Creator studio
Privacy notice
Our commitment to data protection and privacy
Protecting personal data and your privacy is of greatest concern for Creator Studio. This Privacy Notice intends to establish a clear, concise, and transparent communication on the collection, use, processing, storing etc. of personal data related to customers and external partners of Creator Studio.
“Customer” means former, current and potential customer or user of a product or service offered by Creator Studio or by any of our business partners.
“External partner” means any former, current, and potential business partner, agent, supplier, sub-contractor, network, or ecosystem, visitor (to our premises or website) or other stakeholder with whom we engage with.
Creator Studio is a brand within the H&M Group. The H&M Group consists of company affiliates of H & M Hennes & Mauritz AB.
Principles
Creator Studio manifests its commitment to privacy and data protection by embracing the following principles.
• Creator Studio uses personal data lawfully, fairly, correctly and in a transparent manner.
• Creator Studio collects no more personal data than necessary, and only for a legitimate purpose.
• Creator Studio retains no more data than necessary or for a longer period than needed.
• Creator Studio protects personal data with appropriate security measures.
Who is responsible for processing of your personal data?
The Swedish company, H & M Hennes & Mauritz GBC AB (Reg no: 556070-1715), Mäster Samuelsgatan 46, 106 38 Stockholm, Sweden is responsible for the processing of personal data within the scope of this Privacy Notice.
The named H&M Group controller above are throughout this Privacy Notice referred to as “Creator Studio”, “we” or “us”.
Where do we process your data?
The personal data that we collect from you is generally stored within a country of the European Union or the European Economic Area (“EU/EEA”) but may also, whenever necessary, be transferred to and processed in a country outside of the EU/EEA. Any such transfer of your personal data will be carried out in compliance with applicable laws and without undermining your statutory rights.
From time to time, we may transfer personal data from the EU/EEA to a third country not being approved by European commission as a safe country for such transfer (adequacy decision). Whenever applicable Creator Studio will use Standard Contractual Clauses to ensure a similar level of protection as granted within the EU/EEA or other lawful grounds for transfer.
Who has access to your data?
Your personal data is available and accessible only by those who need the data to accomplish the intended processing purpose. To the extent necessary, your personal data may be shared between the companies and brands of within the H&M Group, with suppliers and sub-contractors (processors and sub-processors) carrying out certain tasks on our behalf and with independent third parties. Creator Studio is always fully responsible for its suppliers.
We may from time to time also share personal data with independent third parties, such as electronic communication providers, banks, and postal services. Please be aware that many of these recipients have an independent right or obligation to process your personal data in their own rights.
In addition, we may also disclose personal data to third parties, if we have reason to believe that using or disclosing such information is necessary or advisable to: (i) conduct investigations of possible breaches of law; (ii) identify, contact, or bring legal action against someone who may be violating an agreement they have with us; (iii) investigate security breaches or cooperate with government authorities pursuant to a legal matter; or (iv) to protect our rights, safety or property, including the prevention of fraud.
We reserve the right to transfer any personal data we have about you in the event that we merge with or are acquired by a third party, undergo another business transaction such as a reorganization, or should any such transaction be proposed.
What is the legal ground for processing?
Creator Studio is not allowed to collect, process, use, store etc. personal data without a valid legal ground. Lawfulness may be derived from your consent, by contract, statutory obligations or from our legitimate interest as a business. For each specific process purpose of processing of personal data, we collect from you, we will inform you about which legal ground that will apply, and what rights you are entitled to exercise. whether the provision of personal data is statutory or required to enter a contract and whether it is an obligation to provide the personal data and possible consequences if you choose not to.
What are your rights?
Right to access:
You have the right to request information about the personal data we hold on you at any time. You can contact Creator Studio that will provide you with your personal data via e-mail.
Right to portability:
Whenever Creator Studio process your personal data by automated means based on your consent or based on an agreement you have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us.
Right to rectification:
You have the right to request rectification of your personal data if they are incorrect, including the right to have incomplete personal data completed.
Right to erasure:
If you are a customer, you have the right to erase any personal data processed by Creator Studio at any time except for the following situations:
- if you have an ongoing matter with Customer Service
- if you have an open order which has not yet been shipped or partially shipped
- if you have a balance with Creator Studio, regardless of the payment method
If you are an external partner, you have the right to erase any personal data processed by Creator Studio at any time except for the following situations:
- for exercising the right of freedom of expression and information
- to comply with a legal obligation
- for the establishment, exercise, or defense of legal claims
Right to restriction:
You have the right to request that Creator Studio restricts the process of your personal data under the following circumstances:
*if you object to a processing based on Creator Studio’s legitimate interest, we shall restrict all processing of such data pending the verification of the legitimate interest.
*if you have claim that your personal data is incorrect, Creator Studio must restrict all processing of such data pending the verification of the accuracy of the personal data.
*if the processing is unlawful you can oppose the erasure of personal data and instead request the restriction of the use of your personal data instead
*if Creator Studio no longer needs the personal data but it is required for you to make or defend legal claims.
Your right to object to processing based on legitimate interest:
You have the right to object to processing of your personal data that is based on Creator Studio’s legitimate interest. Creator Studio will not continue to process the personal data unless we can demonstrate a legitimate ground for the process which overrides your interest and rights or due to legal claims.
How can you exercise your rights?
We take data protection very seriously and you can exercise your rights by contacting your point of contact within Creator Studio. If you do not have a point of contact or do not get a prompt response, you can direct your request dataprotection.externalpartners@hm.com to if you are a business customer or to creatorsupport@creatorstudio.com if you are a consumer.
Data Protection Officer:
We have appointed a Data Protection Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Data Protection Officer by email at dataprotection.externalpartners@hm.com if you are a business customer and creatorsupport@creatorstudio.com if you are a consumer, and write DPO as a subject.
Right to complain with a supervisory Authority:
If you have complaints about the way Creator Studio processes and protects your personal data and privacy you have the right, at any time, to make a complaint to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY) or any other competent a supervisory authority in the country of residence.
Updates to our Privacy Notice:
We may need to update our Privacy Notice. The latest version of the Privacy Notice is always available on our website.
Purposes of processing of personal data
Business Relations
We will use your personal data such as name, phone number and e-mail necessary to evaluate potential business partners, collaborations and partnerships as well as manage existing business relations including communication, procurement, contract signing and financial transactions.
In case of legal issues and disputes your personal data will be processed.
When concluding a contract with you, we will process your personal data necessary to fulfil any obligations derived from that contract. The legal ground for processing is fulfilment of contract.
The processing of your personal data to manage business relations and to provide business partners access to our systems are based in our legitimate interest as a business.
Creator Studio will process your data no longer than necessary for fulfilling the purpose of procurement and business partnership, for the length of the agreement and time to preclude legal issues.
For legal disputes we will keep the data during the ongoing dispute and for a period of time after the dispute when the information is still relevant.
For tax and accounting reasons we will save relevant personal data for 7 years.
Create and manage your account
We will use your contact details, such as name ande-mail, to create, manage and support your “My Studioaccount” and to keep your account up-to-date and always current. “My Studio account” is further described in the Terms of Service.
We use no more data than necessary for providing you with all the benefits that comes with the account. This means that we will only use personal data obtained directly from you when you signed-up for your account, combined with information you share with us by using our services.
The processing of your personal data to create and manage your account and to provide you with the services of My Studio is necessary to fulfil contractual obligations derived from that agreement.
Creator Studio will process your data no longer than necessary for fulfilling the purpose of providing you with the services related to your account. We will keep your personal data until the end of our relationship and a period of maximum 30 days after the end of the contractual relationship.
When shopping from us
Whenever you as a customer shop from us, we use your personal data, such as name, e-mail, address order details and transaction data to provide you with the products and services ordered from us. Specifically, we use your personal data tobe able to process your purchase order and payment, to have your order produced and delivered, handle returns and warranty claims.
When making products and services available to you Creator Studio will process your personal data necessary for concluding a contract with you and to fulfil any obligations derived from that contract, whether the contract refers to a purchase order and payment, or the use of other services provided by us or by third parties.
We will keep and process your personal data no more than necessary for us to perform our contractual obligations.
When shopping from our Business Partners
Creator Studio collaborate with business partners called Creators that operate their own e-commerce solution and that uses Creator Studio’s production and logistic solutions. Within this collaboration each party will be independently acting as data controllers in respect of personal data processed by them respectively.
Whenever you as a customer shop from our business partners that we collaborate with and that uses our services we process your personal data, such as name, e-mail, address, and order details, to provide our services to the business partner and to be able to produce and deliver the products that you have ordered and purchased from each business partner.
The processing of your personal data is based on our legitimate interest as a business.
We will keep and process your personal data no more than necessary for us to provide our services.
Marketing and Promotions
We will process your personal data in order to generate and marketing materials and send out direct marketing such as newsletter and information about offers, deals, discounts, promotions, new collections etc.
Whenever you as a customer sign up to direct marketing, we will collect your email address and process your full name, if provided by you in your “MyStudio account”.
We will obtain your consent when you sign up for direct marketing.
We will process your data no longer than necessary to provide you with marketing and promotions. We will cease processing your data for marketing purposes once you are actively rejecting further marketing communication from us.
When you contact Customer Service
We will use your personal data to give you service and support and to improve the overall experience of the service, through email. In this context we will use your personal data to manage your questions, handle complaints and warranty matters and to provide technical support as well as to improve customer experience.
We will only use such personal data necessary for providing the service to you in a secure and efficient way. We will use the personal data you provide us with when you contact us, such as contact details, birth date and other necessary information. In order to resolve your case, we may also need to access and use transaction data such as order, payment and delivery information.
In order to provide you with the best possible Customer Service, we must collect and use your personal data. This is justified on our legitimate interest as a business.
We will keep your data for as long as we need to handle your case. We may continue to keep and use your data if we have outstanding obligations to you or by any other reasons are prevented from erasure.
Development and improvement
We may use your personal data to develop and improve our products, services, systems, and supply chain. This includes analyses to make our services more user-friendly.
We will only use aggregated data on pseudonymized level for developing and improvement purposes.
We will only use personal data for a development and improvement purpose if it is strictly necessary and cannot be achieve with less invasive means. This means that we will protect and secure your data to the extent reasonably possible, for example by appropriate pseudonymization and encryption techniques or by data anonymization.
The processing of your personal data for the purpose to develop and improve our services and products, is based on our legitimate interest as a business.
We will process your personal data no more than necessary for us to fulfil the purposes, Thereafter the data will be immediately erased for this type of use.
CALIFORNIA, COLORADO, AND VIRGINIA PRIVACY RIGHTS
H&M Hennes & Mauritz GBC AB (“H&M Sweden”) and H&M Hennes & Mauritz L.P. (“H&M USA”) (collectively, “H&M,” “us,” “we,” and “our") provides this California, Virginia, and Colorado Privacy Notice (the “Supplemental State Privacy Policy”) for visitors, users, and others who reside in the States of California, Virginia, and Colorado. The Supplemental State Privacy Policy supplements the information contained in the Privacy Notice above and applies solely to visitors, users, and others who reside in the States of California, Virginia, and Colorado. To the extent any provision in this Supplemental State Privacy Policy conflicts with a provision of the Privacy Notice, the Supplemental State Privacy Policy shall govern with respect to visitors, users, and others who reside in the States of California, Virginia, and Colorado.
Collection of Personal Information:
We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). In particular, we collect the following categories of personal information:
A. Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.
B. Categories of personal information described in Cal. Civ. Code § 1798.80(e), such as name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information.
C. Characteristics of protected classifications under state or federal law, such as age, citizenship, and sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions).
D. Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information.
F. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
G. Geolocation data.
H. Audio, electronic, visual, thermal, olfactory, or similar information.
I. Inferences drawn from other personal information to create a profile about a consumer reflecting a consumer’s preferences, characteristics, and trends.
Personal information does not include: publicly available information lawfully made available from government records, deidentified or aggregated consumer information, or information excluded from the California Consumer Privacy Act, the Virginia Consumer Data Protection Act, or the Colorado Privacy Act.
Use of Personal Information:
We may use or disclose the personal information collected for one or more of the following business or commercial purposes:
• To fulfill or meet the reason for which the information is provided. For example, to create your personal account at hm.com or to process your orders.
• To provide you with information, products, or services that you request from us, including answering your queries and to notify winners in promotions.
• To provide you with phone calls, text message notifications, email alerts, and other notices concerning our products or services. For example, to notify you of delivery status, to be able to send you relevant marketing offers and information such as newsletters and our catalogues, to contact you in the event of a problem with delivery of your items, and to inform you of new or changed services.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection and managing your account by carrying our credit checks.
• To be able to analyze your personal data to provide you with relevant marketing offers and information.
• To be able to validate that you are of legal age for shopping online.
• To improve our website.
• Testing, research, analysis, and product and service development.
• As necessary or appropriate to protect the rights, property, or safety of us, our employees, our customers, or others.
• To respond to law enforcement requests and as required by applicable law, court order, or government regulations.
• As described to you when collecting your personal information.
Rights of California, Virginia, and Colorado Residents:
California, Virginia, and Colorado residents have the following rights:
1. Right to Know About Personal Information Collected, Disclosed, or Sold
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (instructions and description below), we will disclose to you:
• The categories of personal information we collected about you;
• The categories of sources for the personal information we collected about you;
• Our business or commercial purpose for collecting or selling that personal information;
• The categories of third parties with whom we share that personal information;
• The specific pieces of personal information we collected about you; and/or
• If we sold or disclosed your personal information for a business purpose, including lists of sales, identifying the categories of personal information that each category of recipient purchased or obtained.
We have collected the following categories of personal information from consumers within the last twelve (12) months:
A. Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.
B. Categories of personal information described in Cal. Civ. Code § 1798.80(e), such as name, signature, physical characteristics or description, address, telephone number, bank account number, credit card number, debit card number, or any other financial information.
C. Characteristics of protected classifications under California, Virginia, and Colorado or federal law, such as age, race, color, ancestry, national origin, citizenship, marital status, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information.
D. Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information.
F. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
G. Geolocation data.
H. Audio, electronic, visual, thermal, olfactory, or similar information.
I. Inferences drawn from other personal information to create a profile about a consumer reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
We have obtained the categories of personal information listed above from the following categories of sources:
• Directly from you, the consumer;
• Indirectly from third parties and service providers, including partners and affiliates;
• Directly and indirectly from our website.
We collected the categories of personal information listed above for the following business or commercial purposes:
• To fulfill or meet the reason for which the information is provided. For example, to create your personal account at hm.com or to process your orders;
• To provide you with information, products, or services that you request from us, including answering your queries and to notify winners in promotions;
• To provide you with phone calls, text message notifications, email alerts, and other notices concerning our products or services. For example, to notify you of delivery status, to be able to send you relevant marketing offers and information such as newsletters and our catalogues, to contact you in the event of a problem with delivery of your items, and to inform you of new or changed services;
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection and managing your account by carrying our credit checks;
• To be able to analyze your personal data to provide you with relevant marketing offers and information;
• To be able to validate that you are of legal age for shopping online;
• To improve our website;
• Testing, research, analysis, and product and service development;
• As necessary or appropriate to protect the rights, property, or safety of us, our employees, our customers, or others;
• To respond to law enforcement requests and as required by applicable law, court order, or government regulations; and/or
• As described to you when collecting your personal information.
We shared the categories of personal information listed above with the following categories of third parties:
• Affiliates, including H&M USA;
• Service providers;
• Third parties to which consumers authorized us to disclose personal information in connection with products or services provided to consumers.
Response Timing and Format
We will confirm receipt of a request within 10 days and provide information about how we will process the request. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosure we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
If you wish to appeal our decision, please submit your appeal to the above contact information. Please clearly denote that it is an appeal.
4. Right to Non-Discrimination
We will not discriminate against you for exercising any of your rights under the California Consumer Protection Act. Unless permitted by the California Consumer Privacy Act, we will not:
• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
California Shine the Light Law:
California Civil Code Section 1798.83 permits our visitors who are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact Customer Service.
2. Right to Request Deletion of Personal Information
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (instructions and description below), we will delete, and direct our service providers to delete, your personal information from our records, unless an exception applies.
We may deny your request to delete your personal information if retaining the information is necessary for us or our service providers, subject to certain exemptions based on your state of residence.
3. Right to Opt Out of the Sale of Your Information
You have the right to opt-out of sharing your personal information with third parties for some purposes, including sharing that may be defined as a sale under applicable laws. You can opt-out of this by filling out this form Creator Studio - Do not sell my data.
What Personal Information Do I Provide to Verify My Identity?
We take the privacy of your personal information seriously and want to ensure that we provide only you or your authorized agent with your personal information. Applicable law also requires that we verify the identity of each person who makes a request to know what personal information we have about you or to delete the personal information we have about you. To verify your identity, we ask you to provide your:
• First name*
• Last name*
• Middle initial
• Email address
• Phone number
• Order number
• *required field
How Do You Verify My Identity?
We may verify your identity in a few different ways in order to balance the requirements of state law and our obligation to keep your information private. When you make your request, you will be asked to answer a few questions about yourself to help us validate your identity. This is a two step process using information unique to you, such as an order number, a product in an order, an address or email address, etc. If you chose to make the request online, it can be made by logging into your account, going to “My Account,” then “Settings” and then “Leave H&M.” Depending on your cache settings, device and operating system, you may have to enter your password a second time.
In some instances, we may ask you to provide other documentation to verify your identity. If this happens, we will reach out to you directly with this request.
What If You Can’t Verify My Identity?
If we can’t verify your identity, we will not be able to process your request to know what personal information we have about you or to delete the personal information we have about you. If we are unable to verify your identity with a high degree of certainty, we will only be able to provide a report with category-level information and we may not be able to delete some of your information.
How to Submit a Request Using an Authorized Agent
An authorized agent is a person or business who has authorization to request to know what personal information we have about you, to delete the personal information we have about you, or to opt out of the sale of personal information on behalf of a California, Virginia, or Colorado resident. Authorized agents use the same links described above to submit requests.
If you are submitting a request on behalf of another person, we require a valid power of attorney or other documentation demonstrating your authority to submit this request. This can be a letter or other documentation signed by the California, Virginia, or Colorado resident authorizing you to submit this request. You can download a sample letter from the request form.
How Do I Send You My Documentation?
If you submit a request via email at creatorsupport@creatorstudio.com, you must include the appropriate above listed documentation in order for us to act on your request. If you submit your request over the phone by calling us at 855-HNM-SHOP [855-466-7467 (Toll-free)], you will also be asked to email your forms to creatorsupport@creatorstudio.com.
Last Updated: October 2022
© Creator Studio 2024 - Part of H&M Group
106 38 Stockholm, Sweden