Privacy Policy

Who we are

Data Controller: Olamex Group, operating as a micro-enterprise under French law (auto-entrepreneur / micro-entrepreneur), founded and led by Sylvia Olam, Paris, Île-de-France, France.

Olamex Group is the parent brand operating across five trading brands: Olam Experiences, Nemas Couture, Olams Beauty, Sylvia Olam (personal brand), and Olamex Marketing Agency. This policy applies to all activities carried out under these brands via the website olamexgroup.com.

For all data protection enquiries, contact us at: hello@olamexgroup.com

What we collect

We collect the minimum personal data necessary to provide our services. The data we collect depends on how you interact with our website and brands.

• Name and email address — collected when you register for an experience, submit an enquiry via our contact form, or sign up to our newsletter.
• Payment information — collected by Stripe when you complete a booking payment. We never store your card details directly.
• Message content — any information you choose to include in your enquiry or message through our contact form.
• UGC content permissions — if you agree to allow us to share content created during your experience, we record your written consent.

• Usage data — collected by Squarespace (our website hosting provider) including pages visited, time on site, and referral source.
• Device and browser data — IP address, browser type, operating system, and screen resolution, collected via Squarespace analytics.
• Cookie data — see Section 6 (Cookies) for full details.

• We do not collect sensitive personal data such as racial or ethnic origin, health data, or financial information beyond what Stripe requires for payment processing.
• We do not knowingly collect data from children under 16 without verified parental consent.

How we use your data

We will never sell your personal data to third parties, use it for automated decision-making or profiling, or use it for any purpose other than those listed above without your explicit consent.

Legal basis (GDPR)

As a Paris-based company serving clients across the EU and internationally, we process your personal data in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679). Our legal bases for processing are:

• Contract performance (Art. 6(1)(b)) — processing necessary to fulfil your booking, confirm your experience, or provide a service you have requested.
• Consent (Art. 6(1)(a)) — where you have explicitly opted in, such as subscribing to our newsletter. You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)) — for website analytics, responding to enquiries, and improving our services, where these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)) — where we are required by French or EU law to process certain data.

Third-party services

To operate olamexgroup.com and provide our services, we work with a small number of trusted third-party providers. Each one has its own privacy policy and data processing terms.

Cookies & tracking

Our website uses cookies — small text files stored on your device — to make the site function correctly and to understand how visitors use it. In accordance with GDPR and the EU ePrivacy Directive, we ask for your consent before placing non-essential cookies.

When you first visit our site, you will see a cookie consent banner (shown below). You can accept or decline non-essential cookies at any time, and update your preferences by contacting us at hello@olamexgroup.com.

International data transfers

Olamex Group is based in Paris, France, within the European Economic Area (EEA). Some of our third-party service providers — including Squarespace and Stripe — are based in the United States.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• Squarespace complies with the EU-US Data Privacy Framework, providing an adequate level of protection for data transferred to the US.
• Stripe transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46.
• All other third-party providers used by Olamex Group either operate within the EEA or have adequate data transfer safeguards in place.

Data retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law.

When data is no longer needed, it is securely deleted or anonymised.

Your rights

Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at hello@olamexgroup.com. We will respond within 30 days.

Children's privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without verified parental or guardian consent.

If you are a parent or guardian and believe your child has submitted personal data to us, please contact us immediately at hello@olamexgroup.com and we will delete the relevant data promptly.

How we protect your data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction.

• Our website is hosted by Squarespace, which maintains SOC 2 Type II certification and enterprise-grade security infrastructure.
• All data transmitted between your browser and our website is encrypted via HTTPS/SSL.
• Payment processing is handled entirely by Stripe, which is PCI-DSS Level 1 certified — the highest level of payment security. We never see or store your card details.
• Access to any data submitted through our forms is restricted to Sylvia Olam and authorised Olamex Group personnel only.
• In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority (CNIL) within 72 hours and affected individuals without undue delay.

Policy changes

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practices. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of our website following any changes constitutes your acknowledgement of the updated policy.

Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us. We aim to respond to all data-related requests within 30 days.