Last updated: 24 October 2026
This policy explains how LENOX PHARM collects, uses and protects the personal data of visitors and customers of the website https://institut-cosmetic.com (the "Site"), in accordance with Regulation (EU) 2016/679 ("GDPR") and the amended French Data Protection Act No. 78-17 of 6 January 1978 ("Informatique et Libertés").
1. Data controller
The data controller is:
- LENOX PHARM, a French simplified joint-stock company (SAS)
- SIREN 892 772 997 – Head office SIRET 892 772 997 00011
- Registered office: 35 boulevard de Strasbourg, 75010 Paris, France
- E-mail: [email protected]
Address for requests about your data: [email protected]
2. What data, for what purpose, on what legal basis?
We only collect the data needed for the purposes below. Mandatory fields are marked in our forms; without them we cannot process your request or order.
| Purpose | Data | Legal basis |
|---|---|---|
| Processing orders and delivery (with or without an account) | Last name, first name, e-mail address, delivery and billing addresses, phone number if you provide it, products ordered, amounts, order history, parcel tracking | Performance of the sales contract |
| Invoicing and accounting | Order and billing data | Legal obligation |
| Creating and managing your customer account | Title (optional), first name, last name, e-mail address, password, your newsletter choices | Performance of the contract (account terms) |
| Payment | Transaction data. Payments by credit card, PayPal, Apple Pay or Google Pay are processed directly by our payment provider (PrestaShop Checkout, built with PayPal). LENOX PHARM neither receives nor stores your card numbers. | Performance of the contract |
| Customer service and contact form | E-mail address, subject, message, optional attachment, exchanges with our customer service | Legitimate interest in answering your requests; pre-contractual measures when the request concerns an order |
| Professional enquiries (resellers, wholesalers, points of sale) | Name, company, business contact details, content of the request | Pre-contractual measures and legitimate interest in developing our business |
| Customer relationship management (customer file) | Identity, e-mail address, country, order summary, newsletter subscription | Legitimate interest in knowing and following up our customers |
| Newsletter and marketing e-mails | E-mail address, first and last name where applicable, date and proof of consent, where applicable e-mail opens and clicks | Consent (unticked checkbox, sign-up forms) |
| "Wheel" game and Klaviyo sign-up forms | E-mail address entered, participation | Consent |
| Audience measurement | Pages viewed, referrer, device, IP address (anonymised in Google Analytics), cookie identifiers | Consent (Google Analytics, loaded only after you agree); legitimate interest for Cloudflare Web Analytics cookieless technical statistics |
| Site security, abuse and fraud prevention | IP address, connection data, browser, result of the anti-bot check (Cloudflare Turnstile) | Legitimate interest in protecting the Site, our customers and our forms |
| Handling disputes and requests to exercise your rights | Data needed for the request | Legal obligation; legitimate interest |
"Find my skincare" questionnaire: your answers are neither stored nor transmitted by LENOX PHARM. They stay in your browser, in the page address, so you can return to your selection.
We do not make any decision based solely on automated processing that produces legal effects concerning you.
3. Recipients and processors
Your data is accessed by authorised LENOX PHARM staff (customer service, shops, logistics, accounting). It is also shared, to the extent necessary, with our service providers:
| Provider | Role |
|---|---|
| OVH SAS, 2 rue Kellermann, 59100 Roubaix, France | Hosting of the Site and its database |
| Cloudflare | Domain name management (DNS), content delivery and protection of the Site, Turnstile anti-bot check, technical statistics (Cloudflare Web Analytics) |
| PrestaShop Checkout and PayPal | Payment by credit card, PayPal, Apple Pay and Google Pay, payment fraud prevention. |
| DHL Express | Delivery of orders and parcel tracking |
| Business e-mail (Google Workspace), audience measurement (Google Analytics 4), display fonts (Google Fonts) | |
| Klaviyo | Sign-up forms and "wheel" game, browsing tracking for marketing purposes (only after you agree), and where applicable sending e-mails |
| Zoho | Customer relationship management (CRM) software |
| Elfsight | Display of our Instagram feed on the Site |
| Brevo (formerly Sendinblue) | E-mail module installed on the shop: where applicable, contact management and sending e-mails |
Paying with PayPal, Apple Pay or Google Pay may also involve these companies under their own privacy policies.
Your data may also be disclosed to administrative or judicial authorities where required by law.
We do not sell your personal data and we do not pass it on to any third party for its own commercial purposes.
4. Transfers outside the European Union
Some of our providers (in particular Google, Cloudflare, PayPal, Klaviyo, Brevo, Elfsight and, depending on the data centre used, Zoho) are established outside the European Union, notably in the United States, or may process data there. In that case, transfers are covered by the safeguards provided for by the GDPR: an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework, for certified companies) or the European Commission's standard contractual clauses.
You can obtain information about these safeguards by writing to us at the address given in section 1.
5. Retention periods
We keep your data for the following periods, based on the guidelines of the French data protection authority (CNIL):
| Data | Retention period |
|---|---|
| Order data | For the duration of the contractual relationship, then archived for 5 years from the order (limitation period for civil and commercial matters) |
| Invoices and accounting records | 10 years from the end of the financial year (article L123-22 of the French Commercial Code) |
| Customer account | Until you delete it or after 3 years of inactivity; order data then follows its own retention period |
| Data used for marketing (customers and prospects) | 3 years from the end of the business relationship or from your last contact (for example a click in an e-mail), unless you unsubscribe earlier |
| Customer service requests | Time needed to handle the request, then 3 years from the last exchange |
| Requests to exercise your rights | 1 year from our answer; 6 years if an ID document was requested for litigation purposes |
| Transaction (payment) data | Kept by the payment provider under its own obligations; LENOX PHARM does not keep any card number |
| Connection and security logs | 6 months to 1 year |
| Cookies and trackers requiring consent | 400 days maximum from when they are set; your cookie choice (acceptance or refusal) is kept for 6 months |
6. Cookies and trackers
A cookie (or tracker) is information stored on your device when you visit the Site. This section also covers the browser's local storage.
Cookies strictly necessary for the Site to work (cart, language, login, security) are set without consent. Others (audience measurement, marketing, third-party content) may only be set with your consent, which you can give, refuse or withdraw at any time, as easily as you gave it, through the cookie banner shown on your first visit ("Accept all", "Deny all" and "Customize" buttons). You can reopen it at any time with the Cookie settings link at the bottom of every page. Until you make a choice, no audience measurement, marketing or third-party content cookie is set, and Google Analytics is not loaded.
Trackers used on the Site (as recorded on 24 October 2026):
| Name | Issuer | Purpose | Category | Duration |
|---|---|---|---|---|
| PHPSESSID | institut-cosmetic.com | Technical session of the Site | Necessary | 400 days maximum (technical server setting) |
| PrestaShop-xxxxxxxx (2 cookies) | institut-cosmetic.com | Cart, language, account login | Necessary | 20 days |
| ps_checkoutPayPalSdkInstance_storage (local storage) | PrestaShop Checkout | Operation of the payment module | Necessary | Until deleted by the browser |
| Cloudflare Turnstile check (challenges.cloudflare.com) | Cloudflare | Protecting forms against bots | Necessary (security) | No cookie observed |
| _ga | Google Analytics 4 | Distinguishing visitors for statistics | Audience measurement | 400 days maximum |
| _ga_H1LR86KPW0 | Google Analytics 4 | Keeping the measurement session state | Audience measurement | 400 days maximum |
| __kla_id | Klaviyo | Recognising the visitor for forms and personalised e-mails | Marketing | 400 days maximum |
| klaviyoOnsite, $referrer, $last_referrer, kl-post-identification-sync, __kla_viewed (local storage); klaviyoPagesVisitCountV2, klaviyoFormSubmit (session storage) | Klaviyo | Displaying forms, origin of the visit, products viewed | Marketing | Until deleted by the browser, or end of session |
| elfsight_viewed_recently | Elfsight | Displaying the Instagram feed | Third-party content | Short duration |
| _cfuvid | Elfsight (elfsight.com domain) | Traffic limiting for the Elfsight service | Third-party content | Session |
| tarteaucitron | institut-cosmetic.com | Remembering your cookie choices (including a refusal) | Necessary | 6 months |
Services loaded without any cookie observed: Cloudflare Web Analytics (technical statistics) and Google Fonts (display fonts). Your IP address is sent to these providers when the page loads.
You can also block or delete cookies in your browser settings. Blocking necessary cookies may prevent the cart and your account from working.
7. Your rights
You have the following rights over your data:
- right of access, rectification and erasure;
- right to restriction of processing;
- right to object, in particular to direct marketing, at any time and without giving reasons;
- right to data portability for the data you provided to us;
- right to withdraw your consent at any time, without affecting processing already carried out;
- right to give instructions on what happens to your data after your death.
To unsubscribe from marketing e-mails, use the unsubscribe link in each e-mail, or change your preferences in your customer account.
To exercise your rights, write to [email protected], or by post to LENOX PHARM, 35 boulevard de Strasbourg, 75010 Paris, France. If we have reasonable doubts about your identity, we may ask you for proof. We answer within one month, which may be extended by two months for complex requests; we will inform you if so.
8. Complaint to the CNIL
If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr. You may also contact the supervisory authority of the EU country where you live.
9. Telephone marketing (Bloctel)
If you live in France and do not wish to receive telephone marketing, you can register free of charge on the French opt-out list Bloctel: www.bloctel.gouv.fr (article L223-1 of the French Consumer Code).
10. Minors
The Site is intended for adults. Products for babies and children must be ordered by an adult. We do not knowingly collect data about minors under 15 without the consent of a holder of parental authority. If you believe a minor has sent us data, contact us so that we can delete it.
11. Security
We take appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS) across the Site, Site protection and anti-bot checks by Cloudflare, access to data restricted to authorised staff, payment handled by a specialised provider with no card numbers kept by LENOX PHARM.
12. Changes
We may change this policy, in particular to reflect changes to the Site, our providers or the regulations. The date of the last update appears at the top of the page. In the event of a significant change, we will inform you by appropriate means.
See also: Legal notice – Terms and conditions – Contact us