Privacy Policy
I. Purpose and scope of this Policy
Version: March 2021
This portal (the “ Alert Line ”) is operated by LVMH MOËT HENNESSY LOUIS VUITTON, a French société européenne (SE) having its registered office at 22 Avenue Montaigne, 75008 Paris, France, registered with the Registry of Commerce and Companies of Paris under the number 775 670 417 (hereinafter “ LVMH ”).
This Alert Line allows employees and external stakeholders (the “ Users ”) of the LVMH group (which includes LVMH and its affiliated companies - the " LVMH Group ") to submit reports (the “ Reports ”) to report in good faith (i) a criminal offence, a manifest violation of the applicable law or a threat or prejudice to the general interest; and/or (ii) manifest violations of the Group’s Code of Conduct, internal guidelines, principles and policies.
The terms and conditions as well as the process for submitting a Report are more fully described on the Alert Line Introduction page.
When a User submits a Report, LVMH will be, regardless of the User's employing company within the LVMH Group, the primary recipient of the Report in charge of investigating the reported facts as more fully described below.
In this context, LVMH, as data controller, will access personal data regarding in particular the User and the persons named in the Report (the “ Personal Data ”).
LVMH takes data protection very seriously and complies with applicable data protection regulations. This privacy policy (the “ Policy ”) aims at describing the terms and conditions under which LVMH may collect and process Personal Data.
This Policy applies to all Users irrespective of the company they are working for. Any User must adhere to this Policy before submitting any Report.
II. Type of Personal Data collected and processed
When a User submits a Report via the Alert Line, LVMH will, to the extent necessary for the handling of the Report, collect and process Personal Data about Users, namely: name, surname, function and details, if provided by the User.
LVMH will also collect and process Personal Data about the persons identified in the Report (the ” Reported Data Subject ”), the content of which will depend on the content of the Report (and of the investigation process).
In this respect, it is hereby reminded that Users shall refrain from providing Personal Data that would not be necessary for the purpose of the Report. The Personal Data provided shall be adequate, relevant and limited to what is strictly necessary in relation to the reported violation. For instance, the User shall refrain from providing details about private life, personality, professional skills etc. of the Reported Data Subject except if such information is absolutely necessary for demonstrating the alleged violation. The reported facts shall be presented in a neutral and objective way and clearly identified as only “presumed”. The User shall in no event report facts covered by national defense secrecy, medical secrecy or client-attorney privilege.
III. Purpose of the Data collection and processing
LVMH will use the Personal Data contained in the Report for the following purposes:
- the management of the Report and the investigation of the reported facts
- if applicable, the launching of necessary claims or disciplinary procedures
- if relevant, the enforcement of applicable remediation measures and/or sanctions
- if relevant, the reporting of the reported facts to judicial or governmental entities or in response to court orders, legal procedures or subpoena.
IV. Recipients of the Data
Reports submitted via the Alert Line will be immediately notified to the Group's Ethics and Compliance Director and then examined by an evaluation team composed of a limited number of examiners selected amongst the relevant competent departments within LVMH and its affiliates considering the nature and the severity of the facts reported as well as the persons involved (the “ evaluation team ”). Members of the evaluation team will be subject to reinforced confidentiality obligations.
For the purpose of the investigations, the examiners may, if relevant and depending on the specific context of the Report, share the reported facts, including the Personal Data if necessary, with the relevant competent persons or bodies within the concerned LVMH entity (the Reported Data Subject's employer notably).
For same purpose, LVMH may transfer the Report to third party providers assisting LVMH in the processing of the Reports. Such providers, if any, will be subject to same obligations as those set forth in this Policy.
In any case, all information and Personal Data contained in the Report (the “Data”), including User's identity, will be shared with a limited number of persons and treated as confidential information, to the extent permitted by law, with the utmost care.
In particular, the identity of the User will not be revealed to third parties outside the evaluation team, without User's prior express approval.
Notwithstanding the above, the Data, including User's identity, may also be disclosed to competent authorities and jurisdictions when relevant for handling the reported facts and/or when required by law or in response to court orders, legal procedures or subpoena.
Finally, this Alert Line is operated by a specialised company, EQS Group AG, Bayreuther Str. 35, 10789 Berlin in Germany (“ BK GmbH ”). Personal data and information entered into the Alert Line are stored in a database operated by EQS Group AG in a high-security data center. Only LVMH has access to the data. EQS Group AG and other third parties do not have access to the data. This is ensured in the certified procedure through extensive technical and organizational measures.
V. Transfer of Data
The Alert Line being operated by BKAG, all Data entered will be transferred to the database operated by EQS Group AG in a high-security data center in Germany.
In addition, Personal Data may be transferred to other LVMH entities, including outside the Economic European Area (EEA), depending in particular on the location of the Reported Data Subject's employer.
All transfers of employees' Personal Data within the LVMH Group are covered by LVMH Binding Corporate Rules (BCR). Any transfer of Personal Data, not covered by these BCR, towards countries not providing an adequate level of protection will be subject to the signature of Standard Contractual Clauses as provided by the European Commission in accordance with applicable data protection regulations, or based on any other legal means allowed by applicable data protection regulations.
VI. Data retention period
The Data collected for the purposes hereunder will be stored as provided below.
If the reported facts do not fall within the scope of the Alert Line, the Data will be immediately deleted (or archived after anonymization for 5 years).
If the reported facts fall within the scope of the Alert Line but, after investigation, no judicial or disciplinary action is finally launched, the Data shall be deleted within 2 months after the end of the investigation process (or archived after anonymization for 5 years) unless the Data is subject to litigation hold under applicable law in which case deletion is suspended until the resolution.
If a judicial or disciplinary action is initiated, the Data will be stored until the end of such action, including any potential periods for appeal and/or execution of the sanction (or of the settlement in case of amicable solution).
VII. Security
LVMH will provide an adequate level of protection for the Data and make sure that appropriate technical and organizational security measures are in place to protect the Data (including education and training of relevant personnel) against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.
In this respect, please note in particular that the BK GmbH's data center is a high-security data center, located within the EEA (Germany). All Data is encrypted and stored with multiple levels of password protection.
VIII. Users' rights
Users may request access to the Personal Data maintained about them, or obtain a copy of any Personal Data held about them in the Alert Line. Users may also request that Personal Data about them be corrected, amended, erased or that their processing be restricted. Users may also withdraw any consent they previously provided to LVMH or indicate their objection on legitimate grounds to the processing of their Personal Data at any time.
Users also have the right to lodge a complaint with the competent supervisory authority (CNIL) in case of any misuse of their Personal Data.
To exercise these rights, Users may contact LVMH at dpo.holding@lvmh.com; an answer will be provided to their request promptly upon receipt thereof.
IX. Changes to the Policy
LVMH reserves the right to modify this Policy at any time, in particular in order to adapt it to evolutions of the LVMH Alert Line or of applicable laws or regulations. In the event the Policy is modified, Users will be asked to accept these changes in order to continue using the LVMH Alert Line. In any case, before submitting any new Report, the User will be asked to accept the Policy. LVMH strongly recommends the User to read the Policy carefully each time he/she will submit a new Report.
X. Cookies
Communication between User's computer and the Alert Line takes place over an encrypted connection (SSL). The user's IP address will not be stored during his/her use of the Alert Line. However, to maintain the connection between the User's computer and the Alert Line, a cookie will be stored on the User's computer that will merely contain the session ID (a so-called “session cookie”). This cookie will only be valid until the end of the User's session and expire when the User closes his/her browser.
XI. Contact
If Users have any questions about the protection of Personal Data about them in the context of the Alert Line or about this Policy in general, they may contact LVMH by email at the following address dpo.holding@lvmh.com.
XII. Governing law
This Policy is governed by French law.