English translation – the French-language version governs in the event of any discrepancy.

Preamble

This Privacy Policy (the “Policy”) is intended to inform any natural person (the “User”) of the conditions under which their personal data (the “Data”) is collected, used, retained, protected and, where applicable, disclosed by Laboratoires Dermo-Cosmetik Inc., the data controller within the meaning of the GDPR, which operates the website www.gmcollin.fr (the “Site”), when you visit or make a purchase on the Site.

We attach particular importance to respecting the privacy and protecting the personal data of our customers, prospective customers, visitors and users.
Data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”), French Act No. 78-17 of 6 January 1978 (as amended) on data processing, data files and civil liberties, the recommendations and guidelines published by the Commission Nationale de l'Informatique et des Libertés (the “CNIL”), and the applicable provisions of the French Consumer Code and the French Commercial Code.
By using the Site, the User acknowledges having read this Policy.

What data do we collect?

When you visit the Site, we collect Data about the device you use, including information about your web browser, IP address, time zone, and certain cookies installed on your device. In addition, as you browse the Site, we collect information about the web pages or individual products you view, the websites or search terms that refer you to the Site, and how you interact with the Site. This automatically collected information is referred to below as “Device Information.”

We collect Device Information through the following technologies:
“Cookies” are data files placed on your computer or device, often containing a unique, anonymous identifier. For more information about cookies and how to disable them, visit http://www.allaboutcookies.org.
●       “Log files” track activity on the Site and collect data, including your IP address, browser type, internet service provider, referring/exit pages, and timestamps.
●    “Web beacons” and “tracking pixels” are electronic files used to record information about how you browse the Site.
Data may be collected:
●    Directly: through newsletter sign-up forms, product information request forms, etc.
●    Indirectly: through our service providers or subcontractors, who may share information about you with us, including your contact details or purchasing preferences, etc.

In addition, when you make or attempt to make a purchase through the Site, we collect certain Data, including your first and last name, billing address, shipping address, payment information (including credit card numbers), e-mail address and telephone number. This Data is referred to below as “Order Information.”
When we refer to personal Data in this Privacy Policy, we are referring to both Device Information and Order Information.

What are the purposes and retention periods for your data?

Processing	Purposes	Legal basis	Data involved	Retention period before deletion
Handling of information requests	Respond to your requests for information about our products, services, or any other request.	Legitimate interest in responding to requests from prospective and existing customers	Identity data Contact details Content of the request	3 years after the last interaction
Sending newsletters and promotional offers	Keep you informed of our new products, promotions and events via newsletters or targeted marketing communications	Consent	E-mail address Identity data Marketing preferences Interaction history	Until consent is withdrawn, and a maximum of 3 years from the last contact
Handling of rights requests	Receive, respond to and document your requests to exercise rights over your Data	Legal obligation (GDPR)	Identity data E-mail address Contact details	Period necessary to process the request; retained as evidence for 5 years
Creation and management of customer account	Enable management of your customer account, access to your purchase history, and management of your preferences	Performance of a contract	Identity data E-mail address Contact details Preferences Purchase history	Until the account is deleted, or 3 years after the last activity
Order processing and delivery	Process your orders, shipping and delivery, and follow up on returns or complaints	Performance of a contract	Identity data E-mail address Contact details Order details Delivery information	Duration of the contract, plus retention as evidence for 5 years
Customer support and assistance	Respond to your support or assistance requests regarding our products or services, including handling complaints	Legitimate interest in providing quality customer service	Identity data Contact details Content of exchanges (e-mails, calls) Complaint history	3 years after resolution of the complaint
Loyalty and rewards program	Manage your participation in our loyalty program, including tracking your points and granting rewards	Performance of a contract	Identity data Contact details Purchase history	3 years after the end of participation in the program
Analysis of purchasing behavior	Analyze your purchasing habits to personalize offers and improve our products and services	Legitimate interest in improving our product offering and our marketing	Identity data Contact details Purchase history Browsing history	2 years
Payment and billing	Manage the processing of your payments, billing, and fraud prevention	Performance of a contract, legal obligation	Identity data Contact details Banking information Transaction history	Duration of the contract, plus retention as evidence for 10 years

 

Who processes your data?

Your Data may be processed by the following recipients:
●    Within the Company: by duly authorized staff members;
●    Outside the Company, the following exhaustive categories of third parties may have access to only the Data strictly necessary:
○    IT service providers: subcontractors in charge of hosting, maintaining IT systems, and managing marketing databases;
○    Payment service providers: to secure financial transactions, manage payments, and process order refunds;
○    Marketing service providers: agencies or tools used to send targeted marketing communications, analyze data, etc.;
○    Administrative or judicial authorities, where they request disclosure of customer information, or in the event of litigation.

We ensure that, with respect to personal Data, these subcontractors and service providers contractually undertake to implement a level of protection equivalent to our own and compliant with applicable regulations.
Data may be disclosed to any authority legally entitled to receive it. Where applicable, the Company is not responsible for the conditions under which personnel of such authorities access and use the Data.

What are your rights? How do you exercise them?

Right of access and rectification

As a User, you have access to your Data and may accordingly correct, amend or delete your identification data and contact details. You may also change your commercial prospecting preferences by clicking the link included in our marketing e-mails or text messages.
If you delete your Data, you will no longer be able to benefit from services linked to your online account or loyalty program.

Right to data portability

Within the limits provided by law, you may exercise your right to data portability, allowing you to retrieve, in an interoperable format, the Data you provided to us when creating and using your account and/or subscribing to our loyalty program.
If you are unable to access your account, or to access other data, please contact us using the details set out below.

Right to object

You have the right to object, on legitimate grounds, to the processing of your Data, unless such processing is required to fulfil a legal obligation. Before processing your request, we are required by law to verify your identity. We may need to ask you for further information in order to respond to your request. We will endeavor to respond to your request as promptly as possible.

Several of our Data processing activities are subject to obtaining your consent. You may withdraw your consent at any time via your User account or by contacting us at the following e-mail address: info@gmcollin.com.

Right to erasure and right to restriction

You may also request the erasure of your Data in the following cases:
●    You consider that the processing of your Data is no longer necessary in light of the services subscribed to, your use of the Site, or the purposes referred to in this Policy, or that its retention is contrary to law;
●    You have withdrawn your consent to the processing of your Data;
●    You object to the processing of your Data on grounds relating to your particular situation;
●    You object to the use of your Data for commercial prospecting purposes;
●    Your data was collected online while you were a minor.
Alternatively, within the limits provided by law, you may request that the processing of your Data be restricted.

Please note that, notwithstanding the exercise of your right to erasure or restriction, we may retain certain Data concerning you where required or permitted by law, where we have a legitimate reason to do so (for example, to allow us to demonstrate performance of a contract), for the exercise or defense of legal claims, or where the exercise of this right would infringe the right to freedom of expression and information.
Complaint to the CNIL and how to exercise your rights
You have the right to lodge a complaint with the CNIL, the supervisory authority (www.cnil.fr).

You may also send your requests:
●    By mail:
Laboratoires Dermo-Cosmetik Inc.
68, Stinson, Saint-Laurent, Québec, H4N 2E7
Canada
●    By e-mail: info@gmcollin.com

The Company has a period of one (1) month to respond to you from receipt of your request. This period may be extended by two (2) months due to the complexity of your request and the number of requests received. Where applicable, you will be informed accordingly.

Sharing of your personal information

We share your Data with service providers and subcontractors to operate the Site and provide you with the related services, strictly to the extent necessary for their work.
For example, we use Shopify to power our online store. To learn more about Shopify's use of your Personal Information, visit: https://www.shopify.com/legal/privacy.
We also use Google Analytics to help us understand how our customers use the Site. To learn more about how Google uses your Personal Information, visit: https://www.google.com/intl/en/policies/privacy/. You can also opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.

To learn more about the use of your personal Data by our service providers and subcontractors, we invite you to review their privacy policy available on their respective websites.

Finally, we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

Transfer of your data outside the EU

Your Data will be transferred outside of Europe, including to Canada and the United States.
Where the recipient is located in a country whose legislation has not been the subject of an adequacy decision by the European Commission, we ensure that the transfer is governed by the European Commission's standard contractual clauses, which guarantee a sufficient level of protection for individuals' privacy and fundamental rights, equivalent safeguards, and/or, where applicable, appropriate technical and organizational measures.

Upon simple request, we can provide you with the list of countries in which we process your data, as well as a copy of the applicable safeguards.

What security measures do we implement to protect your data?

The data controller implements all appropriate technical and organizational measures to ensure a level of security appropriate to the risks. These measures may include:
●    encryption of communications (HTTPS/TLS);
●    encryption of data where relevant;
●    secure authentication procedures;
●    an access-rights management policy;
●    logging of access;
●    regular backups;
●    segmentation of data access;
●    firewalls and intrusion detection systems;
●    regular software updates;
●    security audits;
●    vulnerability testing;
●    internal incident-management procedures.

These measures are regularly reassessed to reflect the evolution of risks, available technologies, and regulatory requirements.

Behavioral advertising

As described above, we use your Data to provide you with targeted advertisements or marketing communications that may be of interest to you. For more information on how targeted advertising works, you can visit the Network Advertising Initiative's (NAI) educational page at: http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can choose not to receive targeted advertisements using the links below:
●    Facebook: https://www.facebook.com/settings/?tab=ads
●    Google: https://www.google.com/settings/ads/anonymous
●    Bing: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

In addition, you can disable some of these services by visiting the Digital Advertising Alliance's opt-out portal at: http://optout.aboutads.info/.
Please note that we do not change our Site's data collection and use practices when the Site detects a Do Not Track (DNT) signal from your browser.

How to contact us

For more information about our personal data protection practices, if you have any questions, or if you wish to file a complaint, please contact us by e-mail at: info@gmcollin.com, or by mail using the information below:
Laboratoires Dermo-Cosmetik Inc.
68, Stinson, Saint-Laurent, Québec, H4N 2E7
Canada

This Privacy Policy may be amended to reflect legislative, regulatory, case-law, or technical developments. In the event of a significant change, users will be informed by any appropriate means.

Last updated: June 25, 2026.