI may install coding in newsletters and other market-ing email which allow it to determine if the recipient has opened an email or downloaded pictures contained in the email. However, the recipient may block this application in his/her email application. In any case he consents to the application of this technology by way of receiving newsletters on other marketing related emails.
Should SWAROVSKI place advertisement of third parties on the WEBSITE (e.g. banners) or intend to place an own ad on the website of a third party, cookies from companies specializing in the use of such advertisement may be employed. SWAROVSKI will not disclose personal data to such com-panies, i.e. they shall only place a permanent cookie with users of the WEBSITE in order to recog-nize users and do so in the sole interest of SWAROVSKI. This allows SWAROVSKI to place aimed advertisements for these individuals on external third party websites (e.g. in connection with prod-ucts for which these individuals showed an interest in the online-shop). SWAROVSKI will not dis-close personal data to the operators of external websites either.
SWAROVSKI may use Google Analytics or similar services on its WEBSITE. These applications are third party services which allow SWAROVSKI to measure and analyze the use of its WEBSITE. The provider of these services may be located in any country worldwide (in the case of Google Analytics which is operated by Google Inc. it is the U.S., www.google.com). The service provider uses perma-nent cookies for these applications. SWAROVSKI will not disclose any personal data to the service provider (who will also not save any IP addresses). The service provider may, however, monitor the use of the WEBSITE by the user and combine this data with data from other websites monitored by the same service provider which the user has visited and the servicer may use these findings for its own benefits (e.g. control of advertisement). The service provider knows the identity of the user who has registered with the service provider. In this case the processing of personal data will be the service provider's responsibility and data shall be processed according to the data protection poli-cies of the service provider. The service provider will provide data on the use of the WEBSITE to SWAROVSKI.
In addition, SWAROVSKI may use plug-ins from social media networks such as Facebook, Twitter, Youtube, Google+, Pinterest or Instagram on its WEBSITE. In the default setting of the WEBSITE plug-ins are deactivated; the user can thus choose when to activate them. Should the user do so, the social media providers are able to establish a direct connection to the user during his visit on the WEBSITE, which allows the provider to be aware of the user's visit and may analyze the respec-tive information. The subsequent processing of the personal data will be conducted in the respon-sibility of the provider and according to his data protection policies. The provider of the respective social media offering will not disclose any information to SWAROVSKI.
7. RIGHTS OF THE CUSTOMER, VISITORS AND PARTNERS
Any affected individual, including any CUSTOMER, VISITOR and PARTNER, may request infor-mation from SWAROVSKI as to whether data concerning them is being processed. In addition, they have the right to request the correction, destruction or restriction of personal data regarding them as well as to object to the processing of personal data. Should the processing of personal data be based on consent, the affected individual may withdraw consent at any time. In countries of the EU and EEA the affected individual may, in certain cases, have the right to obtain data generated dur-ing the use of online services in a structured, common and machine-readable format which allows for further use and transfer. Request in this respect shall be submitted to the contact point (see para. 1 above). SWAROVSKI reserves the right to restrict the rights of the affected individual in accordance with applicable law and e.g. not to disclose comprehensive information or not to delete data.
Should SWAROVSKI make an automated decision with respect to a certain individual which may have a legal effect for the affected individual or seriously affect her in a similar way, the affected individual shall have, in accordance with applicable law, the right to communicate with a controller of SWAROVSKI and to request a reconsideration of the decision or to request the prior evaluation by the controller. In this case the affected individual might no longer be able to use certain automated services. The individual will be informed thereof subsequently or separately in advance.
Any affected individual may also raise a complaint with the competent data protection authority, which in the case of a SWAROVSKI controller in Switzerland is the Federal Data Protection and Information Commissioner in Switzerland (http://www.edoeb.admin.ch), the SWAROVSKI controller in the Principality in Liechtenstein is the Data Protection Office (Amtstelle Datenschutzstelle, in the Principality in Liechtenstein (https://www.llv.li/), the SWAROVSKI controller in Austria is the Austrian Data Protection Authority in Austria (https://www.dsb.gv.at/). In all other cases a list can be found here.
8. CHANGES TO THE DATA PRIVACY NOTICE
SWAROVSKI is entitled to amend this Data Privacy Notice at any time and without prior notice or announcement. The latest version according to the WEBSITE shall be applicable.
Should the Data Privacy Notice form part of an agreement with CUSTOMERS and PARTNERS, SWAROVSKI may inform them of an update or amendments by email or in another appropriate manner. The amendments shall be deemed to have been accepted unless an objection is raised within 30 days of notification. In case of objection SWAROVSKI shall be free to terminate the agreement exceptionally and with immediate effect.
The following provisions shall supplement the provisions of the general part for certain activities of SWAROVSKI. In the event there is any inconsistency, the following provisions shall prevail the pro-visions of the general part.
The creditworthiness of CUSTOMERS may be evaluated automatically in online-shops in order to offer the purchase on account based on this decision as far as this payment option shall be offered at all. In this case the credit rating is evaluated on the basis of information from an external credit rating agency, which will provide SWAROVSKI with a credit score of the respective CUSTOMER. The agency will calculate the score based on a secret formula based on data on the payment histo-ry of the CUSTOMER, its debt and insolvency history and possible limitations of its legal capacity. Should the score be below a certain threshold no payment by invoice will be offered. In this event the CUSTOMER may contact the contact person shown on the imprint of the respective website of the online-shop if he is not ready to accept the decision.
Online shops of SWAROVSKI may automatically decide whether to enter into purchase agree-ments. However, SWAROVSKI does not deem this an automated individual decision (according to article 22 GDPR). In the event the CUSTOMER does not wish such an automated entering into an agreement, it has the option to purchase products and services from SWAROVSKI at physical stores run by SWAROVSKI and its retailers.
2. PARTNERS, INCLUDING WHOLESALERS, RETAILERS, DEALERS, CUSTOMER SERVICE VENDORS ETC.
As previously indicated, CUSTOMER DATA, PARTNER DATA and VISITOR DATA is generally col-lected directly by SWAROVSKI but also indirectly, like for example when SWAROVSKI requests THIRD PARTIES to act as processors, such as SWAROVSKI’s PARTNERS. In these cases, SWA-ROVSKI’s PARTNERS process personal data on behalf and under instruction of SWAROVSKI and are bound by specific processor agreements covering the terms and conditions of their duties in a manner to ensure the protection of the rights of our CUSTOMERS, PARTNERS and VISITORS and the processing and security of their personal data in accordance with applicable data protection laws.
3. NEWSLETTER AND BANNER ADVERTISEMENT
SWAROVSKI may send newsletters or other commercial communications in connection with its products and services to CUSTOMERS and PARTNERS. In accordance with applicable law, SWA-ROVSKI reserves the right to do so without prior consent of existing customers and business part-ners. However, the respective CUSTOMERS and BUSINESS PARTNERS may object to a further mailing of newsletters or other commercial communications at any time through their account on the respective WEBSITE or through the link indicated in every mailing. However, the termination of one newsletter may not entail the termination of other newsletters, as well.
It is possible that personalized advertisement is placed during the visit on the WEBSITE. Every banner advertisement displayed to the CUSTOMER contains products offered on the WEBSITE which have previously been looked at by the customer. The advertisement is generated by SWA-ROVSKI by the means of cookies (see Section I para. 6 above).
4. SWEEPSTAKES and other PROMOTIONAL ACTIVITIES
The following provisions shall be applicable for the processing of data by SWAROVSKI in connec-tion with customer SWEEPSTAKES and other PROMOTIONAL ACTIVTIES.
The data in connection with the SWEEPSTAKE and other PROMOTIONAL ACTIVTIES is basically processed by (i) the controller of the respective local Swarovski company which sponsors, promotes and organizes the sweepstake and as the case may be by (ii) Swarovski Aktiengesellschaft, Dröschistrasse 15, 9495 Triesen, Liechtenstein, as a joint controller. Other companies and affiliates of SWAROVSKI may however use the collected personal data for their purposes according to Sec-tion I para. 3 above.
As far as the SWEEPSTAKE and other PROMOTIONAL ACTIVITES are concerned, SWAROVSKI namely processes the personal data of participants according to Section I para. 2 above. for the purposes listed under that respective provision, and in particular also for the following purposes in accordance with applicable laws:
Further information regarding the SWEEPSTAKE and OTHER PROMOTIONAL ACTIVTIES can be found in the specific terms and conditions applicable to each SWEEPSTAKE and PROMOTIONAL ACTIVTIY, as published and organized from time to time.