Who does this notice apply to?
Quimelia C.A., including the brands and companies within its group — among them CompacXpress — is committed to the responsible processing of personal data relating to customers, visitors, suppliers, job applicants, franchisees, business contacts and users of our websites, stores, digital channels and social networks.
This notice explains how we obtain, use, retain and share personal information when a person visits our sites, interacts with our brands, makes inquiries, purchases products, takes part in commercial activities or communicates with us through any channel.
Where applicable law recognizes the role of Data Controller, that responsibility lies with Quimelia C.A. or the Quimelia C.A. Group entity that maintains the relationship with the data subject and determines the purposes and means of processing.
For questions related to privacy and data protection, you may write to privacy@quimelia.com.
Key definitions
Personal Data: any information relating to an identified or identifiable person.
Sensitive Personal Data: information that may include racial or ethnic origin, political opinions, religious beliefs, trade-union membership, criminal history, genetic or biometric data, information related to health, sex life or sexual orientation, and any other category specially protected by applicable law.
Depending on the country or jurisdiction, financial data, precise location, information about minors, official identification numbers, access credentials and combinations of data that could allow access to accounts or cause significant harm to a person may also receive special protection.
Processing: any operation performed on personal data, including collection, recording, organization, consultation, analysis, storage, modification, transfer, disclosure, blocking, deletion or destruction.
Data Controller: the natural or legal person that determines the purposes and means of processing. Within our group, overall responsibility corresponds to Quimelia C.A.
Third Party: any person, company, authority, supplier or entity other than the data subject and the Data Controller, except those acting on behalf of the latter and under its instructions.
Data Subject: the identified or identifiable person to whom the personal data relates.
Quimelia C.A. Group: includes the companies and brands related to Quimelia C.A., including, among others, Quimelia, Compac, CompacXpress, Okly and OklyCosmetics.
Personal Data we obtain and process
We may obtain personal information when you visit our websites or brand pages, create an account, purchase products, make an inquiry, visit a store, participate in campaigns, promotions, sweepstakes or contests, interact with franchisees or customer service, communicate through messaging, social networks or email, or post reviews about products or services.
Basic personal data
We may process data such as name, postal address, email address, telephone number, sex, date of birth, country or place of residence, login information, internal identifiers, IP address, device identifiers and other profile data voluntarily provided.
This data may be obtained directly from you or, where permitted by law, from third parties such as social media platforms, service providers or people purchasing products or services intended for you.
We may use it to provide and improve products and services, manage inquiries and purchases, communicate with you, send requested information, administer promotions, provide customer support, personalize content, verify identity, improve user experience, manage business relationships, evaluate customers or suppliers and comply with legal obligations.
Sensitive personal data
We limit the collection and use of special categories of data to justified situations. Certain products, services or inquiries could indirectly reveal information related to health, skin characteristics, adverse events or other protected categories.
Where appropriate, this data will be processed with the consent of the data subject or under another legal basis permitted by applicable law. Its use will be limited to purposes compatible with the reason for which it was obtained.
Commercial and transaction data
We may obtain information about products or services viewed or purchased, preferences, billing and delivery addresses, order details, amounts, payment methods, incidents, returns, claims and records necessary for fraud prevention and risk management.
This data may be used to process orders, manage deliveries, validate transactions, provide support, administer returns and refunds, maintain purchase records, protect customers and the business, comply with contractual and legal obligations, and improve our services.
Communication data and inferences
We may retain communications received by email, messages, calls, social networks or other channels. We may also generate inferences from interactions, preferences, purchase history and behavior in our digital channels where permitted by law.
This information may be used to improve service, personalize communications, analyze trends, develop new products and services, manage promotions, conduct internal studies and address matters related to the business relationship.
Internet and other network activity
You may visit our sites without voluntarily providing identifiable personal information. However, certain technical data may be transmitted automatically from your browser or device.
This data may include IP address, device identifiers, domain name, browser and version, operating system, platform, time zone, browsing and search history within our sites, pages visited, products viewed, referrals from other sites, response times, visit duration and interaction information such as scrolling, clicks and cursor movements.
We may use this information to ensure technical delivery of content, strengthen security, optimize our sites, improve user experience, measure performance, conduct analytics and, where regulations permit and an appropriate legal basis exists, provide relevant communications or advertising.
Where required by applicable regulations, you may manage your preferences regarding cookies and similar technologies.
Third-party websites and services
Our sites may contain links to or integrations with third-party services. Those third parties may apply their own privacy policies and practices. We recommend reviewing their notices before providing personal information outside our digital environments.
How long we retain your Personal Data
We retain personal data for the period reasonably necessary to fulfill the purposes described in this notice and while a commercial, contractual or service relationship with the data subject exists.
When data is no longer necessary, we seek to delete or anonymize it, except where we must retain it for legal, regulatory, tax, accounting or security obligations, to address claims, or for the establishment, exercise or defense of legal rights.
Specific retention periods may vary according to the applicable law in each jurisdiction.
How we share your Personal Data
Where necessary and legally permitted, we may share data with companies in the Quimelia C.A. Group; franchisees or commercial representatives related to the requested service; providers of goods and services; advisers, auditors and lawyers; competent authorities; and other parties where there is a legal obligation or authorization to share information.
Information may also be transferred in connection with corporate reorganizations, mergers, acquisitions, liquidations, asset sales or similar transactions, subject to confidentiality obligations and safeguards required by applicable law.
International transfers
When it is necessary to transfer data to other countries or jurisdictions, we will use available legal mechanisms and appropriate measures to maintain an adequate level of protection. This may include contractual agreements, data-protection clauses and other safeguards recognized by the relevant legislation.
We do not sell our users’ personal data or sensitive personal data.
How we protect your Personal Data
We apply technical, physical and organizational measures designed to maintain a level of security appropriate to the type of information and the risks associated with its processing. These measures seek to protect the confidentiality, integrity and availability of data and are reviewed periodically.
Privacy of minors
Our general sites and services are primarily intended for adults. Where a service may be intended for a minor audience, we will seek to apply the parental or guardian consent mechanisms required by local law.
If we become aware that a minor provided personal data without the necessary authorization, we will take reasonable steps to delete that information and cancel related records to the extent permitted and required by law.
Your rights regarding your Personal Data
Depending on applicable law, you may have the right to:
- Request information about and access to the personal data we process.
- Request correction or updating of inaccurate or incomplete information.
- Request deletion of your data where legal requirements are met.
- Request restriction of processing in cases provided by law.
- Withdraw previously given consent without affecting the lawfulness of processing carried out before withdrawal.
- Where applicable, request portability of information in a structured, commonly used and machine-readable format.
- Request not to be subject to certain decisions based solely on automated processing where the law grants this right.
- Object to processing in cases provided by law, including certain uses based on legitimate interests or direct marketing.
To exercise these rights, you may contact privacy@quimelia.com. For security purposes, we may request reasonable information to verify the identity or authority of the requester before handling a request.
You may also file a complaint with the competent data-protection authority where applicable law permits.
Requests under jurisdiction-specific rules
Where special rules exist regarding disclosure of information for direct marketing, eligible residents may submit the requests provided for by those laws. We may verify identity and, when an authorized representative acts on someone’s behalf, request sufficient evidence of authorization.
Geolocation data
If you authorized the use of precise geolocation information through your browser, mobile device or a digital service, you may later withdraw that authorization by changing the relevant browser or device settings.
Notifications and alerts
If you have enabled push notifications or alerts in an application or device, you may disable them at any time through the notification settings of the device or service used.
Updates to this notice
We may update this policy periodically to reflect legal, operational or technological changes. When a change is material, we will seek to communicate it through our sites or by other appropriate means before it takes effect where required.