Below, we wish to present the Privacy Policy of the company IQ VERDE d.o.o., which represents the brand The Body Shop en Provence (hereinafter: The Body Shop) in Slovenia. This Privacy Policy, together with the Cookie Notice available at https://thebodyshop.si/obvestilo-o-piskotkih, applies to information we collect in The Body Shop stores, when you use our website www.thebodyshop.si, or in other instances where you come into contact with The Body Shop brand. This document describes the types of personal data we collect from our customers and explains how we use, store, disclose, share, and transfer this data, as well as describes the choices available to customers regarding the use of such data. It also describes the steps we have taken to protect the security of this data and explains how you can contact us regarding our data protection practices. Please read our Privacy Policy carefully, as it provides detailed information regarding your personal data. If you do not wish for your personal information to be used in the manner described in this Privacy Policy, we may not be able to fulfill some of your requests. We recommend that you check our Privacy Policy periodically, as this will keep you informed of any potential changes.

By providing consent, the person submitting their personal data and at least one contact number joins The Body Shop Love Your Body Club. Membership in the Love Your Body Club is free, and the customer is under no obligation to become a member of the Love Your Body Club.

Personal Data Controller

Within the scope of The Body Shop brand in Slovenia, the personal data controller is the company IQ VERDE d.o.o., Bleiweisova cesta 30, 4000 Kranj (tax identification number: SI30331676; registration number: 9598448000), which has been the sole official distributor and representative of The Body Shop brand in Slovenia since 2024.

Contact details of the Data Protection Officer

The Data Protection Officer, Patricija Merlak, is responsible for ensuring that your personal data protection rights are respected within the operations of IQ VERDE d.o.o. If you have any questions regarding your personal data and the exercise of your rights in accordance with the applicable legislation governing personal data protection, you may contact our Data Protection Officer by sending an email with your question to contact@thebodyshop.si (please note that sending personal data by email is not secure, therefore we recommend sending them by regular mail for their protection) and must include "IQ VERDE d.o.o. - VPRAŠANJE ZA DPO" in the subject line. Alternatively, you may write to us at IQ VERDE d.o.o., Bleiweisova cesta 30, 4000 Kranj with the subject line "IQ VERDE d.o.o. - VPRAŠANJE ZA DPO".

Methods of collection and types of personal data

We collect or receive personal data from you in various ways, for example by filling out a registration form to join the Love Your Body Club. In one of our stores or points of sale; you can also do this via our online form, through prize draws you choose to participate in, by communicating with us through various communication channels, and so on.

We may collect personal data about you to a limited extent when you use our website - both when you are simply browsing (based on cookies, if you have accepted them - you can read more about this here) and when you have made a purchase (filling in the information required in the online store).

We may also obtain personal data through social media and other marketing tools when you publicly post your email address, in accordance with their privacy policies, which allow direct marketing to your email address.

For the purpose of sending notifications and marketing activities for The Body Shop brand

For the purpose of sending notifications and marketing activities for The Body Shop brand (i.e., the so-called "Love Your Body Club" approach), we collect the following information about you: name, address and postal code with location, date of birth, mobile number, email address, and gender.

We will send you marketing communications based on your consent. If you are already our customer and have not explicitly opted out of receiving such notifications at the time of purchase or at any time thereafter, we may send you notifications based on the law (at the time of the update of this Privacy Policy, this is Article 158/II of the Electronic Communications Act (ZEKom-1)).

You may opt out of receiving these notifications at any time in accordance with the unsubscribe instructions in each notification you receive.

If you indicated upon subscription to the newsletter that you wish to receive notifications on your mobile number, we will send you notifications via regular SMS as well as via other applications such as Viber or WhatsApp. If you also provided your date of birth when joining the Love Your Body Club, we will use this information to offer benefits on your birthday.

For the purpose of selling products in our online store and for fulfilling our obligations and rights in this regard, we collect the following information about you: first and last name, address and postal code with location, date of birth, mobile number, email address and gender, order number, order date, payment method, billing address, delivery address, your opinions or experiences if you provide them (we may publish your opinions and experiences on social media and in our notifications), information about purchases and transactions (type and number of purchased and returned products, date of purchase).

In this case, we collect your personal data for the performance of a contract to which you, as the data subject, are a party, or for the implementation of measures at your request prior to the conclusion of a contract, or in rare cases based on our own legitimate interests (e.g., to protect our legal interests, enforce legal claims, reduce or prevent damage, etc.).

For the purpose of direct communication with you, we collect basic personal data about you, such as: name, surname, address, email address, phone number, as well as customer support data (questions, answers, and data you provide in this context), your photos, videos, and comments that you send to us or post yourself; data from social media that you provide to us by logging into the website via social media or by interacting with us via The Body Shop Slovenia Facebook or Instagram pages; your personal data that you provide to us for the purpose of consulting or making a purchase on your behalf by phone when you call +386 30 794 403 (such as your name, surname, phone number, delivery address, and other information necessary to complete a phone purchase), whereby the phone call is not recorded; your phone number (except for commercial toll-free numbers or numbers outside Slovenia), to which we return your missed call to +386 30 794 403; in this case, we do not store your number and use it exclusively for the return call; other information you provide to us as part of your proactive inquiry (e.g., your skin condition, age, etc., when looking for suitable products) or information you provide to us regarding the processing of your inquiry, complaint, and other requests. We only need this information for the duration of resolving your request and do not store it.

We will process your personal data specified in this section based on our legitimate interest (traceability of communication content and improvement of our offer). If you wish, you can stop communicating with us at any time and also request the deletion of your personal data. We will keep your data until the purpose for which it was collected has been achieved, as a rule, until the conclusion of the communication or the resolution of any open matters between us.

Processing based on legislation and contractual relationships

In the event that the provision of personal data is contractually mandatory, the obligation is necessary for the conclusion and performance of a contract with the controller (e.g., if you do not provide personal data, you cannot conclude a contract with the controller, nor can the controller provide services or products in accordance with the contract, as it does not have the data necessary to perform the contract).

Explanation of the controller's legitimate interests

As stated in point 4 of this Privacy Policy, the controller also collects personal data about you based on its own legitimate interests, unless such interests are overridden by your interests or fundamental rights and freedoms.

In case of using legitimate interest, the controller has performed an assessment in accordance with the General Data Protection Regulation (GDPR).

An example of the controller's legitimate interest is, for instance, identity verification for fraud prevention - even if you do not want your personal data to be processed, we will verify your identity to protect ourselves, as well as other users of our services, from potential fraud.

Website and online store

When you visit www.thebodyshop.si, we collect certain information and monitor your online activities to ensure functionality, quality, and to track general statistical information. We also record information related to your device and operating system, your IP address, web pages or advertisements you see, details of your visits to our web content and social media, advertising or similar identifiers, and your online activities. We collect this information using automated means such as cookies, third-party cookies, web servers, pixels, and web tags, and through demographic means related to areas of interest and content when you view our content, use our applications, social media, contact us in any way or application, open emails sent by us or on our behalf by third parties, and when you visit third-party websites or networks that display our ads. We may link information collected by automated means, such as your information and your browsing history, with other information we have collected about you.

We need your personal information for purchases in our online store and take all necessary measures to protect the confidentiality of your personal data. We do not disclose the information you provide to us to third parties, except to confirm the validity of your payment card purchase and to deliver the products. You can review, change, or request the deletion of your personal data via email: contact@thebodyshop.si. The user is also responsible for protecting their personal data by ensuring the security of their username and password and by ensuring that their computer is protected with appropriate software (anti-virus).

a) Web cookies

Web cookies are also treated as personal data. A cookie is a small file stored on your computer when you visit a website. Cookies contain various information that the website reads when you visit it again. In principle, cookies do not contain personal data, but they can be used to access your user preferences and other data related to your past activities on the website. If you disable cookies on your computer, you will not be able to make a purchase in the online store. The Body Shop Slovenia www.thebodyshop.si uses cookies on our website to provide you with the best possible service while browsing and ordering in The Body Shop online store and to ensure the security and smooth operation of our website. You can visit most subpages of our online store without disclosing personal information such as your name, address, and email address. However, some information is obtained automatically using cookies and web tags ("pixel tags"), standard tools in the web industry. The use of cookies and web tags allows us to recognize your IP address, the type of browser you are using, and your general online activities. More information about the use of cookies on our website can be found in the Cookie Notice accessible at https://thebodyshop.si/obvestilo-o-piskotkih.

b) Links to external websites and social media

On www.thebodyshop.si, there are some links to other websites. The visitor must be aware and accept that these websites have their own privacy policies for which IQ VERDE d.o.o. is not responsible, and which are independent of the IQ VERDE d.o.o. Privacy Policy. It is also possible to sign in to The Body Shop Slovenia via Facebook or Google. In this case, you share information about your personal profile with us, and we recommend that you read the privacy policies of these networks to ensure the security of your personal information.

Some of our websites and applications allow users to post their own content. Please note that all content posted on our social media is visible to the public, so be careful when posting certain personal information on these networks, such as financial information, your address, and any health issues. We are not responsible for the actions of others if you post your personal information on any of our social media platforms. We reserve the right to manage comments.

IQ VERDE d.o.o. may perform targeted advertising for The Body Shop brand through rented advertising networks such as search engines (e.g., Google) and social media (e.g., Facebook and Instagram) based on demographic, interest, and contextual parameters or visits to the website www.thebodyshop.si. These networks use information about your online activity, either separately or in combination with other information relevant for advertising purposes, to show you ads tailored to your interests.

Third-party providers of applications, tools, gadgets, and plugins on our websites and applications, as well as third-party websites and networks where our ads are displayed (such as advertising networks, digital advertising partners, and social media platforms), may also use automated and demographic methods related to areas of interest and context to collect information related to you, such as your interactions with these features, while continuously monitoring your online activity on third-party websites. This information is collected directly by third-party providers (in addition to the information we collect ourselves) and is subject to their policies. To the extent permitted by applicable law, we are not responsible for the practices of these third parties and suppliers.

c) Content created by you

Users can submit product reviews on www.thebodyshop.si. In doing so, your name or the initial of your name will be included when the review is publicly posted. Although this does not allow for customer identification, you must still be aware that posting an opinion is a proactive act and you assume full responsibility for it. You must take into account that the review will be publicly posted on our website and, if necessary for marketing purposes, posted on the The Body Shop Slovenia Facebook or Instagram page. By submitting a review, you agree to this Privacy Policy.

In addition to the aforementioned data collection opportunities arising from the operation of the website, we obtain your personal data only through your active inquiries or orders (e.g., sending an email to contact@thebodyshop.si, placing an online order, sending specific product requests, etc.).

Categories of recipients of your personal data

Personal data may only be accessible to authorized employees of IQ VERDE d.o.o. who need the personal data to fulfill the purposes defined in point 4, and to authorized subcontractors who provide IQ VERDE d.o.o. with technical or professional support in processing personal data.

These are:

manufacturers, maintainers, and providers of web interfaces and applications for processing personal data;

maintainers of the website and IT services;

developers and implementers of software solutions;

providers of interfaces for sending emails and SMS messages;

providers of online advertising (on Google, Facebook, Instagram, etc.);

printers;

delivery services;

public authorities or other legal entities where there is a legal obligation to do so.

All authorized subcontractors have a contract for the processing and protection of personal data in place, which ensures the same level of protection by IQ VERDE d.o.o.'s subcontractors.

When you use the Dialogue application, the personal data you entered into the Dialogue application is transferred or processed in the State of Israel in an automated manner. The Information Commissioner of the Republic of Slovenia has determined that Israel ensures an adequate level of protection of your personal data in the described cases, therefore the described data transfer is secure.

Your rights

By submitting a written request in the manner described below, an individual may request access to their personal data, its correction, change, blocking, limitation or restriction of processing, or deletion of personal data, object to the processing of personal data relating to them, or request data portability.

The request for the exercise of a right must contain the grounds on which it is based and clearly define which right the individual is exercising. The request must be signed. Anonymous requests will not be processed by the controller. If the controller has doubts about the identity of the individual who is supposed to have submitted the request for the exercise of a right, it may request that the individual provide additional evidence or confirmation of their identity (including inspection of the individual's identification document).

Fraudulent requests or requests filed with the intent to obviously mislead the individual may be reported by the controller to the competent supervisory and/or law enforcement authorities.

You can file a request for the supplement, correction, update, cessation of use, or complete deletion of your personal data in the following ways, clearly marking the content of your request:

• send a clear written request by email to contact@thebodyshop.si;

• send a clear written request by regular mail to IQ VERDE d.o.o., Bleiweisova cesta 30, 4000 Kranj, with the subject "The Body Shop";

• fill out an unsubscribe form at any The Body Shop store in Slovenia;

• to unsubscribe from the newsletter, click on the link at the bottom of the newsletter;

Processing your repair or cancellation request may take a few days, during which time you may continue to receive promotional and marketing emails, mailings, or SMS notifications. Your opt-out from receiving direct marketing messages does not prevent us from sending you other types of property-related communications, such as transaction confirmations via email.

Information regarding the right to withdraw consent when processing is based on consent: You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Protection of Personal Data

IQ VERDE d.o.o. has implemented a series of technical and organizational measures to ensure the highest possible level of technical and content security for personal data and to protect against accidental or unlawful destruction, accidental loss, alteration, or any unauthorized disclosure, access, or use. We strive to ensure that all processes related to personal data are transparent and clearly communicated to consumers.

Obligations and Security

We also contractually require authorized subcontractors who come into contact with personal data to act accordingly. We are also committed to the security of the information you provide to us online; however, as the flow of information over the internet may not be completely secure due to factors beyond our control, we are obliged to inform you that we cannot guarantee complete security of personal data sent to us via online forms, and the transmission of such data is at your own risk.

Personal Data Retention Period

The controller will keep your personal data only for as long as is necessary to fulfill the purpose (e.g., data processed by the controller based on a legitimate interest) for which the personal data was collected and further processed. Personal data processed by the controller based on law is kept in accordance with the time period prescribed by law, or, if no legal provision for retention is prescribed, until the purpose for which it was collected is fulfilled.

Personal data processed by the controller for the performance of a contractual relationship with a person is kept by the controller for the time necessary for the performance of the contract, and for a period of 5 years after its termination, except in cases where a dispute exists between you and the controller regarding the contract. In such a case, the controller will keep the data for another 5 years after the final judgment or arbitration award or settlement, or, if there was no legal proceeding, for another 5 years from the day of the amicable settlement of the dispute.

Those personal data processed by the controller based on the individual's personal consent are kept by the controller permanently until the consent is withdrawn by the individual or until a request for cessation of processing is filed. The controller will delete such data before withdrawal only if the purpose of the personal data processing has already been achieved or if required by law.

Notifications and Contact

This Privacy Policy may be updated periodically to align with changes in our personal data processing practices. We will notify you of these changes, including their effective date. If you continue to use the website after the effective date of these changes, this means you accept these changes.

If you want us to update the information we hold about you or your preferences, especially if you want us to remove you from our mailing lists, if you want to withdraw your consent, if you want to object to the processing of your data, or if you have any questions about the protection of your personal data, please contact us by writing to the following email address: contact@thebodyshop.si or by sending a letter by post to: IQ VERDE d.o.o., Bleiweisova cesta 30, 4000 Kranj with the subject "Question for The Body Shop".

We inform you that you may:

· request access to your personal data and its rectification, blocking, deletion, or restriction of processing, or object to the processing and portability of your personal data by sending a written notice to:

email address: contact@thebodyshop.si;

by mail to: IQ VERDE d.o.o., Bleiweisova cesta 30, 4000 Kranj with the note "The Body Shop".

· file a complaint with a supervisory authority if you believe that the processing of personal data violates the General Data Protection Regulation and other data protection regulations.

Our Data Protection Officer is Patricija Merlak; contact email: contact@thebodyshop.si.

IQ VERDE d.o.o. will process personal data collected in this campaign only for the above-stated purposes. Personal data will be collected only for the time necessary to achieve the purposes (email notification, if you sign up for it) for which they were collected or further used. After this time, they will be permanently deleted by the Organizer.

The Privacy Policy of IQ VERDE d.o.o. enters into force on July 1, 2024.