Privacy policy


1. Data Controller information

1.1 Business Name: LAKMÉ COSMETICS S.L.U. (“Lakmé” or “we”)

1.2 Postal address: c/Narcís Monturiol 27, 08960 Sant Just Desvern (Barcelona)

1.3 Tax Id Nº.: B-61208476

1.4 Telephone: +34 934 700 155

1.5 E-mail:

2. Origin and categories of data

2.1. We will process the data that you provide us through the “contact” form, as well as through other means related to the use or services offered on the Website. These data generally include the email address, the company and the free field for the message you want to send us. Remember that, in case of buying through our online store, we will process additional data as indicated in the corresponding privacy policy.

2.2. In addition to said data, we may process other personal data that you provide us or that are generated during our communications or provision of services.

23. On the other hand, we will also collect data through cookies for analytical and advertising purposes. You can find more information in our Cookies Policy 

2.4. Finally, please keep in mind that, by providing us with your data, you guarantee us the veracity and/or accuracy of such. Consequently, you will be responsible for the false or inaccurate statements that you make, as well as for the damages caused to Lakmé or to third parties as a result of such.


Provide the services

Provide you with the services you request (e.g., sale of a product) and/or respond to your requests for information.


Send you commercial communications and newsletters by digital means, including, for example, email or SMS. Note that you may object at any time by sending us an email to or by following the instructions contained in each communication.


Carry out analysis of aggregate data (not associable to any person) of navigation on our Website.

Behavioural target advertising and social networks

Show you advertising during browsing through the use of cookies based on your preferences, as well as based on the interactions you make on social networks.

Legal Base

Art. 6.1.(b) GDPR

Necessity to offer and provide the services or information that you request.

Art. 6.1.(a) GDPR

Consent for the installation and use of cookies as explained in the Cookies Policy 

Art. 21 LSSICE or Art. 6.1.(a) GDPR

If you are a client, we will rely on Art. 21 LSSICE to send you information by digital means about our services and news. If you are not a customer, we will only send you said information if you give us your consent or request to sign up for our newsletter.

Art. 6.1.(a) GDPR

Consent for the installation and use of cookies as explained in the Cookies Policy 

4. Data retention

4.1. We will keep your data while our client-supplier commercial relationship is in force to manage it correctly and send you commercial information of your interest. However, if we observe a prolonged inactivity time, we will also proceed to delete your data to the extent that the treatment is no longer adequate, relevant and necessary for the purposes intended for the treatment. This rule will apply unless you request us to delete your data.

4.2. Once the processing of your data is no longer adequate, pertinent and necessary for the purposes for which they were collected in the first place, we will keep your data duly blocked and only to attend the potential responsibilities, as required by the regulations.

4.3. Finally, we inform you that we will take all reasonable steps to ensure that your data is rectified or deleted when it is inaccurate.

5. Automated decisions

5.1. No, we will not make individual decisions based solely on automated processing that produces legal effects on you or significantly affects you in a similar way.

6. Recipients

6.1. As a general rule, we will not communicate your data to third parties. However, in certain cases we will need to communicate your data to:

  • Providers: Providers who require such access to provide us with their services will have access to your personal data, such as managers, IT or cloud or hosting providers (for example, ICM NETSYSTEMS 2005 S.L. or Google LLC), CRM providers, partners, logistics companies or postal services, telecommunications providers or payment gateways. These third parties will act as our (sub)processors and will have appropriate safeguards in place to protect your personal information including the corresponding treatment order contract in accordance with Art. 28 GDPR.
  • Others: We will share your personal data with third parties if required to do so by a regulation, by an administrative or judicial authority or for the purpose of public interest or order, such as to comply with money laundering regulations and fight against terrorism, fiscal obligations or towards Social Security.

6.2. Finally, please note that we may also share your information if we believe it is reasonably necessary to enforce the Website’s terms and policies or to protect our operations or Users. In addition, in the event of a corporate restructuring, merger, spin-off, or sale, we may transfer your personal information to the third party resulting from such transaction.

7. International transfers

7.1. We do not carry out international data transfers. However, as is common today, many IT providers have their servers outside of the European Economic Area (EEA). Therefore, it is possible that in the future some of our suppliers will be located outside the EEA. In this case, and only when it is strictly necessary to operate the Website and/or provide the services you request, we will make international transfers within the framework of the provision of services requested from said providers.

7.2. In any case, we anticipate that with all these providers we will sign as many documents as necessary to ensure that they offer adequate guarantees equivalent to those in the EU to carry out such international transfers.

8. Rights

8.1. What rights do you have?

As provided for in the General Data Protection Regulations (GDPR) and Spanish Law 3/2018 on the Protection of Personal Data and guarantee of digital rights, we inform you that you have the following rights:

  • Access: You have the right to access your data to find out what personal data concerning you we are processing.
  • Rectification and erasure: In certain circumstances, you have the right to rectify inaccurate personal data concerning you that are processed by us or even to request its erasure.
  • Restriction of processing: In certain circumstances, you will have the right to ask us to restrict the processing of your data, in which case we inform you that we will only keep them for the exercise or defence of claims. 
  • Portability: In certain circumstances, you will have the right to receive the personal data that concerns you and that you have provided us, in a structured, commonly used and machine-readable format, and to transmit it to another data controller.
  • Opposition: In certain circumstances and for reasons related to your particular situation, you will have the right to oppose to the processing of your data. In this case, we will stop processing them except for compelling legitimate reasons or for the exercise or defence of possible claims. At any time, you may oppose the receipt of commercial communications.

8.2. How can you exercise your rights?

You can exercise your rights at any time by contacting the Responsible Party (Lakmé) as indicated in Section 1 at, indicating “Privacy” in the subject line. In order to verify your identity, we may require you to send us certain additional information or documentation, such as a copy of your ID or similar identification document.

The exercise of these rights is free. However, please note that a fee may be charged when requests are unfounded, excessive or repetitive.

8.3. Do you have the right to withdraw your consent?

Yes, at any time you can withdraw your consent for the processing of your data for one, several or all of the purposes indicated above that are based on your consent to be processed. Be advised that, where appropriate, this could alter and even cause the termination of the provision of the services.

8.4. Do you have the right to submit a claim?

Yes, at any time you can submit a claim to the competent control authority according to your place of residence. You can consult the different control authorities by contacting us at For example, in Spain, the competent control authority is the Spanish Data Protection Agency (AEPD).

In any case, before initiating any claim, we ask you to contact us via email ( in order to try to resolve any discrepancy or controversy amicably.

8.5. When will we answer you?

We will respond to your requests as soon as possible and, in any case, within one month. If this is not the case, please excuse us and contact us again in order to assist you and correct any possible technical error that has prevented us from giving you a response on time.

9. Modification

9.1. Lakmé reserves the right to modify this Privacy Policy in accordance with the provisions of the Legal Notice

Last updated in August 2023.