We follow all applicable data protection laws when collecting personal data online from children, including by obtaining parental consent where required, based on the applicable age standard. For example, we obtain consent from the holder of parental responsibility of a child in the EEA, Switzerland, Serbia, and the UK when we collect personal data from children under 16 years of age. Similarly, in the U.S., we obtain verified parental consent when collecting personal data from children younger than 13. In Canada, these verified parental consent measures are in place for minors younger than 14. We do not use personal data collected from children for targeted advertising.

Your privacy is important to us. That’s why we respect it by taking steps to protect your data from loss, misuse, or alteration.

We have processes and controls in place to appropriately manage personal data, including its collection, use, disclosure, retention, and destruction. We respect your personal data and take steps to protect it from loss, misuse, or alteration. Where appropriate, these steps can include technical measures like firewalls, intrusion detection and prevention systems, unique and complex passwords, and encryption. We also use organizational and physical measures such as training staff on data processing obligations, identification of data incidents and risks, restricting staff access to your personal information, and ensuring physical security including appropriately securing documents when not being used.

JNCorporate has its head offices in the United States, regional offices in Singapore, Dubai, Geneva, and Panama, and additional service centers in other countries, such as Costa Rica or the Philippines. As a multinational company, JNCorporate undertakes data transfers, either within the JNCorporate group of entities or when sharing your data with service providers or selected partners that may store, process, or access your data in a country other than the one in which it was collected, including the United States. Personal data collected from Quebec, for example, may be transferred outside of Canada with adequate protections and safeguards in place.

For EU citizens (as well as citizens of Switzerland, the UK, and Serbia, for example), this means that their data may be processed outside of the European Economic Area (EEA), either in countries that have been recognized by the European Commission to offer adequate data protection, like the United Kingdom (where, for example, some of our fulfillment, return, and contact center services are managed for the EU region), or Switzerland (where our EU headquarters are located), or in other countries that the European Commission does not deem as offering such a level of data protection. For such transfers of data, special safeguards need to be foreseen to ensure that the protection travels with the data. We use the EU Standard Contractual Clauses, standardized and pre-approved model data protection clauses, for these transfers. You can find the latest version of the approved EU Standard Contractual Clauses, including the different transfer modules, here. Our transfer agreements also incorporate the standard data protection clauses issued following UK, Swiss, and Serbian data protection law. If you have any questions regarding our data transfer agreements, please contact us.

If you are located in the European Economic Area (EEA), United Kingdom (including Gibraltar), or Switzerland, please note that JNCorporate is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) [collectively, the “Data Privacy Framework”] developed by the U.S. Department of Commerce, the European Commission, Information Commissioner, and Swiss Federal Data Protection, respectively, regarding the transfer of personal information from the EEA, United Kingdom (including Gibraltar), or Switzerland to the U.S. Click here to view our Data Privacy Framework: Consumer Privacy Policy.

For non-EEA and UK data, we perform such transfers based on your consent or our contracts, where required by local law.

➡ U.S. State Privacy Disclosure and Consumer Rights (“U.S. State Privacy Notice”)

This U.S. State Privacy Notice applies to “Consumers” as defined under U.S. privacy laws, specifically the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (“CCPA”), the Virginia Consumer Data Privacy Act (“VCDPA”), the Colorado Privacy Act, the Utah Consumer Privacy Act, Connecticut’s Act Concerning Personal Data Privacy and Online Monitoring, and any other U.S. privacy laws, as each are amended and as and when they become effective, and including any regulations thereunder (collectively, the “U.S. Privacy Laws”). This U.S. State Privacy Notice is a supplement to this Privacy Policy. In the event of a conflict between any other JNCorporate policy, statement, or notice and this U.S. State Privacy Notice, this U.S. State Privacy Notice will prevail as to Consumers and their rights under the applicable U.S. Privacy Laws.

This U.S. State Privacy Notice is designed to provide you with notice of our recent personal data practices over the prior 12 months from the “Last Updated” date of this Privacy Policy. This U.S. State Privacy Notice will be updated at least annually. This U.S. State Privacy Notice also applies to our current data practices, providing “notice at collection,” which informs you of the personal data (also referred to in some of the U.S. Privacy Laws as “personal information”) we collect online and offline, and the purposes for which we process personal data, among other requirements mandated by the U.S. Privacy Laws. For any new or substantially different processing activities that are not described in this U.S. State Privacy Notice, we will notify you as required by the U.S. Privacy Laws, either at the time of collecting personal data or by updating this U.S. State Privacy Notice earlier than required. We reserve the right to amend this U.S. State Privacy Notice at our discretion and at any time. To contact us about this U.S. Privacy Notice, please see the Contact Us section below.

Generally, we collect, retain, use, and disclose your personal data for our business and commercial purposes, as described throughout the remainder of this Privacy Policy, including in “How We Gather & Use Personal Data” and “How We Disclose Personal Data” (collectively, our “Processing Purposes”). The sources from which we collect personal data are detailed in the “How We Gather & Use Personal Data” section above. Some of the Processing Purposes involve activities such as “Sale,” “Sharing,” and “Targeted Advertising,” which are further explained in the “Do Not Sell/Share/Target” section below. Please note that the Processing Purposes listed in the table are general descriptions to enhance readability and clarity. For a comprehensive description of each Processing Purpose, please refer to the “General Ways We Use Personal Data” section of the Privacy Policy above.

The table below outlines the categories of personal data we collect in the first column. The second column provides examples of data types within each category, including some of the personal data types/categories mentioned under “Types of Personal Data We Collect.” The third column identifies the categories of recipients who may receive such personal data (including sensitive personal data) as part of disclosures for business purposes, as well as disclosures that may qualify as a Sale or Share under certain U.S. Privacy Laws. The fourth column specifies the Processing Purposes applicable to each category of personal data. In the fifth column, we indicate the applicable retention period on a per category basis.

➡ EEA, UK and Serbia Privacy

This section includes information required for disclosing our processing of personal data of EEA country, UK, and Serbian residents. It aims to enhance transparency regarding our processing, retention, and transfer of personal data by the General Data Protection Regulation (“GDPR”), and its incorporation into UK law by the Data Protection Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019. Certain information, such as the entities and list of data controllers, as well as the legal bases for processing explained under “Processing and Retention” below, applies specifically to the processing of personal data of EEA country, UK, and Serbia residents. However, the retention periods described below apply more broadly to the personal data of residents of the states described above in the U.S. State Privacy Notice.

Entities

Different JNCorporate entities may act as the controller of your personal data. A data controller directs the processing activity and is primarily responsible for the data. The chart below identifies our data controllers for EEA country, UK, and Serbian data. For instance, if you register for email on one of our French websites, the JNCorporate entity listed next to that country name will be the controller of that personal data (e.g., JNCorporate France SAS).

➡ Colombia Privacy

JNcorporate Colombia Ltda., with NIT 800.000.946-4, located at Carrera 7 # 114-33, 12th floor, Bogotá D.C., phone number 601-5280000, and email address notifications.im@jn.com, acts as the Data Controller. In compliance with articles 15 and 20 of the Constitution of Colombia, Law 1581 of 2012, Law 1266 of 2008, Decree 1377 of 2013, and Decree 1074 of 2015, it informs all data subjects that the personal data provided will be processed in accordance with the purposes described in this privacy policy.

➤  Rights of the Owner of Personal Data Residing in Colombia

In compliance with articles 15 and 20 of the Constitution of Colombia, Law 1581 of 2012, Law 1266 of 2008, Decree 1377 of 2013, and Decree 1074 of 2015, data subjects are informed that the personal data provided will be processed according to the purposes described in this privacy policy. Additionally, data subjects have the following rights:

a) To know, update, and rectify their personal data regarding partial, inaccurate, incomplete, fractioned, misleading, or data whose processing is expressly prohibited or has not been authorized;

b) To request proof of the authorization granted, unless expressly exempted as a requirement for processing;

c) To be informed, upon request, of the use that has been given to their personal data;

d) To file complaints with the Superintendence of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add, or complement it;

e) To revoke the authorization and/or request the deletion of the data when the processing does not comply with constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the Data Controller or Processor have engaged in conduct contrary to this law and the Constitution;

f) To access their personal data that have been subject to processing free of charge.

The aforementioned rights may be exercised in accordance with the provisions set forth in this section and the privacy policy.

➤  Authorization and form of collection of personal data

For the processing of personal data, JNcorporate Colombia Ltda. will obtain the prior, express, and informed consent of the data subject. This consent may be obtained through any means that can be consulted later and may be granted through different mechanisms enabled by JNcorporate Colombia Ltda., including in writing, orally, or through the data subject's unequivocal conduct.

The data subject's consent will not be necessary when it concerns:

1. 1. 1. 1. Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
         2. Data of a public nature.
         3. Cases of medical or sanitary urgency.
         4. Processing of information authorized by law for historical, statistical, or scientific purposes.
         5. Data related to the Civil Registry of Persons.

➤ Processing of personal data

JNcorporate Colombia Ltda. uses personal data to fulfill the purpose of affecting and improving people's lives, better understanding their interests and preferences as consumers and individuals. We use your information for the processing purposes designated in the privacy policy, which can be found through our official communication channels.

Here are the purposes for which we process personal data:

1. 1. 1. 1. Carrying out marketing, promotion, and/or advertising activities through different means such as personal visits to customers, marketing, and sending information by physical and electronic means.

         2. Providing customers with information that allows them to access offers, promotions, discounts, launches, and supplying information of interest (personalized attention, benefits, use, health care, and well-being, etc.).

         3. Fulfilling obligations contracted with customers, suppliers, and employees.

         4. Informing about changes to our products and/or services.

         5. Evaluating the quality of products and/or services and measuring customer satisfaction.

         6. Disseminating policies, programs, results, and organizational changes.

         7. Analyzing information for the development and implementation of commercial or marketing strategies, as well as designing, implementing, and developing programs, projects, and events.

         8. Contacting the data subject through calls, text messages, emails, and/or physical means for activities related to the authorized purposes.

         9. Electronic invoicing.

         10. Disclosing, transferring, and/or transmitting personal data within and outside the country to JNcorporate Colombia Ltda.'s parent companies, subsidiaries, or affiliates, or to third parties because of a contract, law, or lawful relationship requiring it or to implement cloud computing services, with the same limitations and rights.

         11. Transferring and/or transmitting sensitive personal data to competent public entities, either by virtue of a legal mandate or judicial or administrative order, on account of or suspicion of adverse events that JNcorporate Colombia Ltda. has become aware of, relating to technical claims or others.

         12. Knowing, storing, and processing all the information provided in one or more databases, in the format that JNcorporate Colombia Ltda. deems most convenient.

         13. Managing procedures (requests, complaints, claims).

         14. Sending information regarding the use and care of offered products, whether directly or through the data processor.

➤  Attention to inquiries, complaints, revocation of authorization, updating, withdrawal, correction, or deletion of databases (generally known as "PQRS").

The data subject, their successors, representatives, or anyone determined by stipulation in favor of another (generally known as the "Interested Party") may exercise their rights by contacting us through written communication addressed to the customer service department, which is the unit responsible for the protection of personal data.

➤  Procedure for the exercise of queries, requests, complaints, revocation of authorization, updating, withdrawal, correction, or deletion of databases

➥  Verification of the Data Subject's identity and the content of any request

To protect the privacy and security of the Data Subject, we verify their identity before responding to requests related to their personal data. Therefore, to address your request, please provide the following identification data of the Data Subject:

1. 1. 1. 1. 1. Full name
            2. Identification number
            3. Contact information (physical and/or electronic address, and contact telephone numbers)
            4. Date of birth

If the request is submitted through our Preference Center, upon receipt, we will send a verification form via email. The Data Subject must respond to this form to complete the request.

For any other Interested Party who is not the Data Subject but seeks to act on their behalf, it is necessary to prove their identity and their status as a successor in interest, representative, or with legal authorization.

Requests related to the processing of Personal Data must include at least the following information:

• • • • • The Data Subject's identification data (full name, identification number, contact information, and date of birth).
        • Accreditation of the Interested Party's identity and their status, if applicable (identification data and supporting documents).
        • This means to receive a response to the request.
        • Reasons and factual basis for the request.
        • Documents intended to support the request.
        • A clear and precise description of the personal data about which the Data Subject seeks to exercise their rights (except for inquiries).

For more detailed information on identity verification and to understand the procedures

➥  Inquiry procedure

The Interested Party may submit a request specifying the information they wish to know, and all inquiries will be addressed within a maximum period of ten (10) business days from the date of receipt. If it is not feasible to respond to the inquiry within this timeframe, the Interested Party will be notified before the expiration of the initial ten (10) business days regarding the reasons for the delay and the new deadline for responding. This subsequent deadline will not exceed five (5) business days following the end of the initial ten-day period.

➥  Procedure for complaints, revocation of consent, withdrawal, correction, updating, or deletion of personal data

When a Data Subject believes that their processed information requires correction, updating, or deletion, or if they suspect a breach of any legal duties, they or another Interested Party may submit a complaint or request for rectification, updating, or deletion of their personal data.

If the complaint is incomplete, the Interested Party will have five (5) days from receipt to rectify any deficiencies. If two (2) months pass without the applicant providing the required information, it will be considered that they have withdrawn their complaint.

Should Procter & Gamble Colombia Ltda. receive a complaint beyond its jurisdiction, it will forward it to the appropriate authority within two (2) business days and inform the Data Subject accordingly.

The maximum timeframe to address a complaint is fifteen (15) business days from the day following its receipt. If unable to address it within this period, the Interested Party will be notified of the reasons for the delay and the new deadline for resolution, not exceeding eight (8) business days after the initial timeframe expires.

➡ Nigeria Privacy

➡ Vietnam Privacy

As a data subject in Vietnam, you are entitled to certain rights under local regulations. These rights include being informed about how your data is processed, the ability to give and withdraw consent, and the right to request access, erasure, rectification/correction, and restriction of your personal data processing. You also have the right to object to the use of your personal data for advertising purposes and to seek self-protection or involve other competent organizations/agencies to protect your rights. It is important to provide complete and accurate personal data when consenting to its processing, in accordance with applicable data privacy laws.

Some of the personal data we collect may be classified as sensitive under Vietnamese law. This includes data such as race and ethnicity, location data obtained through location services, IP addresses, health-related information, bank account details, and biometric data.

Please note that in Vietnam, Legitimate Interest is not the sole legal basis for processing personal data. We will generally seek your consent to process personal data unless other exceptions permitted by law apply.

When collecting and processing personal data of children under 16 years old, we obtain consent from children aged seven or older, as well as from their parent or legal guardian, unless otherwise stipulated by applicable laws.

In the event of a data breach, we will adhere to all reporting and remedial obligations specified by Vietnamese laws.

If you have any questions or concerns regarding your privacy and data protection practices, or if you need this notice in an alternative format due to a disability, please feel free to contact us directly. If your inquiry pertains to a suspected data breach or is specific to our Data Protection Officer, please indicate that in your message.