Privacy policy

Version dated October 15, 2026.

Protecting your personal data matters to Browlab. This policy explains what information is processed when you visit our website, contact us or make a purchase, why it is processed, whom it may be shared with and what rights you have.

1. Who is responsible for processing your data?

The website www.browlab.fr is operated by GROUPE SCHAZ, a French simplified joint-stock company (SAS) registered with the Auch Trade and Companies Register under number 949 869 846, with its registered office at 89 route du Serrot, 32810 Leboulin, France.

For questions about your personal data or to exercise your rights, email hello@browlab.fr or use our contact form.

2. What data may be collected?

• Identity and contact details: first and last name, billing and delivery addresses, email address and any other details you voluntarily provide for an order or a conversation with our team.
• Orders and transactions: products purchased, prices, discounts, shipping arrangements, payment references and status, order history, return requests and refund requests.
• Customer accounts and loyalty: information needed to manage your customer account and, where you use a loyalty programme, your benefits under that programme.
• Messages and requests: the content of forms, emails and conversations with customer service or online support, and information needed to handle your enquiry.
• Preferences and questionnaires: answers you choose to give in product-selection quizzes, beauty preferences and information helpful for personalised recommendations.
• Browsing and technical information: IP address, browser and device characteristics, pages visited, interactions with the website and identifiers linked to cookies or similar technologies, subject to your choices and applicable law.
• Marketing communications: newsletter registration, communication preferences and information used to manage subscriptions, unsubscribes and interactions with campaigns, where permitted by law.

Information needed to process an order is marked as required during checkout. Without it, we may not be able to enter into or fulfil the order. Optional information, such as certain questionnaire answers or registration for marketing communications, may be omitted.

3. Why do we process your data and on what legal basis?

Purpose	Legal basis
Process orders, payments, deliveries, returns, refunds and after-sales service.	Performance of a contract and, where necessary, legal obligations.
Create and manage a customer account or a loyalty programme in which you participate.	Performance of the requested service and, depending on the processing, legitimate interest in operating that service.
Respond to your messages and requests for support.	Performance of a contract, pre-contractual steps or legitimate interest in providing customer service.
Maintain website security, prevent misuse and fraud, and handle incidents.	Legitimate interest in securing the store, subject to your rights, and applicable legal obligations.
Retain accounting records and meet tax or regulatory obligations.	Legal obligation.
Send newsletters and promotional offers by email.	Your consent where required; in situations allowed by law, special rules may apply to marketing to existing customers, with the right to object.
Offer recommendations based on information you voluntarily provide in a quiz or questionnaire.	Performance of the requested service; consent where necessary for a particular type of processing.
Measure website traffic, personalise selected features or deliver targeted advertising using non-essential tracking technologies.	Consent where required.

4. Who may receive your data?

Only authorised Browlab personnel and service providers who need certain information to perform their tasks may access it, to the extent necessary. Depending on the services actually used, recipients may include:

• our e-commerce platform Shopify, which provides technical services for the store;
• payment, fraud prevention and invoicing service providers;
• carriers and logistics intermediaries, including Sendcloud, Mondial Relay, Colissimo or Chronopost, depending on the delivery option selected;
• customer service, messaging, newsletter, customer review, loyalty and product-recommendation tools when these features are enabled. At the time this policy was updated, Browlab sends its email newsletters and marketing campaigns through Shopify Messaging ;
• technical, maintenance, security, analytics and advertising service providers, subject to applicable settings and your cookie preferences.

We may also disclose certain information to competent authorities where required by law or when defending our rights. Recipients receive only the categories of data necessary for their work.

5. Can your data be processed outside the European Union?

Some technical services and international providers may involve access to or processing of data from a country outside the European Economic Area. Where such a transfer is subject to the GDPR, it must rely on an approved mechanism, such as an adequacy decision or standard contractual clauses, supplemented by additional safeguards where necessary. You can ask us about applicable safeguards at hello@browlab.fr.

6. How long do we retain data?

Information is kept only for as long as appropriate for its purpose, then erased, anonymised or archived with restricted access where required by law:

• Purchases and customer relationships: throughout order fulfilment and the commercial relationship, and then for the periods needed to handle warranties, disputes and statutory obligations.
• Accounting documents and supporting records: generally 10 years when that period is required by applicable accounting regulations.
• Marketing and customer retention: depending on the circumstances, during the commercial relationship and generally up to 3 years after it ends for data used for marketing; for prospects, generally up to 3 years after collection or their last active contact, unless consent is renewed or another rule applies.
• Customer service requests: for the time needed to handle them, followed by any period justified by legal duties or potential disputes.
• Cookies and tracking technologies: according to their purpose and individual retention period, as explained in our cookie policy.

7. How do we protect data?

We use providers and security measures appropriate to our activities to reduce the risk of unauthorised access, loss or disclosure. Access is limited to people and service providers who need it. However, no transmission over the internet can be guaranteed to be completely risk-free.

8. What are your rights?

Subject to the conditions set out in the GDPR and applicable law, you may request access to your data, correction, erasure, restriction of processing and, where applicable, data portability. You may also object to certain processing based on legitimate interests and object to direct marketing at any time. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of processing already carried out.

To exercise your rights, email hello@browlab.fr. We will request proof of identity only when necessary to verify that the request is legitimate. You may also lodge a complaint with the French data protection authority, the CNIL.

9. Newsletters and marketing communications

At the time this policy was issued, Browlab uses Shopify Messaging to send its newsletters and email marketing campaigns. You can unsubscribe from marketing communications at any time using the link in each email or by contacting us. Unsubscribing does not stop messages needed to process an order, manage an account or handle a customer service request.

10. Cookies and similar technologies

Some tracking technologies are needed for store operation, security or to remember the shopping basket. Others may measure traffic, personalise the experience or deliver advertisements. Trackers subject to consent must be used in accordance with visitors' choices and applicable law. More information is available in our cookie policy.

11. Changes to this policy

This policy may be updated to reflect changes to our services, providers or applicable law. The version date at the top identifies the most recently published update. Where required by law, we will communicate significant changes by appropriate means.