Data privacy is of high importance for H&M Group and we want to be open and transparent with our processing of your personal data.

We therefore have a policy setting out how your personal data will be processed and protected.

Who is responsible for your personal data?

The Swedish company, H & M Hennes & Mauritz GBC AB is the controller and responsible for the personal data processing activities operating under the brand Creator Studio hereinafter referred to as “We” or “Us”.

H & M Hennes & Mauritz GBC AB Mäster Samuelsgatan 46 106 38 Stockholm Sweden

Companies register: Bolagsverket/Swedish Companies Registration Office Company registration number: 556070-1715 Authorised representative: Helena Helmersson Swedish VAT registration number: VAT NO. SE556070171501

What are your rights?

Right to access:

You have the right to request information about the personal data we hold on you at any time. Please contact Customer Service and we will provide you with your personal data via e-mail.

Right to portability:

You have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us, not such data we have obtained from third parties (if any).

Right to rectification:

You have the right to request rectification of your personal data if the information is incorrect, for example rectification of your contact details, including the right to have incomplete personal data completed.

Right to erasure:

You have the right to have your personal data erased unless:

you have an ongoing matter with Customer service

you have an open order which has not yet been shipped or partially shipped

you have an unsettled debt with us, regardless of the payment method

if you are suspected or have misused our services within the last four years

your debt has been sold to a third party within the last three years or one year for deceased customers

if you have made any purchase, we will keep your personal data in connection to your transaction for book-keeping purposes

Right to object:

You have the right to object to processing based on our or third parties’ legitimate interest and if you believe our processing is not lawful. Upon your objection, we will cease the processing your personal data unless we show you that our or third parties’ legitimate interests overrides your interest and rights or due to legal claims.

Right to restriction of processing:

You have the right to request restriction, meaning that you are entitled to restrict our processing of your personal data under the following circumstances.

where you have contested the accuracy of the personal information being processed by us

where our processing is unlawful, and you have opposed the erasure of your personal data and requests restriction instead; or

where we no longer need your personal information, but you have opposed the erasure because you need it to establish, exercise or defend a legal claim.

How do you exercise your rights?

Making a request

We take data protection very seriously and therefore we have dedicated customer service personnel to handle your requests in relation to your rights stated above. You make a request for access, portability, rectification, erasure or objection by contacting Customer service.

Data Protection Officer:

We have appointed a Data Protection Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Data Protection Officer at dataprotection.se@hm.com and write DPO as subject matter.

Right to complain with a supervisory authority:

If you consider us to process your personal data in an incorrect way, please contact us at dataprotection.se@hm.com. You also have the right to raise a complaint to a supervisory authority.

When and why do we process your data?

When shopping from us

Whenever you shop from us, we use your personal data to provide you with the products and services ordered from us. Specifically, we use your personal data to be able to process your purchase order and payment, to have your order produced and delivered, handle returns and warranty claims.

Before you place a purchase order, we use your personal data to verify your identity and your capacity to enter into a contract. We also process your personaldata to verify that financial information you provide us is correct and to prevent fraud and other malicious activities against us and our trusted partners.

When you contact Customer service

Whenever you contact our Customer service, we will ask you to submit personal data to be able to manage your queries, to handle complaints and warranty matters and to provide you with technical support. We do this through e-mail, chat, telephone and through social media. We may also reach out to you by e-mailing you if there is a problem with your order.

Business relations

We will use your personal data to evaluate potential business partners and manage existing business relations including communication, procurement, contract signing and financial transactions.

Development and improvement

We may use your personal data to develop and improve our products, services, systems, and supply chain. This includes analyses to make our services more user-friendly.

We will only use aggregated data on pseudonymized level for developing and improvement purposes.

What are the legal grounds to process your personal data?

We are not allowed to collect and process your personal data without a proper legal justification.

When making products and services available to you we will process your personal data to the extent necessary to conclude a contract with you and to fulfil any obligations derived from that contract.

It is in our legitimate interest as a business to give you an outstanding customer experience when engaging with our Customer service.

It’s also our legitimate interest to manage business relations and provide business partners access to our systems.

As a business we must comply with different laws and regulations. In some case we must process your personal data to comply with such laws and regulations, for example, compliance with applicable tax and accounting legislation.

What types of personal data do we process?

We only use personal data that is submitted by yourself, such as creating and developing your order, contact information, billing and delivery address and order and delivery information automatically generated when placing a purchase order. Only in case of fraud prevention we use data in public records.

We never ask you to provide more data than necessary.

How long do we process and store your data?

We will not process your data more than necessary to fulfill your requests and to ensure a secure transaction. We will save your personal data, including shopping history for a maximum of 6 months.

For tax and accounting reasons we will save relevant personal data for 7 years.

Who has access to your data?

Personal data provided to us is shared with trusted third parties assisting us in carrying out certain tasks or to provide a requested service. In particular, the e-commerce platform you are currently using, the printing suppliers as well as with carriers making sure you get the right products on time are all trusted parties to us. H&M is fully responsible for its suppliers.

We never pass on, sell or swap your data for marketing purposes to third parties except as explicitly stated in this Privacy Notice.

Where do we store your data?

Cookies

What is a cookie?

A cookie is a small text file that is downloaded onto your device such as computer or smartphone when you access our website. When we say “cookie” we mean cookies and similar online tracing technologies. This covers any means we use to store information, or access information stored on your device, including:

first- and third-party cookies

tracking pixels and plug-ins, including technologies those from third parties and other tracing technologies.

We use cookies in order to make our website work, or work more efficiently, as well as to provide information to us and to any third-party provider about your past, present and future activities on the internet, including your website browsing history, clicks and “likes”.

All cookies have an owner which tells you who the cookie belongs to. The owner is the domain specified in the cookie. Whenever you visit our website, we place cookies onto your device for different reasons. Such cookies are called “first-party” cookies, whereas cookies set by a different owner such as social media platforms or ad network/ad tech providers, are called “third-party” cookies.

Below you will find more detailed information about our cookies and the reason for using them.

What types of cookies do we use and why?

We group cookies into four categories.

Strictly necessary cookies

Some cookies are strictly necessary for you to be able to experience the full functionality of our site and for us to deliver upon our promises. For example, these cookies allow you to use the website and log-in to your account as intended. Without these cookies, some parts of our site and services just won’t work as they should. We also use cookies to direct you to the right website based on geography and language and to detect and prevent security threats and malicious behaviour.

Performance cookies

Performance cookies tell us about how you use the site and they help us to make it better. For example, these cookies count the number of visitors to our website and see how visitors move around when they are using it. This helps us to improve the way our site works, for example, by ensuring that users find what they are looking for easily.

Functional cookies

Functional cookies allow our site to remember your preferences, helping you to customize your content on our website. This type of cookie enables us to highlight products and services we believe is of interest and relevance to you. This way we can remember you when you return to our site and to give you best possible user experience.

Marketing cookies

Marketing cookies are a key part of how we deliver marketing on our sites. Among other uses, cookies allow us to show more relevant advertising by serving you information, offers and promos that are based on your browsing patterns and the way you have interacted with our sites and apps. We can then present to you a web site content that is more relevant to you, meeting your interests and preferences. Cookies enables limiting the number of times an ad is shown. Marketing cookies can be used to track the effectiveness of our ad campaigns on third party websites.

What is the legal ground to use cookies?

Who has access to cookie information?

Information obtained from you through cookies is shared within the H&M Group. Information obtained from third party cookies is also available to the third-party provider placing the cookie on our site. We will not share first-party cookie information with third parties nor sell swap or otherwise disclose such information with anyone outside the H&M Group.

How long are cookies stored in your browser or on your device?

Cookies can be stored for varying lengths of time on your browser or device.

Persistent cookies

Persistent cookies (or permanent cookies) will be stored in one of your browser's subfolders until you delete them manually or your browser deletes them based on the duration period contained within the cookie's file. Their duration depends on the date of expiry written in them.

Session cookies

Session cookies are immediately deleted when you close your browser. When you restart your browser and go back to the site that created the cookie, the website will not recognize you.

Other tracing technologies

Information gathered through other tracing technologies such as tags and pixels are saved for 24 months.

How to manage your cookies?

Managing browser settings

You can manage your cookies from your computer or mobile device using web browser. All commercial web browsers are featured with cookie management functionality. Please check your web browser to find out more how to delete or disable cookies etc. You can easily stop your browser from accepting cookies altogether by configuring your browser’s cookie settings.

If you choose to disable cookies in your web browser, you will not be able to take advantage of all our features.

Opting-out from social media platforms, ad network/ad tech providers

Please follow the link to learn more about how to opt-out of the cookies provided by some of our partners here:

Facebook Pixels

https://www.facebook.com/help/568137493302217

Google AdWords

https://support.google.com/ads/answer/2662922?hl=en-GB

Google Analytics

https://tools.google.com/dlpage/gaoptout/

Google DoubleClick

https://adssettings.google.com/authenticated?hl=en

Twitter

https://help.twitter.com/en/safety-and-security/privacy-controls-for-tailored-ads

California privacy rights

This part applies for visitors, users, and others who reside in the State of California. To the extent any provision in this California Privacy Policy conflicts with a provision of the Privacy Notice, the California Privacy Policy shall govern with respect to visitors, users, and others who reside in the State of California.

Collection of Personal Information

We may collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). In particular, we may collect the following categories of personal information:

A. Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.

B. Categories of personal information described in Cal. Civ. Code § 1798.80(e), such as name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information.

C. Characteristics of protected classifications under California or federal law, such as age, citizenship, and sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions).

D. Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

E. Biometric information, as defined in Cal. Civ. Code § 1798.40(b).F. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.

G. Geolocation data.

H. Audio, electronic, visual, thermal, olfactory, or similar information.

I. Inferences drawn from other personal information to create a profile about a consumer reflecting a consumer’s preferences, characteristics, and trends.

Personal information does not include: publicly available information lawfully made available from government records, deidentified or aggregated consumer information, or information excluded from the California Consumer Privacy Act.

Use of Personal Information:

We may use or disclose the personal information collected for one or more of the following business or commercial purposes:

To fulfill or meet the reason for which the information is provided. For example, to create your personal account or to process your orders.

To provide you with information, products, or services that you request from us, including answering your queries and to notify winners in promotions.

To provide you with phone calls, text message notifications, email alerts, and other notices concerning our products or services. For example, to notify you of delivery status, to be able to send you relevant marketing offers and information such as newsletters and our catalogues, to contact you in the event of a problem with delivery of your items, and to inform you of new or changed services.

To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection and managing your account by carrying our credit checks.

To be able to analyze your personal data to provide you with relevant marketing offers and information.

To be able to validate that you are of legal age for shopping online.

To improve our website.

Testing, research, analysis, and product and service development.

As necessary or appropriate to protect the rights, property, or safety of us, our employees, our customers, or others.

To respond to law enforcement requests and as required by applicable law, court order, or government regulations.

As described to you when collecting your personal information.

Sale of Personal Information:

We do not, and will not, sell your personal information.

Rights of California Residents:

California residents have the following rights:

1. Right to Know About Personal Information Collected, Disclosed, or Sold General Information

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (instructions and description below), we will disclose to you:

The categories of personal information we collected about you;

The categories of sources for the personal information we collected about you;

Our business or commercial purpose for collecting or selling that personal information;

The categories of third parties with whom we share that personal information;

The specific pieces of personal information we collected about you; and/or

If we sold or disclosed your personal information for a business purpose, including lists of sales, identifying the categories of personal information that each category of recipient purchased or obtained.

We may have collected the following categories of personal information from consumers within the last twelve (12) months:

A. Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.

B. Categories of personal information described in Cal. Civ. Code § 1798.80(e), such as name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information.

C. Characteristics of protected classifications under California or federal law, such as age, race, color, ancestry, national origin, citizenship, marital status, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information.

D. Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

E. Biometric information.

F. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.

G. Geolocation data.

H. Audio, electronic, visual, thermal, olfactory, or similar information.

I. Inferences drawn from other personal information to create a profile about a consumer reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We have obtained the categories of personal information listed above from the following categories of sources:

Directly from you, the consumer;

Indirectly from third parties and service providers, including partners and affiliates;

Directly and indirectly from our website.

We collected the categories of personal information listed above for the following business or commercial purposes:

To fulfill or meet the reason for which the information is provided. For example, to create your personal account at hm.com or to process your orders;

To provide you with information, products, or services that you request from us, including answering your queries and to notify winners in promotions;

To provide you with phone calls, text message notifications, email alerts, and other notices concerning our products or services. For example, to notify you of delivery status, to be able to send you relevant marketing offers and information such as newsletters and our catalogues, to contact you in the event of a problem with delivery of your items, and to inform you of new or changed services;

To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection and managing your account by carrying our credit checks;

To be able to analyze your personal data to provide you with relevant marketing offers and information;

To be able to validate that you are of legal age for shopping online;

To improve our website;

Testing, research, analysis, and product and service development;

As necessary or appropriate to protect the rights, property, or safety of us, our employees, our customers, or others;

To respond to law enforcement requests and as required by applicable law, court order, or government regulations; and/or

As described to you when collecting your personal information.

We shared the categories of personal information listed above with the following categories of third parties:

Affiliates, including H&M USA;

Service providers;

Third parties to which consumers authorized us to disclose personal information in connection with products or services provided to consumers.

2. Right to Request Deletion of Personal Information

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (instructions and description below), we will delete, and direct our service providers to delete, your personal information from our records, unless an exception applies.

We may deny your request to delete your personal information if retaining the information is necessary for us or our service providers to:

Complete the transaction for which we collected the personal information, fulfill the terms of a written warranty or product recall in accordance with federal law, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract with you;

Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;

Debug or identify and repair errors that impair existing intended functionality;

Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law;

Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546, et seq.;

Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent;

Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;

Comply with a legal obligation; and/or

Make other internal and lawful uses of the personal information that are compatible with the context in which you provided it.

3. To exercise your right to know about, access, or delete personal information, please submit a verifiable consumer request to us by either:

Calling us at: 855-HNM-SHOP [855-466-7467 (Toll-free)]

Emailing us at: dataprotection.us@hm.com

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal information. You or your authorized agent may only make a verifiable consumer request for access or data portability twice within a 12-month period.

Your verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information, or an authorized representative;

Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

4. Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under the California Consumer Protection Act. Unless permitted by the California Consumer Privacy Act, we will not:

Deny you goods or services;

Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

Provide you a different level or quality of goods or services; or

Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

California Shine the Light Law:

California Civil Code Section 1798.83 permits our visitors who are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact Customer Service.

Online Tracking:

Please note that our Sites may not support “Do Not Track” browser settings and may not currently participate in any “Do Not Track” frameworks that would allow us to respond to signals or other mechanisms from you regarding the collection of your personal or non-personally identifiable information.

Last Updated: December 2019

Updates to our Privacy Notice

We may need to update our Privacy Notice. The latest version of the Privacy Notice is always available on our website. If practicable possible we will communicate any material changes that affects you by e-mail.