1. The provision of Personal Data to us is on a voluntary basis. If you fail to provide sufficient information, we may not be able to process the membership application or to provide you with some or all of our services.

2. Examples of Personal Data about you that we may collect include:

1. Your personal details such as your name, gender, month of birth and place/country of residence;

2. Your membership details such as your membership details, password and records of your transactions, accrual and redemption activities;

3. Your contact information such as your mobile numbers and email addresses;

4. Your preferences such as your interests, opinions, hobbies and destinations you are interested in

5. Your responses to market surveys and contests conducted by us or on our behalf;

6. Records of any correspondence with you such as those by email, telephone, mobile short messaging service (SMS), multimedia messaging services (MMS), cross-platform mobile messaging application (e.g. smartphone messaging application) or postal correspondence and any interactions you have with our staff or representatives;

7. Details of your visits to our website, your use of our official social media pages and information that you look at; and

8. Information collected through the use of closed circuit television systems and other security systems when you visit the premises of LBL at Langham Place Mall.

1. We may receive some Personal Data from you directly, for example where you contact us or apply for LBL’s affiliated club membership or apply for registration as customer of eStore for using the eStore or make order for buying goods or services from eStore.

2. We may collect or obtain some Personal Data in the course of our relationship with you, for example:

1. When you make your Personal Data public, such as by making your Personal Data publically available on your social media profile, or such as Personal Data you make public by making any public post on social media.

2. When you visit our website.

3. We may also collect or obtain some Personal Data about you from third parties such as: (a) our service providers and agents; (b) the third parties that we partner with in connection with LBL’s affiliated club or its eStore; (c) our third party marketing and research partners; and (d) providers of third party websites and social media platforms.

4. When you visit our website, we may use cookies and other technologies to automatically collect the following information:

1. Technical information, including your IP address, your login information, browser type and version, device identifier, location and time zone setting, browser plug-in types and versions, operating system and platform, page response times, and download errors.

2. Information about your visit, including the websites you visit before and after our website and products you viewed or searched for.

3. Length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouseovers) and methods used to browse away from the page.

4. Similar information for additional content that can be accessed from website pages, such as opening or printing documents or which videos are played and for how long.

5. If you do not want to receive a cookie when using our website, you may set your browser to refuse cookies or to notify you when you receive a cookie, which you may then refuse upon such notice. However, by disabling cookies, you may not be able to take full advantage of our website.

6. If you provide us with information about other individuals, you must tell those individuals and let them know where they can find a copy of this Privacy Policy.

1. We process your Personal Data for the following purposes:

1. To provide our services to you;

2. To administer your LBL’s affiliated club membership and other partner loyalty programmes or your application for registration as customer of eStore for using LBL’s eStore or your order for buying products or services from LBL’s eStore;

3. To tailor and personalise (including through profiling activities) services which may be of interest to you;

4. To provide customer support;

5. For marketing and promotion purposes;

6. To interact with you on social media;

7. For improvement of customer services;

8. To perform appropriate anti-fraud checks such as credit checks and reference check

9. For managing and providing for the safety and security of our guests, customers, visitors, employees or users; and

10. For legal and administrative purposes.

The processing of your Personal Data is necessary for our legitimate interests when we process your Personal Data to tailor and personalise services which may be of interest to you, to provide customer support, for marketing and promotion purposes, to interact with you on social media, and for improvement of customer services.

Where necessary to comply with applicable laws, we will seek your consent to process your Personal Data.

In some cases it will be necessary for us to process your Personal Data in order to comply with our legal and regulatory obligations, for example where we process your Personal Data for legal and administrative purposes.

Where we process your Personal Data to provide our services to you, or to administer your LBL’s affiliated club membership, and other partner loyalty programmes or your application for registration as customer of eStore for using LBL’s eStore or your order for buying products or services from LBL’s eStore, we do so because it is necessary in order for us to perform our contractual obligations towards you.

1. Service providers

1. We may share your Personal Data with our service providers in connection with the services and products provided to or requested by you. These include any agent, contractor or third party service provider who provides administrative, marketing and research, data processing, telecommunications, computer or other services to us in connection with the operation of LBL and its affiliated club or its eStore, LPBL and EPM.

2. We may also disclose your Personal Data to third parties who provide marketing services or conduct marketing or social interaction activities on our behalf such as campaigns, contests, sweepstakes, market research, customer surveys and data analytics.

3. Subject to having obtained appropriate consent from you where necessary, we may also disclose your Personal Data to our third party marketing partners in order that they may market their products and services to you.

4. We may, where necessary, transmit or obtain information about you to or from third parties including, but not limited to, credit reference or fraud-prevention agencies, which may keep a record of that information.

2. Third parties required by law

1. We may disclose your Personal Data to governments and regulatory authorities and bodies and to other individuals, bodies and organisations such as dispute resolution, prosecution and law enforcement agencies, regulatory bodies and/or legal advisers for compliance with applicable laws, rules, regulations, codes, and/or guidelines and/or any person or entity to whom we are under a binding obligation to make disclosure under the requirements of any law, rule, regulation, code and/or guideline and/or order of any competent court of law, law enforcement agencies and/or regulatory bodies, but such disclosure will only be made under proper authority.

3. Within our group of holding companies, subsidiaries and affiliates

1. We may share your Personal Data among our other offices, affiliates and locations to administer our services and products, to send you information about products and services that may be of interest to you and conduct the other activities described in the Privacy Policy.

4. Business transfer

1. We may transfer your Personal Data to third parties in connection with a reorganisation, restructuring, merger, acquisition or transfer of assets.

1. If you are under the age of 18, consent from your parent or guardian is required before you provide us with any personal data. You must be at least 16 years old to register for LBL’s affiliated club membership or to make your application for registration as customer of eStore for using LBL’s eStore or your order for buying products or services from LBL’s eStore. We will not knowingly collect Personal Data about children under the age of 16. If you are under the age of 16 you should not provide Personal Data to us. If we become aware that a person under 16 has provided Personal Data to us, we will securely destroy such data.

2. Individuals between the age of 16 and 18 may register for LBL’s affiliated club membership or to make your application for registration as customer of eStore for using LBL’s eStore or your order for buying products or services from LBL’s eStore and provide us with their Personal Data, provided they obtain the prior consent of an individual who holds parental responsibility for them.

1. No data transmission over the Internet, a website, or via email or other message service can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your Personal Data in accordance with the requirements of data protection legislation.

2. All Personal Data we collect about you is stored on our or our subcontractors’ secure servers. We comply with our security policies and standards when accessing or using this information and restrict access to your Personal Data to those persons who need to use it for the purpose(s) for which it was collected. Any of our employees with access to Personal Data are required to sign a declaration of secrecy to declare compliance with our Code of Conduct and not to disclose any Personal Data of a LBL’s affiliated club member or a customer of the eStore of LBL without our authorisation.

3. You are responsible for keeping any information that we send to you confidential and for complying with any other security procedures that we notify you of.

1. Our retention periods for Personal Data are based on business needs and legal requirements. We will only retain your Personal Data for as long as is necessary for the processing purpose(s) for which it was collected, any other permitted linked purpose and to the extent permitted by applicable law.

2. Where Personal Data is no longer needed, we either irreversibly anonymise the data (and the anonymised information will be retained) or securely destroy the data. If you choose to terminate your LBL’s affiliated club membership or registration as customer of eStore with the methods as set out in section 9 of this Privacy Policy, your Personal Data will also be either irreversibly anonymised (and the anonymised information will be retained) or securely destroyed.

1. General rights – You have the right (subject to various exceptions and in accordance with data protection legislation in your country) to access certain Personal Data held about you and correct any inaccuracies by contacting the LBL Data Protection Officer. We may charge a reasonable fee for the processing of any data access request in accordance with data protection legislation in your country. You also have the right to raise a complaint about our processing with the data protection regulator in your jurisdiction by contacting the LBL Data Protection Officer as set out in section 9.6 below.

2. Updating Personal Data – You have the right to have incomplete or inaccurate personal data that we process about you rectified. You can update your Personal Data at any time by contacting the LBL Data Protection Officer.

3. Right to opt out of direct marketing – You have the right to ask us not to process your Personal Data for direct marketing purposes.  You can exercise your right to prevent such processing by indicating that you do not consent to direct marketing at the point at which we collect your Personal Data.  You can also exercise the right at any time after we have collected and used your Personal Data for direct marketing purposes by (a) following the opt-out instructions contained in the relevant communications; or (b) contacting the LBL Data Protection Officer. Please note that if you choose to unsubscribe or opt out of marketing communication, we will still send you communications about the services we provide to you where these communications are not direct marketing.

4. Right to cancel LBL’s affiliated club membership or registration as customer of eStore – You can exercise your right to cancel your LBL’s affiliated club membership or registration as customer of eStore by contacting the LBL Data Protection Officer at any time.  If you choose to terminate your LBL’s affiliated club membership or registration as customer of eStore, your Personal Data will be either irreversibly anonymised and the anonymised information such as spending and redemption record of such ex-member will be retained for analytic and market research purpose or securely destroyed.

5. Right to refuse LBL and its affiliated club or its eStore, LPBL or EPM to transfer or disclose personal data to LBL’s, its affiliated club’s or its eStore’s, LPBL or EPM’s contractors – You can exercise your right to refuse LBL, its affiliated club or its eStore, LPBL or EPM to transfer or disclose your personal data to LBL’s, its affiliated club’s or its eStore’s, LPBL or EPM’s contractors by contacting the LBL Data Protection Officer at any time. By exercising your right to do so, your LBL’s affiliated club membership or registration as customer of eStore will be cancelled simultaneously. Your Personal Data will be either irreversibly anonymised (and the anonymised information will be retained) or securely destroyed.

6. Contacting the LBL Data Protection Officer
You have the right to contact the LBL Data Protection Officer at any time with any of the following methods to exercise any of your rights as set out in this Privacy Policy:

1. In person (please proceed to L2 LANGHAM BEAUTY Customer Service between 11:00 a.m. (Hong Kong time) and 22:00 p.m. (Hong Kong time) on Monday-Thursday and between 11:00am (Hong Kong time) and 22:30 p.m. (Hong Kong time) on Friday-Sunday); or

2. By email (please send your member name, registered email and mobile number to [email protected]

7. We ask for your personal details in order to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure. For individuals in the EU, the following sections 10 to 12 apply to you in addition to sections 1 to 9 above.

1. Under European data protection law (EU DP Law), certain categories of Personal Data are considered particularly sensitive and therefore as needing additional protection. We will collect and handle some sensitive Personal Data about you, for example, when we handle requests for special medical assistance or your specific requirements.

2. We will ask you for your consent when processing this type of Personal Data, unless we are otherwise permitted to process such Personal Data under EU DP Law or the laws of the EU member state in which you are based.

1. Your Personal Data will be accessed by staff or suppliers, transferred, and/or stored outside the EEA. This may also include other countries which may have a lower level of data protection than under EU DP law.

2. When we transfer Personal Data from inside the EEA to outside the EEA, we will use appropriate safeguards to protect the Personal Data. For example, we will transfer your Personal Data subject to European Commission approved contractual terms that impose different data protection obligations directly on the recipient, or as otherwise permitted under EU DP Law.

3. Please contact us as set out in section 9.6 of the Privacy Policy if you would like to see a copy of the specific safeguards we apply to the export of your Personal Data.

1. For the purposes of applicable data protection law, the data controller is LBL, LPBL and EPM.

2. In addition to section 9 of this Privacy Policy, if you are in the EU and the processing of your Personal Data is subject to the GDPR, you have the rights under EU DP Law (if applicable) to:

a) delete Personal Data that we process about you, except we are not obliged to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims;

b) restrict our processing of your Personal Data where you believe such data to be inaccurate; our processing is unlawful; or that we no longer need to process such data for a particular purpose unless we are not able to delete the data due to a legal or other obligation or because you do not wish for us to delete it;

c) where the legal justification for our processing of your Personal Data is our legitimate interest, object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defence of a legal claim;

d) obtain Personal Data we hold about you, in a structured, electronic format, and to transmit such data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are processing that data on the basis of your consent or to perform a contract with you; and

e) where you have consented to our processing of your Personal Data, withdraw your consent at any time, free of charge This includes cases where you wish to opt out from marketing messages that you receive from us.

3. You may exercise these rights by contacting us at the contact details in section 9.6 of this Privacy Policy. Please note that we will not charge a fee when we deal with your requests in the exercise of these rights (including the rights provided for in section 9 of the Privacy Policy).

4. If we are unable to resolve an inquiry or a complaint, you have the right to contact the data protection authority of the EEA country which you are in or to which the issue relates.

1. If there are any questions or concerns regarding this Privacy Policy, please contact us as follows:

by email: [email protected].

1. The English version of this Privacy Policy will prevail wherever there is any inconsistency or conflict between the English and Chinese version.

2. If the processing of your Personal Data is subject to the GDPR, and there is any inconsistency or conflict between the provisions in sections 1 to 9 and sections 10 to 12, the provisions in sections 10 to 12 will prevail.