PERSONAL INFORMATION PROTECTION POLICY
Data privacy is of high importance for H&M and we want to be open and transparent with our processing of your personal data.
We therefore have this Personal Information Protection Policy ("Policy") setting out how your personal data will be processed and protected.
By purchasing or using our products and/or services from our platforms including our website hm.com.cn, H&M App, H&M WeChat Official Account, H&M WeChat Online Store and H&M Member Center on WeChat (collectively referred to as “H&M Platforms”) and HM Tmall Official Flagship Store (hm.tmall.com) ("H&M Tmall Store"), you represent that you have fully understood the content of this Policy (including its updated versions) that we collect, use, store and share your personal data according to this Policy.
Who is the controller of your personal data?
The Chinese company, H&M Hennes & Mauritz (Shanghai) Commercial Co. Ltd (“H&M”), is the controller of the personal data you submit to us and responsible for your personal data under applicable data protection law.
H & M Hennes & Mauritz (Shanghai) Commercial Co. Ltd
Registered address: No 645-659, B1-4F, Middle Huaihai Road, Huangpu District, Shanghai, P.R. China
Registered number: 91310000794519276H
Where do we store your data?
The data we collect from you is stored within the Mainland of the People´s Republic of China (“Mainland China”), except that your order history data generated before November 18, 2019 is stored out of China under the custody of our mother company H & M Hennes & Mauritz AB GBC until November 17, 2022 at the latest, in order to provide you with inquiry service of purchase history, to support you to bind your mobile phone number to your My Account, and to develop and improve our supply chain, products and services. Any transfer of Personal Data outside the Mainland China will be carried out in compliance with applicable laws.
Who can access your data?
Your data may be shared within the H&M group (for details on the companies within the H&M group, please refer to our annual report which may be found at about.hm.com). We never pass on, sell or swap your data for marketing purposes to third parties outside the H&M group.
Except for those third-parties expressly indicated herein, we will share your personal data with other third parties only after receiving your authorization or consent.
We may externally share your personal data according to laws and regulations or needs for dispute resolution by litigation or required by administrative or judicial authorities.
We will not transfer your personal data to any company, organization or individual, except for the following circumstances:
When a merger, acquisition, asset transfer or similar transaction involves transfer of personal data, we will inform you, and require the new company or organization which holds your personal data to continue to be bound by this Policy; otherwise, we will require such company or organization to re-seek your authorization or consent.
We will not publicly disclose your personal data unless any of the following circumstances applies:
In the circumstance of compulsory requirements from the laws and regulations, legal procedures, lawsuits or governmental competent authorities, we may publicly disclose your personal data.
According to law, in terms of sharing, transferring de-identified personal data, as long as it is ensured that the data recipient is unable to re-identify the subject of personal data, we are not required to notify you and seek your consent in advance for the sharing, transferring of such data.
What are your rights?
Right to access:
You have the right to request information about the personal data we hold on you at any time. You can contact H&M and we will provide you with your personal data via e-mail.
If you have an H&M account or H&M membership, you can visit “My Account” or “Member Center” of any H&M Platforms or "Store Membership" of H&M Tmall Store (hereinafter collectively referred to as "My Account") and access your personal data of your account under your account pages on “My Account”.
Right to rectification:
You have the right to request rectification of your personal data if the information is incorrect, including the right to have incomplete personal data completed. We will also use our best efforts to notify the parties who obtain your personal data from us and require them to rectify your personal data in a timely manner.
If you have an H&M account or H&M membership you can edit your personal data under your account pages on "My Account".
Right to erasure:
You have the right to erase any personal data processed by H&M at any time except for the following situations:
*you have an ongoing matter with Customer Service;
*you have an open order which has not yet been shipped or partially shipped;
*you have an unsettled debt with H&M, regardless of the payment method;
*if you are suspected or have misused our services within the last four years;
*your debt has been sold to a third party within the last three years or one year for deceased customers;
*your credit application has been rejected within the last three months;
*if you have made any purchase, we will keep your personal data in connection to your transaction for book-keeping purposes.
If we respond to your deletion request, we will also use our best efforts to notify the parties who obtain your personal data from us and require them to delete your personal data in a timely manner, unless otherwise specified by laws and regulations or these parties obtain your independent authorization.
Your right to withdraw your consent:
You have the right to withdraw your consent for the processing of your personal data at any time. When you do so, H&M will not be able to provide you with the services mentioned herein. H&M will not continue to process the personal data unless we can demonstrate legitimate grounds for the process which overrides your interest and rights or due to legal claims.
Your right to object to direct marketing:
You have the right to object to direct marketing, including profiling analysis made for direct marketing purposes.
You can opt out from direct marketing by the following means:
* following the instruction in each marketing email or SMS;
* by editing the settings of your My Account;
* un-subscribe on WeChat Official Account for WeChat messages;
* by contacting Customer Service for marketing emails.
Right to H&M membership cancellation
You may unbind H&M Tmall Store from your H&M Membership Account by clicking “Quit Membership” on “Store Membership” – “Membership Rules” page of H&M Tmall Store. After unbinding, you will not be able to enjoy purchase accumulative points, member-only discount and other member benefits in H&M Tmall Store. But your membership on other H&M Online Platforms remains same without any impact.
If you would like to quit your membership on all H&M Online Platforms, you need also to contact customer service to cancel your membership. Please note that cancelling your membership means that you will only be able to shop at H&M Online Platforms using the guest check-out, any points which remain in such account will be forfeited, and H&M will not be able to provide you services applicable to H&M membership under the H&M Membership Terms and Conditions and the Personal Information Protection Policy.
How can you exercise your rights?
We take data protection very seriously and therefore we have dedicated customer service personnel to handle your requests in relation to your rights stated above. You can always reach them at email@example.com. To ensure safety, we may need you to provide a written application or otherwise prove your identity, and usually we will respond to your request within 15 working days after receiving your feedback and verifying your identity.
Data Protection Officer:
We have appointed a Data Protection Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Data Protection Officer at firstname.lastname@example.org and write DPO as subject matter.
How do we manage website links?
The online H&M Platforms may contain website links that are not under our supervision. For such websites, we are not responsible for their privacy and content protection, but we provide such links to facilitate visitors finding information on specific subjects.
How do we process children's personal data?
Only persons 18 years of age or older, who are not under guardianship, or over 16 years of age who have the consent of the guardians (we reserve the right to request written confirmation of such consent) can place an order on H&M Platforms or create his/her own H&M membership.
In the circumstance of collection of children's personal data with the permission of parents or guardians, we shall use or publicly disclose the data only under the situation of being legally allowed, being permitted expressly by the parents or guardians, or being essential for protecting the children. If we find any collection of children’s personal data without evidenced prior consent of the parents or guardians, we will try our best to delete the relevant data as fast as possible.
Right to complain:
If you consider H&M to process your personal data in an incorrect way you can contact our Data Protection Officer at email@example.com and write DPO as subject matter. To ensure safety, we may need you to provide a written application or otherwise prove your identity, and usually we will respond to your request within 15 working days after receiving your feedback and verifying your identity. You also have the right to turn in a complaint to a supervisory authority if our response is unsatisfying to you.
Updates to this Policy:
We may need to update this Policy. The latest version of the Policy is always available on any H&M Platforms and in H&M Tmall Store. We will communicate any material changes to the Policy, for example the purpose of why we use your personal data, the identity of the personal data controller. In addition, we will not reduce your rights hereunder without your explicit consent unless we are complied to do so by statutory law.
This updated version of Personal Information Protection Policy shall come into force as from September 8, 2020.