PRIVACY POLICY

May 2026

Galeries Lafayette attaches great importance to the protection of your personal data and the respect for your privacy. This policy aims to inform you of our practices regarding the collection, processing, and sharing of the data you provide to us in stores and/or via our websites.

By “Galeries Lafayette,” we mean the company Galeries Lafayette Management, whose registered office is located at 27 rue de Châteaudun – 75009 Paris, as well as all companies operating stores under the Galeries Lafayette brand that are subsidiaries or affiliates of the company Galeries Lafayette Management (hereinafter “Galeries Lafayette”) and websites:

• Galerieslafayette.com
• Haussmann.galerieslafayette.com
• Gourmet.galerieslafayette.com
• Wellness.galerieslafayette.com

PREAMBLE

We consider your personal data to be confidential data to which we pay particular attention. Personal data includes any information that allows you to be identified directly or indirectly, notably your name, gender, age, postal address, telephone number, email address, and IP address.

In accordance with legal and regulatory obligations, we collect, use, share, and retain this information under enhanced security conditions and for limited periods of time, proportional to the purposes for which you communicated them to us.

1. DATA COLLECTION

You trust us with the processing of your data, and we want to be transparent about how we collect it. We collect the data you provide when you make purchases or use our services in stores and/or online, particularly when you:

• Browse and consult our websites;
• Create a customer account;
• Subscribe to our services, subscriptions, and/or programs, notably loyalty programs;
• Use your loyalty card;
• Use the wallet;
• Request a credit card offered by Galeries Lafayette;
• Add products to your shopping cart;
• Place an order or make a return request on our websites;
• Proceed with a payment;
• Subscribe to newsletters or communications from Galeries Lafayette;
• Contact our customer service;
• Use the Wi-Fi in our stores;
• Ask a question or answer a question on the community chat;
• Participate in a game or competition;
• Complete an information entry form, such as a questionnaire or survey.

In the event that certain sections are specifically aimed at children under 15 years old and offer them the possibility to transmit personal data to us (registration for a game or competition, for example), we require them to obtain prior authorization from their parents or legal guardian(s).

Furthermore, certain information requested in order forms and entry forms during a purchase or service is mandatory and is marked with an asterisk. Their collection is essential for processing your request. Consequently, failing a response, we will not be able to process your request.

2. NATURE OF DATA AND PURPOSES OF DATA PROCESSING

The data controller is the company Galeries Lafayette Management, the parent company of the Department Stores branch, acting both on its own behalf and on behalf of its sales/service subsidiaries operating the Galeries Lafayette banners (Galeries Lafayette Stores, Galeries Lafayette Haussmann, Galeries Lafayette Catering, 1001 Listes, Galeries Lafayette Outlet, Galeries Lafayette Champs-Elysées) as well as for affiliated companies operating stores under the Galeries Lafayette brand and accepting the Galeries Lafayette loyalty program.

The information collected about you allows us to manage and facilitate your purchases, to get to know you better in order to send you targeted offers, and thus to improve and personalize our services. We use your personal data according to the purposes for which you transmitted it to us, which are based on one or more of the following legal grounds:

• The execution of the services we offer you;
• Your consent;
• Our legitimate interests;
• A legal, regulatory, judicial, or administrative obligation.

The table below presents the data we are likely to collect, the ways we use it, as well as the expected objective and their legal bases.

Personal data	Purposes	Legal Bases
Title / Last Name / First Name	Provide the product or service to the specifically eligible person (e.g., loyalty program, personalized sales advisor, order). Improve our services and your customer experience. Personalize our communications. Establish a nominative document: an invoice or a warranty… Participate in a competition. Perform statistical analyses.	Execute a contract Legitimate interest
Postal address	Identify you. Ship and deliver your orders. Establish a nominative document: an invoice or a warranty… Contact you and send you documents, commercial communications. Manage your participation in a competition: sending prizes. Where applicable, verification of residence by the credit institution or by any competent administrative authority (tax detax). Invite you to an event. Perform statistical analyses.	To execute a contract To communicate with you
Email address	Identify you. Contact you. Inform you. Invite you to events. Send you your sales documents. Send you commercial communications. Perform statistical analyses. Carry out personalized communication operations via social networks/advertising networks.	Execute a contract Legitimate interest Consent
Opt-in (authorization) via a checkbox on forms in-store or on our websites	Send you commercial communications by SMS, email, WhatsApp. Receive commercial solicitations from our partner brands. Exchange with you via instant messaging.	Consent
Mobile and/or landline telephone number	Identify you. Contact you (delivery, after-sales service…), inform you. Improve your customer experience. Send you commercial solicitations.	Execute a contract Legitimate interest Consent
Date of birth / Age	Identify customers with the same name. Determine your minority/majority for the delivery of a product or service. Improve your customer experience. Perform statistical analyses.	Legitimate interest Legal obligation Execute a legal obligation
Communicated preferences	Know you better. Propose personalized commercial offers and advantages.	Execute a contract Legitimate interest
Payment information / Bank data	Securely record your payments. Refund you. Facilitate the customer journey. Conduct analyses to fight fraud, abuse, and security breaches. Perform statistical analyses.	Execute a contract Legitimate interest, prevent and detect fraudulent activities
Purchase data	Management of the Loyalty Program. Make personalized product suggestions to you. Manage your orders. Allow returns and associated refunds. Establish invoices / proof of warranties. Conduct economic purchase analyses or statistics. Conduct analyses to fight fraud, abuse, and security breaches.	Execute a contract Legitimate interest
Contact history	Follow the customer relationship. Improve our services and your customer experience. Conduct analyses to fight fraud, abuse, and security breaches.	Execute a contract Legitimate interest
Customer / Loyalty Identifiers	Identify you. Management of the loyalty program. Follow the customer relationship.	Execute a contract Legitimate interest
Connection data	Follow the relationship.Allow the finalization of an order.	Execute a contract Legitimate interest
Password	Allow and secure your connection.Prevent abuse and security breaches.	Execute a contract Legitimate interest
Copy of an identity document / proof of address	Verify your identity and nationality according to the nature and amount of the purchase.Conduct analyses to fight fraud, abuse, and security breaches.Tax detax	Execute a contract Legitimate interest Legal obligation

Connection via Social Login

When you create an account or log in via a social network (Google, Meta, Apple), we receive your public profile data that you have agreed to share, such as your name and email address. This data is exclusively used for authentication and the management of your account. No data is used for commercial purposes without your explicit consent.

3. TRANSMISSION OF PERSONAL DATA TO THIRD PARTIES

Your personal data, collected within stores under the Galeries Lafayette brand and/or through our websites, may be transmitted to third parties within the limits provided by the provisions in force and in accordance with this policy. Third parties are considered to be any companies other than the company Galeries Lafayette Management or its subsidiaries or affiliates operating stores under the Galeries Lafayette brand for which it intervenes (hereinafter “Third Parties”). These Third Parties are:

• 3.1 Commercial partners: Your personal data may be transmitted to our commercial partners and more particularly to the companies operating our brand or offering the Galeries Lafayette loyalty card, as well as the brands of products and services offered for sale in Galeries Lafayette stores and websites, to perform processing related to a purchase or a service request (order tracking, warranty, after-sales service) and for the same purposes as what you have authorized us to do. Our commercial partners, provided that you have expressly consented, are likely to send you commercial solicitations within the framework of commercial, event, or partnership operations. Our commercial partners are not authorized to use this data for other purposes.
• 3.2 Financial partners: Your personal data may be transmitted to our partners involved in payment operations, notably financial institutions and entities fighting fraud. Thus, the personal data collected on the site is processed by the partners to determine the associated risk level. Any order considered suspicious will be verified by the dedicated service, which may adjust its execution conditions. In the event of a fraudulent order detection, the data may be transmitted to administrative or financial authorities within the scope of their investigative powers.
• 3.3 Social Networks / Advertising Networks: Your email address may be transmitted, via a hashing process to enhance its security, to social networks/advertising networks to offer you personalized advertisements for our products and services on these platforms and thus better meet your interests. This transmission, based on the legitimate interest of Galeries Lafayette, will only be carried out if you have given your consent to marketing communications (consent to marketing cookies and/or opt-in via your account to Galeries Lafayette’s offers and commercial communications). You can withdraw your consent at any time and without justification by modifying your communication preferences in your account, by contacting our customer service, or by setting your cookies via the “Cookie Management” link available in the website footer. You can also consult the privacy policy of the social network or advertising network concerned for more information:
  • Meta
  • Pinterest
  • Tiktok
  • Google
  • Snapchat
  • Criteo
• 3.4 Service Providers: Your personal data may be transmitted to external service providers who process it on our behalf and/or according to our instructions. These service providers may act as data processors or as controllers of their own processing. The transmission of your data is strictly regulated to guarantee the security of your data. These are, in particular, third-party companies providing services and benefits: marketing, advertising, technological, IT, logistics, order management, transport and delivery, customer services, after-sales service, in order to offer you all the necessary guarantees to carry out your commercial operations.
• 3.5 State Authorities: In order to comply with legal, regulatory, judicial, or administrative obligations or to respond to requests from administrative and judicial authorities, we may be required to communicate your data to these authorities whenever we are legally required to do so.

4. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION

Your personal data is processed and hosted on servers located in the European Union; however, exceptionally, it is possible that it may be transferred to a processor whose servers are located in a third country outside the European Union. In such an event, we take all necessary measures to guarantee the security of your data and compliance with legal and regulatory obligations, notably through the signature of specific mechanisms such as the standard contractual clauses adopted by the European Commission. We will ensure in particular that they are protected in the same way as if they were used within the European Union.

5. DATA RETENTION PERIOD

• Customers: We retain your data for the duration of our commercial relationship and for a maximum of 5 years after our last interaction.
• Prospects: We retain your data for a maximum of 3 years after our last interaction.

In addition to the retention period of your data, it will no longer be used to send you commercial solicitations via email and/or SMS beyond a period of two years from your last interaction with us, which means notably either:

• Your last order on our site or purchase in one of our stores;
• Your last click on a link in one of our commercial communications by email;
• Your last login to the customer account or loyalty account;
• Your last communication with customer service.

6. RIGHTS OF DATA SUBJECTS

You have at any time a right of access, portability, rectification, and erasure of your data or limitation of its processing. It is specified that regarding requests for changes to names, first names, and email addresses, these must be sent directly to customer service via the contact form provided for this purpose or by mail. In terms of commercial prospection by Galeries Lafayette or its partners, you can exercise your right to object without having to justify a legitimate reason. If you have given us your consent so that we can use your data, for example, to send you newsletter communications, you can withdraw your consent at any time.

You can exercise these rights according to the channels described below:

• 1- directly from your customer account space: When you are logged into your customer account on our site, you can always check and update or delete your information by accessing the services on the page “MY ACCOUNT” > “YOUR PERSONAL INFORMATION” > “MODIFY” or “DELETE YOUR ACCOUNT”. The information recorded in your account is stored until the account is deleted, unless your data is no longer necessary for the execution of our services.
• 2 – on the mobile application: When you are logged into your customer account on the mobile application, you can exercise your right to object and erase data on the page “MY ACCOUNT” > “PREFERENCES” > “ACCOUNT DELETION”.
• 3- directly in store: When you do not have a customer account on our site but you are a member of the Mes Galeries loyalty program, you can request the verification and updating of your information in our customer file from our in-store staff.
• 4- by email or mail: You can exercise your right of access, portability, rectification, and erasure of data concerning you under the conditions provided by legal and regulatory provisions by making a request by mail to:
  • via the contact form available at the bottom of the page of the galerieslafayette.com website.
  • by email to the address: [email protected].
  • by mail: GALERIES LAFAYETTE – Data Protection Officer, 27 rue de châteaudun – TSA 56 000 – 75009 PARIS.
• 5- directly from your customer account space: When you are logged into your customer account on our site, you can always check and update the information concerning you by accessing the services on the page “MY ACCOUNT” > “MY DATA YOUR PERSONAL INFORMATION” > “MODIFY”. The information recorded in your account is stored until the account is deleted, unless your data is no longer necessary for the execution of our services.

It is specified that you can also object, for legitimate reasons, to your personal data being processed or kept in our files. If, for any reason, you consider that our response is not satisfactory, you can lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés), responsible for ensuring the protection of personal data on French territory.

7. SECURITY OF YOUR DATA

7.1 Our commitment to protection

We make every effort to guarantee the security and confidentiality of your personal information. For this, we use rigorous technical and organizational measures to prevent your data from being lost, stolen, modified, or accessed by unauthorized persons, whether accidentally or intentionally.

7.2 Security of your payments

Whether you buy online or in-store, the security of your transactions is one of our priorities.

• Protection by encryption: We use the SSL (Secure Socket Layer) protocol to lock access to your personal information and payment data.
• Banking confidentiality: Thanks to the SIPS system (Système Intégré de Protection des Sites), your bank details are encrypted before being transmitted directly to our bank. They never circulate “in clear text” on the Internet.
• Storage: For your security, we do not retain any data relating to your bank card after the transaction.

7.3 Management of incidents and data breaches

Despite our precautions, if a security breach should occur, we have set up an alert and rapid reaction procedure:

• Analysis and correction: We intervene immediately to identify the source of the problem and limit risks.
• Information to authorities: If a data breach presents a risk to your rights, we undertake to inform the CNIL as soon as possible (within 72 hours maximum after becoming aware of it).
• Information to users: If the incident presents a high risk for you, we will notify you personally as soon as possible. We will then explain the situation as well as the measures we have taken to protect your data and mitigate its consequences.

8. MODIFICATION OF THE PRIVACY POLICY

We may modify this policy. If it turns out that these modifications could lead to a reduction of your rights, we will inform you directly according to the contact methods you have communicated to us.

9. CONTACT

For any questions, you can contact our customer service reachable at the address: [email protected].

Furthermore, the Galeries Lafayette Group has appointed a data protection officer. The latter can be reached at the following address: GALERIES LAFAYETTE – Data Protection Officer, 27 rue de châteaudun – TSA 56 000 – 75009 PARIS and is specifically suited to handle the following subjects:

• lodge a complaint
• question concerning this Privacy Policy and confidentiality

10. COOKIE MANAGEMENT

10.1 What is a “cookie”?

A cookie is a file deposited on your terminal (computer, mobile, or tablet) when visiting a site or consulting an advertisement. Its purpose is to collect information relating to your navigation, in order to send you services and offers adapted to your terminal and your interests.

Your choice regarding the deposit of cookies is kept for 6 months. Cookies deposited on the site have a maximum lifespan of thirteen months.

When you visit our website for the first time, cookies are likely to be deposited, subject to the choices you have expressed regarding cookies. We inform you of the deposit of these cookies via the information banner that displays upon the first opening of the web page consulted. You are then informed that by clicking on the “ACCEPT AND CLOSE” button you give your consent for the deposit of all cookies. If you click on the “Continue without accepting” button, no cookie will be deposited except for cookies strictly necessary for the operation of the site (hereinafter defined as functional cookies).

Your choices are not final and can be modified at any time by adapting your cookie deposit settings.

10.2 Why does the Galeries Lafayette website use cookies?

Cookies record information relating to your interaction with the site, and notably to your navigation and your behavior. This information can be: your IP address, pages visited, brands that interest you, purchases made, etc.

In this context, subject to your agreement and/or the selected setting, Galeries Lafayette collects and processes all or part of the following information within the framework of the operations detailed below:

• Functional cookies indispensable for navigation: These cookies are files essential for the display and proper functioning of the site. They allow notably to authenticate you, to memorize data relating to customer accounts, and to save shopping carts. These cookies are automatically deposited and it is not possible to set or refuse their deposit because, without them, the site could not display and/or function correctly.
• Marketing cookies: We are likely to call upon partner companies to allow the display of advertisements, targeted content offered according to your interests, products you like that will be displayed to you on other sites during your internet browsing (advertising banners). These partners are:
  • Google Ads: uses trackers to display personalized advertising based on your navigation and measure the performance of advertising campaigns on Google tools.
  • Bing: uses trackers to display personalized advertising and measure the performance of advertising campaigns.
  • RemailMe: uses trackers to display personalized advertising based on your navigation.
  • Facebook: uses trackers to display personalized advertising and measure the performance of advertising campaigns on Facebook tools.
  • Snapchat: uses trackers to display personalized advertising and measure the performance of advertising campaigns on Snapchat tools.
  • Pinterest: uses trackers to display personalized advertising and measure the performance of advertising campaigns.
  • Dataiads: uses trackers to offer Google Shopping users an optimized browsing path.
  • TikTok: uses trackers to display personalized advertising and measure the performance of campaigns.
  • Gamned: uses trackers to display personalized advertising based on your navigation.
  • Criteo: uses trackers to display personalized advertising based on your navigation and measure the performance of advertising campaigns.
  • RTB House: uses trackers to display personalized advertising based on your navigation and measure the performance of advertising campaigns.
  • Uzerly (Cibleclic): uses trackers to display personalized advertising based on your navigation and analyze service use.
• Analysis and performance cookies: We are likely to call upon partner companies to analyze and measure the audiences and visits to our websites, establish statistics, and perform checks with the aim notably of optimizing our services and/or improving customer knowledge. These partners are:
  • Google Analytics: uses trackers to measure performance.
  • Content Square: uses trackers to measure audience performance.
• Personalization cookies: We are likely to deposit partner cookies allowing us to recommend products or services offered by Galeries Lafayette that you are likely to appreciate. These partners are:
  • AB Tasty: uses trackers to display personalized tests and measure the performance of personalization campaigns.
  • Salesforce Marketing Cloud Personalization: uses trackers to personalize content, recommendations, and messages displayed on the site based on your navigation and measure the performance of personalization campaigns.

10.3 Why does the Galeries Lafayette Le Gourmet website use cookies?

In this context, subject to your agreement and/or the selected setting, Galeries Lafayette Le Gourmet collects and processes all or part of the following information within the framework of the operations detailed below:

• Marketing cookies:
  • Google Ads: uses trackers to display personalized advertising based on your navigation and measure the performance of advertising campaigns on Google tools.
  • Facebook: uses trackers to display personalized advertising and measure the performance of advertising campaigns on Facebook tools.
  • Teads: uses trackers to display personalized advertising based on your navigation and measure the performance of advertising campaigns.
• Analysis and performance cookies:
  • Google Analytics: uses trackers to measure performance.
  • Hotjar (feature of ContentSquare): uses trackers to measure performance.
• Personalization cookies:
  • AB Tasty: uses trackers to display personalized tests and measure the performance of personalization campaigns.

10.4 How to configure cookies?

Several possibilities are offered to you to configure your preferences regarding cookies. Any setting you undertake will, however, be likely to modify your navigation and your access conditions to certain services requiring the use of cookies. You will no longer be able to benefit from a certain number of features which are nevertheless necessary to browse certain areas of our site. This would be the case if you tried to access our content or services that require you to identify yourself. This would also be the case when we – and/or our partners – could not recognize, for technical compatibility purposes, the type of browser used by your terminal, its language and display settings, or the country from which your terminal seems connected to the internet.

You can configure cookies by the following means:

• by directly configuring your browser (Internet Explorer, Chrome, Safari, Mozilla, etc.) so that cookies are saved or rejected;
• by clicking on “Personalize my choices” on the cookie banner that displays during your first visit to our site;
• by clicking on “Cookie Management” at the bottom of our website page.

10.5 Why does the Galeries Lafayette mobile application use trackers?

Trackers record information relating to your interaction with the mobile application, and notably to your navigation and your behavior.

The table below presents the trackers that are deposited, the personal data collected, as well as their purposes and retention periods:

Trackers	Purposes	Personal Data	Retention Period
SDK MCE IOS	Send push notifications to app users / monitor mobile engagement (opens, clicks)	User ID, Push token (APNS), Device information (OS, app version), Engagement data (opens, clicks)	6 months
SDK MCP IOS	Personalization of the experience / monitoring user behavior (real-time events)	User ID, Email address, Device information (OS, app version), Browsing data (screens viewed, actions), Event data (clicks, view, path)	6 months
Google analytics/Firebase	Analyze the use and performance of the mobile application	User ID, Geographic area	6 months

10.6 How to configure trackers?

Several possibilities are offered to you to configure your preferences regarding trackers. Any setting you undertake will, however, be likely to modify your navigation and your access conditions to certain services requiring the use of trackers. You will no longer be able to benefit from a certain number of features which are nevertheless useful to browse certain areas of our mobile application. This would be the case if you tried to access our content or services that require you to identify yourself. This would also be the case when we – and/or our partners – could not recognize, for technical compatibility purposes, the type of browser used by your device, its language and display settings, or the country from which your device is connected to the internet.

You can configure trackers by the following means:

• by clicking on “ACCOUNT”, > “YOUR COMMUNICATION PREFERENCES”, > “TRACKER MANAGEMENT”.
• By directly contacting our customer service.