Privacy Policy
Welcome to our website www.carolinaherrera.com (hereinafter the “Site”).
We invite you to read this Privacy Policy carefully.
1. Our commitments
Everyone has the right to the protection of their personal data, defined as any information relating to an identified or identifiable natural person (hereinafter “Personal Data”). We respect users’ right to be informed about the collection of their Personal Data and any other operation involving such data.
When we use data that may identify you directly or indirectly, we apply a principle of strict necessity. To this end, we have designed the Site in such a way as to minimize the use of your Personal Data and not to go beyond the purposes for which it was collected and/or processed.
We do not process your Personal Data when we can provide you with services using anonymous data or traffic data (for example, marketing studies intended to improve our services, browsing data used to offer you personalized content or offers based on your language, location, etc.), or by other means that allow you to be identified only when it is strictly necessary or required by competent public authorities or law enforcement (for example, in the case of traffic data or IP address data).
2. Data controller
For the purposes of Data Protection Legislation, ANTONIO PUIG, S.A.U. (hereinafter the “Company”), whose registered office is located at Plaza Europa 46-48, 08902 L’Hospitalet de Llobregat, Barcelona (Spain), registered with the Barcelona Trade Registry under number A08158289, acts as the controller of your Personal Data.
This Privacy Policy relates to personal information that makes it possible to identify a user when accessing our Site, using its services and/or completing forms on our Site, with or without purchasing a product in local online stores. Its purpose is to help you understand how the Company collects and uses your Personal Data, for what purposes, and to inform you of the rights you have in this respect.
In order to ensure the accuracy of the Personal Data you have provided to us, we invite you to report any changes to our Customer Service. This allows us to ensure that the information contained in our files is always up to date and accurate. We reserve the right to suspend or discontinue the provision of the requested services if you provide us with inaccurate Personal Data, without prejudice to any action permitted by law.
If you give us your consent, your data may be shared with other companies in the Puig Group in order to send you their own commercial communications. All relevant information regarding this processing will be provided to you before your consent is collected.
If you have any questions or concerns related to this Privacy Policy, you may contact our Customer Service at the following address: [email protected].
3. Applicable law
All Personal Data transmitted to the Company via the Site and/or in connection with the purchase of products is collected and/or processed in accordance with the laws applicable in the user’s State or country of residence, namely: (i) for residents of the European Economic Area, Regulation (EU) 2016/679 (“GDPR”), without prejudice to more favorable mandatory local provisions for consumers, in accordance with Regulation (EC) No 593/2008 (“ROME I”); or (ii) any other applicable conflict-of-laws rule (hereinafter, “Data Protection Legislation”).
4. Purpose(s) of processing Personal Data and legal basis
The purposes for which the Company collects and processes Personal Data, as well as the corresponding legal bases, are as follows:
• Online sales: Your Personal Data may be processed in order to provide e-commerce services, in particular to fulfill product orders, manage deliveries, returns and payments, and contact you in the event of an issue related to an order (the “Commercial Purposes”). This processing is based on the performance of the contract entered into with you.
• Offline sales: Any data collected at a PUIG physical point of sale may be processed by the relevant commercial entity to ensure the performance of the sale (including communications related to the purchase). This processing is based on the performance of the contract.
• Marketing purposes: With your prior consent, or where permitted by law, your Personal Data may be used to send you, through any communication channel (email, telephone, SMS, mail, instant messaging, push notifications, social media platforms, etc.), commercial information and/or news about our products, offers, samples, gifts, exclusive sales, promotional campaigns, events and similar initiatives organized by the Company and, where applicable, by other companies in the Puig Group.
Your data may also be used to personalize the advertising presented to you online and to create similar audiences (“lookalike audiences”) via third-party platforms (for example Facebook, Instagram, Google, Snapchat, Pinterest or TikTok), in accordance with their own privacy policy and on the basis of your consent.
• “Virtual Try-On” tools: Based on your consent, certain “Virtual Try-On” or “Foundation Shade Finder” features may process your image and facial characteristics locally on the device you are using. This data is not retained after you finish using these features.
• Security purposes: On the basis of our legitimate interest, your Personal Data may be processed to detect fraudulent activities, secure the Site, and prevent security breaches (for example: payment fraud, identity theft, account hacking, abuse of promotional offers). In the event of an irregularity, we reserve the right to retain the relevant data and to transmit it to the competent authorities.
5. What happens if you do not provide us with your Personal Data?
The provision of certain Personal Data (in particular your contact details, your email address, your postal address, your payment data, and your telephone number) is necessary to process your product orders on the Site, provide you with the requested services, or comply with legal or regulatory obligations.
If you refuse to provide the Personal Data required for these purposes, the Company may be unable to process your order, send you the requested newsletters, or comply with certain legal obligations. In some cases, the absence of Personal Data may constitute a legitimate reason not to provide the requested service.
The provision of other Personal Data, which is not strictly necessary for compliance with legal or contractual obligations, is optional and does not affect general use of the Site. Where applicable, we will clearly indicate mandatory data, in particular by means of an asterisk (*).
6. To whom will your Personal Data be disclosed?
Personal Data may be disclosed to third-party companies providing, on behalf of the Company, specific services in the fields of information technology, payment, logistics, customer service, and marketing, acting as processors. These processors have been selected for their expertise and provide sufficient guarantees of compliance with Data Protection Legislation.
Personal Data may also be disclosed to judicial or administrative authorities where required by law, in particular for fraud prevention purposes.
With your consent, your Personal Data may be shared with other companies in the Puig Group, as well as with their distributors and licensees, for their own marketing purposes.
7. Security measures and retention period
We have adopted appropriate technical and organizational security measures to protect Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, and against any other form of processing that does not comply with this Privacy Policy.
We will retain your Personal Data only for as long as necessary to fulfill the purposes described in this Privacy Policy, to comply with our legal obligations, and to comply with applicable limitation periods. Where processing is based on your consent, the data is retained until you withdraw that consent.
8. Transfer of your Personal Data to other countries
The Personal Data we collect from you is, in principle, stored within the European Union (“EU”). However, it is possible that certain data may be transferred, stored and/or processed outside the EU, in particular by certain cookie providers or technical service providers.
In such cases, we put in place appropriate safeguards (such as standard contractual clauses or any other recognized mechanism) to ensure a level of protection equivalent to that provided by Data Protection Legislation. For more information on these transfers, you may contact us at [email protected].
9. Your rights relating to Personal Data
Under the conditions provided for by Data Protection Legislation, you have the following rights:
• Right to withdraw your consent: You may withdraw, at any time, the consent you have given for the processing of your Personal Data. Withdrawal of consent does not affect the lawfulness of processing based on consent before such withdrawal.
• Right of access: You may obtain confirmation as to whether or not we process your Personal Data and, where applicable, access such data and receive a copy of it.
• Right to rectification: You may request the rectification of inaccurate or incomplete Personal Data concerning you.
• Right to erasure: You may request the erasure of your Personal Data in the cases provided for by law (for example when the data is no longer necessary for the purposes pursued or when you withdraw your consent).
• Right to restriction of processing: You may request the restriction of processing of your Personal Data in certain situations (disputes, verifications, etc.).
• Right to data portability: You may receive the Personal Data that you have provided to us, in a structured, commonly used and machine-readable format, and transmit it to another controller, where the processing is based on your consent or on a contract and carried out by automated means.
• Right to object: You may object, on grounds relating to your particular situation, to the processing of your Personal Data based on our legitimate interest, and you may also object at any time to the processing of your data for direct marketing purposes.
• Right to provide post-mortem instructions: You may define instructions relating to the fate of your Personal Data after your death.
• Right to lodge a complaint: You may lodge a complaint with the competent supervisory authority, in particular with the French Data Protection Authority (CNIL) if you reside in France, or with the competent authority of your place of residence, work, or the place of the alleged infringement.
You may exercise your rights by contacting us at: [email protected].
10. Acceptance/Refusal
Whenever your consent is required, the Company will inform you in advance and give you the option to accept or refuse the use of your Personal Data for the purposes concerned, in particular by ticking the appropriate boxes on online forms or in preference management tools.
We may also process your Personal Data without your consent where such processing is necessary for compliance with a legal obligation to which we are subject or for the performance of a contract entered into with you.
11. Contacts
You may contact the Company at any time at the email address [email protected] with any questions or concerns regarding this Privacy Policy and the Personal Data you have provided to us, or if you wish to receive further information about how we process your Personal Data.
You may also contact our Data Protection Officer at [email protected] or by post at the following address: Puig Brands, S.A. – Data Protection Officer, Plaza Europa 46/48, 08902 L’Hospitalet de Llobregat, Barcelona, Spain.
12. Changes and updates to this Privacy Policy
We may amend or update all or part of this Privacy Policy, in particular in the event of changes to legal or regulatory provisions governing data protection and the protection of your rights. Changes and updates will be effective upon publication in this section of the Site. We therefore invite you to consult this page regularly in order to review the most recent version of the Privacy Policy.
Last update: January 2026
© ANTONIO PUIG, S.A. 2025. All rights reserved.
