MALAYSIA GENERAL PRIVACY POLICY

This Malaysia General Privacy Policy (“Privacy Policy”) applies to all personal data collected by Swarovski Malaysia Trading Sdn Bhd and their related corporations ("Swarovski"), including without limitation, by way of this Website, and explains how we handle personal data and comply with the requirements of applicable privacy laws.

This Privacy Policy applies in addition to (where applicable) the privacy policies specific to the Swarovski Crystal Society (“SCS”) or Swarovski Club programs.

If there is any inconsistency between any of the provisions in this Privacy Policy and the provisions of the privacy policies specific to the SCS or Swarovski Club programs respectively, the provisions of this Privacy Policy shall prevail.

Collecting your personal data

We collect personal data from customers (existing and prospective), suppliers, contractors, employees and prospective employees, and consumers and other individuals for various business and other purposes further listed below. In this section, we explain the types of personal data which we usually collect as well as how we collect this information.

The type of information Swarovski may collect from you will depend on the circumstances in which that information is collected. It may include, for example, your contact details (such as name, email address, address, phone number), date of birth, gender and where necessary to effect a purchase, exchange, return or similar transaction, your credit card or banking details.

In particular, Swarovski may collect personal data:

• when you contact us or our authorized retailers with queries or issues;
• when you participate in our promotions or competitions;
• when you fill in questionnaires, surveys or contact forms;
• when you register or provide your details with or to us or our authorized retailers;
• when you submit information through this Website (such as when you set up a user account, retrieve log-in information, make online orders or purchases or enter into other online transactions) or our social media channels;
• when you join the SCS, Swarovski Club (or similar membership groups); or
• when you use this Website, in which case our system may automatically collect information relating to your visit to this Website, such as your IP address.

If you do not provide Swarovski with all requested personal data, we may be unable to assist you or provide you with our products and/or services, you may not be able to participate in our promotions or competitions or you may be unable to join the SCS, Swarovski Club (or similar membership groups).

Where practicable, we will collect personal data directly from you.

Our use of cookies

Cookies are pieces of information that a website transfers to your computer's hard disk for record keeping purposes. Most web browsers are set to accept cookies. Swarovski uses cookies to make your use of this Website, resources and services as convenient as possible. Cookies in and of themselves do not personally identify users, although they do identify a user's browser. Cookies are useful to estimate our number of users and determine overall traffic patterns through this Website.

If you do not wish to receive any cookies, you may set your browser to refuse cookies, but this may mean you will not be able to take full advantage of the services and resources on this Website.

Use, processing and disclosure of your personal data

We will only use, process and disclose your personal data in accordance with applicable privacy laws, this Privacy Policy and (where applicable) the privacy policies specific to the SCS or Swarovski Club programs (collectively, our “Privacy Policies”).

Our purposes in collecting, holding, using and disclosing information about you are to:

• develop, enhance, market and provide you with our products and/or services (including repairs and returns);
• respond to your queries if you are seeking information about our products or services;
• communicate with you about our products and services;
• conduct promotions and competitions;
• conduct market research and analysis;
• process and assess employment applications;
• enforce agreements between you and us;
• keep you informed about our activities, products and services;
• allow you to join and participate in the SCS, Swarovski Club and other similar Swarovski-related memberships;
• comply with legislative and regulatory requirements;
• operate our business efficiently; and
• create, develop, operate and deliver and improve our products and services.

Swarovski may also use and/or process aggregated, anonymous data about its customers and/or website users as a group, for Swarovski's business purposes.

In carrying out our business, it may be necessary to share information about you with and between our related bodies corporate, our authorized retailers and organizations that provide services to us. We would not otherwise disclose personal data to another organization unless:

• the disclosure is for one of the purposes described in or otherwise permitted by our Privacy Policies;
• the disclosure is required or permitted by law;
• we believe the disclosure is necessary to provide you with products or services which you have requested;
• we believe the disclosure is necessary to protect the rights, property or personal safety of another person or Swarovski; or
• the assets and operations of Swarovski's business are transferred to a third party.

Retailers and service providers

Like most large organizations, we use a range of authorized retailers to sell and service our products and service providers to help us maximize the quality and efficiency of our services and our business operations. This means that individuals and organizations outside of our organization, such as third party retailers of Swarovski products, third parties that operate the personal data on behalf of and in accordance with Swarovski’s instructions (commissioned data processing) and third parties which Swarovski commissions for repairs or delivery of our products, will sometimes have access to personal data held by us and may use and/or process it on behalf of us. We require our service providers to adhere to strict privacy guidelines and not to use and/or process the information for any unauthorized purposes.

Using your personal data for marketing

We may use and/or process personal data you have provided to us, including your email address, to provide you with information in relation to new or updated products or services or special offers, promotions or competitions in which you may be interested. We will only do so in accordance with applicable laws or with your prior consent.

If at any time you do not wish to receive such information from us, you may ask us to remove your name from our list by contacting us using our contact details below. Alternatively, if we send you such information by email, you can use the unsubscribe function in the email to inform us that you do not wish to receive such information from us by email. In either case, please allow 5 business days for your request to be processed.

Disclosing and transferring your personal data overseas

The central customer database, in which all data described in the Privacy Policy is saved, is operated on behalf of and in accordance with Swarovski’s instructions by our related body corporate, D. Swarovski KG, Swarovski strasse 30, 6112 Wattens, Austria. Swarovski ensures compliance with the applicable privacy laws.

In order to deliver products and services to you and to improve our products and services, we may sometimes disclose and/or transfer your personal data to another company within or related to the Swarovski group (including but not limited to those located in Switzerland, the United States, Liechtenstein and Austria), affiliates and service providers.

Swarovski will not otherwise use, process or disclose or transfer any information about you without your consent, unless:

• the use, processing or disclosure is for one of the purposes described in or otherwise permitted by our Privacy Policies;
• the use, processing or disclosure is required or permitted by law;
• we believe it necessary to provide you with products or services which you have requested;
• we believe it necessary to protect the rights, property or personal safety of another person or Swarovski; or
• the assets and operations of Swarovski's business are transferred to a third party.

Access and accuracy

Upon request, we will provide you with access to personal data that Swarovski holds about you, except in the limited circumstances in which it is permitted for us to withhold this information. To request access to your personal data, please contact us using our contact information below.

If at any time you wish to change personal data that is inaccurate, out of date or incomplete, please contact us using our contact information below and we will amend your record upon verification of your identity.

If you wish to have your personal data deleted, please let us know in the same manner as referred to above and we will take all reasonable steps to delete it unless we need to keep it for legal, auditing or internal risk reasons.

Security and storage of your personal data

Swarovski will protect your personal data in its possession or under its control by making reasonable security arrangements to prevent loss, misuse, unauthorized or accidental access, collection, use, disclosure, copying, modification, disposal or similar risks, alteration or destruction . When we no longer need to use your information, we will take steps to properly de-identify or destroy it.

Unfortunately, however, no data transmission over the internet can be guaranteed secure. As a result, while we strive to protect your personal data, we cannot guarantee the security of any information you transmit to us through this Website and you use this Website at your own risk.

Your personal data is stored on secure servers that are protected in controlled facilities. We require our employees and data processors to respect the confidentiality of any personal data held by Swarovski.

Usernames and passwords

You can play an important role in keeping your personal data secure by maintaining the confidentiality of any password and accounts used on this Website. Please notify Swarovski immediately if there is any unauthorized use of your account by any other Internet user or any other breach of security.

You are responsible for the security of your user name and password (or other log-in information) and you take responsibility to ensure the confidentiality of this information.

Links to other websites

Swarovski provides access to third party websites through this Website. These linked websites are not under the control of Swarovski, and we are not responsible for the content or the conduct of the organization accessed via a link on this Website. Before disclosing your personal data on any website, we suggest you examine the terms and conditions and privacy policy of that website.

What to do if you have a problem, question or complaint

If you have any further queries relating to our Privacy Policies, or you have a problem or complaint, please contact us at:

Contact person: Data Protection Team Email: SMY.DPO@swarovski.com Contact number: 012-769 6390

In most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavors to respond to you in writing within 21 days of receiving the written complaint.

Future changes

From time to time, Swarovski's policies will be reviewed and may be revised. Whilst Swarovski seeks to minimize changes to its policies, Swarovski reserves the right to change its Privacy Policies at any time by posting an updated version on this Website. Please therefore keep checking these policies to ensure you are aware of the current terms. If at any point Swarovski decides to use and/or process personal data in a manner materially different from that stated at the time it was collected we will notify you by email or via a prominent notice on this Website, and where necessary we will seek your prior consent.

Where this Privacy Policy is drafted is another language and there is any inconsistency between the provisions in the two language versions, the provisions in the English version of this Privacy Policy shall prevail.

SWAROVSKI CRYSTAL SOCIETY (SCS) The following provisions shall be applicable for the processing of data by SWAROVSKI in connection with the customer loyalty program Swarovski Crystal Society (SCS). a. Responsible for the Personal Data (Controller) The PERSONAL DATA in connection with the membership at SCS is processed by two joint controllers, in particular (i) the controller of the respective local Swarovski company which issues the membership according to the application form and which receives the membership fees, and (ii) the controller of Swarovski Aktiengesellschaft, Dröschistrasse 15, 9495 Triesen, Liechtenstein. The collected personal data will be shared with other companies of the Swarovski Group of companies and certain third parties as described in this Privacy Policy. b. Processing of Personal Data and Source Swarovski collects and retains the personal obligatory data provided on the SCS application form (including but not necessarily limited to the title, name, contact details, birth date, pre-existing SCS membership number, language preference, order information, as well as the name, contact details and SCS membership number of the gift giver, where applicable) by the SCS Member him or herself or by the person that buys the SCS Membership as a gift and provides Swarovski with the PERSONAL DATA of the SCS Member (“Form Data”). In addition, Swarovski also collects any Personal Data provided voluntarily by the customer in the online member area or when interacting with us: styles/interests (e.g. in Jewellery and Accessories, Home, Figures and Collectables and/or Watches; Classic style), social media accounts (and related information collected through social log-in), gender, IP address and online identifiers. Swarovski receives such PERSONAL DATA from the points of sale where the membership is ordered and paid. It assigns to each new SCS Member, a unique membership number, tracks the membership start and renewal dates, service and mailing options chosen by the SCS Member, services provided (including gifts sent), and, as the case may be, further data about the SCS Member's use of the Swarovski Group's online offerings and mailings (e.g., newsletter open rate, click rate, visited online web pages, social media interactions), interaction variables (such as click rates, time of interaction or social media interaction). Swarovski may also process payment information, directly or through a third party, where necessary for the payment of SCS Membership fees. Additionally, Swarovski records the purchase history of each SCS Member, in the form of items purchased (product designation, price) and place and time of purchase. The purchase history is recorded only if the SCS Membership number is communicated at the checkout for purchases in stores offering the SCS program. In the online store, a registered customer must activate their account online by setting up an online account. A registered customer’s purchase history is recorded if the account number is quoted when making a purchase or the registered customer makes a purchase when logged into their online account. Swarovski also collects and saves any vouchers sent to the SCS Member and, as the case may be, further data about the SCS member’s use of the Swarovski Group's online offerings and mailings (e.g., newsletter open rate, click rate, visited online web pages, social media interaction). Where Swarovski believes that two different SCS Memberships belong to the same individual, or where a valid request is received, Swarovski may merge them.
c. Purpose of processing SWAROVSKI collects and processes the personal data of members of the customer loyalty program in particular also for the following purposes:

• administration of SCS memberships;
• operation of SCS, namely providing of advantages and awarding special conditions, participating in surveys, requiring feedback and act in social media,
• Personalization and unification of customer experience across channels (Swarovski stores, swarovski.com, e-mail communication, social media) 
• Provision of relevant information and a personalized marketing content 
• Non-marketing communication including but not limited to: changes related to our Privacy Policy, General Terms and Conditions and/or Terms of Use; general changes to product and service offering; account verification; password reset; or an information related to incidents that could affect our services
• Provision of personalized offers, assistance and advice regarding products and services
• Provision of invitations to special events and promotions reserved for registered customers
• Participation in surveys, requiring customer feedback across channels (Swarovski stores, swarovski.com, e-mail, social media)

In participating stores, the SCS membership allows SCS members to take advantage of an extended customer advice in which, upon presentation of the account number, the store employee can call up the registered customer’s data and provide the registered customer with additional sales advice based on his or her past purchases, style/interests selected or wish list. On presentation of the SCS membership number, e-mail address or the registered customer’s name and date of birth (or another unique authentication attribute), the relevant store employee or customer service representative has access to the relevant registered customer’s saved purchase history data and wish list. 
Swarovski may also use personal data of SCS members to propose them personalized assistance and advice and to be in contact with a dedicated Crystal Expert with any requests they may have via phone, email or in any other way chosen by Swarovski. Members can decide if they wish to benefit from such services. For the provision of this personalized information interesting for visitors or loyalty program members, Swarovski may perform profiling activities. Profiling is defined as any kind of automated processing of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict elements as preferences, interests or likely behaviour of that natural person. By providing certain information to Swarovski, such as a telephone number, loyalty program members are consenting to and authorizing Swarovski and its affiliates, to contact them from time to time by telephone at the telephone number provided (even if their phone number(s) may be on a Do-Not-Call list or similar list) to receive personalized marketing messages. This consent can be withdrawn at any time by contacting us using our contact information below.
The personal data collected is used by Swarovski to administer and manage the Membership (including also for accounting and payment purposes), to provide the Member with the benefits and other services that come with the Membership (the legal basis for this is the Membership) and to provide the SCS Member with commercial communications (such as newsletters, product information, services and exclusive offers of the Swarovski Group) by e-mail, mail, mobile messaging or a phone call based on the contact information provided by the Member (for which Swarovski relies on the SCS Member's consent). In all these cases, SWAROVSKI may personalize the information sent to the Member so that the Member particularly receives, where possible, information which SWAROVSKI considers interesting for the Member. For this purpose, SWAROVSKI analyses the Form Data (and in particular, information as to age, gender, interests and preferences) and other information that can be gleaned from the purchase history, or inferred from interaction data, or has been given to SWAROVSKI by the SCS Member voluntarily at any later time. Furthermore, SWAROVSKI may use the personal data for compliance with its legal obligations and, where it has a legitimate interest, for statistical and research purposes, including for better understanding of SCS Members, consumer and market analysis, improvements to the SCS Program and the development of new products and services. Non-marketing communication may still be sent if you have opted-out from certain marketing communication as this may be necessary for us to perform a contract with you, to comply with legal obligations or security requirements. Also, we will send you a personal note on your birthday, if you share your date of birth with us.
d. Disclosure of Personal Data In the course of processing personal data in connection with SCS, SWAROVSKI may namely disclose data to the following categories of recipients:

• PARTNERS, including business, marketing and promotion partners (including social media partners) and all participating retail shops or other authorized specialists dealers, irrespective of whether the company is run by SWAROVSKI or another sales or cooperation partner; whereas these stores may be located within any country worldwide and they may use data received from SWAROVSKI only for the purpose of operating SCS, including personalized offers to and communication with Members on behalf of SWAROVSKI;
• to a SWAROVSKI company to whom the processing of data (operation of the database) regarding SCS has been outsourced in technical respect (processors). Each recipient may be located in a country without an adequate level of data protection. If that is the case, SWAROVSKI will ensure an adequate level of protection. e. Rights of Data Subjects SCS Members and membership gift givers are entitled at any time to ask SWAROVSKI for information relating to their saved personal data, and other information as provided for by applicable data protection law. They also have the right to ask to amend, limit or delete their personal information, or ask for a copy of the personal information.  Swarovski registered customers may also revoke any consent they have provided to Swarovski (e.g. to be used for promotional, advertising purposes and receive newsletters and other commercial communications) for the future.  If you want to exercise any of your rights regarding newsletter subscriptions, data access or data deletion, please do not hesitate to contact our Customer Care team at Customer_Service_MY@Swarovski.com, who will be happy to answer any questions you may have. Please note that we may require you to verify your identity before allowing you to access your personal information.

f. Data Retention Personal Data will be held and used for the duration of the Membership; thereafter, it will be retained as long as necessary for the aforementioned purposes, but not for more than five years, unless required for legal reasons. The purchase history is generally recorded for five years. As exception to this rule, the purchase history on SCS exclusive products will be kept during the entire duration of the Membership in order to recognize member life-time value to the Society. Should a SCS Member not wish to have his or her SCS exclusive product history stored above 5 years, he/she can request deletion by contacting informing of his/her explicit wish to have this history deleted Further information regarding SCS can be found in the General Terms and Conditions of the customer loyalty program on www.swarovski.com.
g. Updates and Additional Information For updates to the information provided in this Data Privacy Policy and, as the case may be, further country-specific mandatory information and mandatory information based on the EU Data Protection Regulation, and for any uncertainties regarding the transfer of personal information overseas, the storage, security of your personal information and other privacy issues that are not explicitly stipulated under this Data Privacy Policy, please refer to the Privacy Policy on www.swarovski.com where applicable.