Security and Data Protection

Hermes.com/hk has implemented security measures to protect the personal information you provide against unauthorised access and use. 

Please be aware, however, that no data transmission over the Internet is 100% secure and any information disclosed online can potentially be collected and used by persons other than the intended recipient.

The protection of personal data and the respect for people's privacy are major challenges for the Hermès Group and essential elements in maintaining a relationship of trust.

In this context, the Hermès Group has adopted and implemented Binding Corporate Rules (BCR). 

BCRs are a data protection policy to ensure an appropriate level of protection for personal data transferred throughout Hermès Group entities, wherever they are located. 

BCRs are a tool recognized in Article 47 of the General Data Protection Regulation (""GDPR"")*. They are legally binding and must be respected by all signatory entities of the Hermès Group, regardless of their country of establishment, as well as by all their employees.

Our BCRs include:

• The appointment of a data protection officer;
• Commitments to data security;
• An audit program to verify the application of BCRs;
• An internal program to manage customer requests for their data;
• A training program for our employees involved in the processing of our customers' personal data;
• The publication of the BCRs on the Internet and on our Intranet, and the provision of a copy of them on request.

To consult the full text of our BCRs, click here.

* The GDPR is a European regulation that regulates the processing of personal data within the European Union. It was adopted on April 27 2016 and became mandatory on May 25 2018. The GDPR rules include giving individuals more control over their personal data and strengthening the role of national data protection authorities.

In accordance with the applicable regulations, you have the right to request access, rectification, erasure and portability of your personal data, to restrict or oppose its processing.

A summary of these rights is available in our Privacy Policy, which can be accessed by clicking here. 

Please note that your rights are only applicable to your own personal data. For example, you will not be able to request access to someone else's data. Therefore, if you exercise any of the rights mentioned above, you will be asked to let us know which right you wish to exercise and to provide us with certain information so that we can identify you (for example: copy of an identity card, passport or other legally recognized identity document). These measures will allow us to process your request by protecting you against fraudulent requests from third parties and in compliance with regulations.

When you request access, rectification or deletion of your data, for example, we will provide you with the requested information as soon as possible after receipt of your request, but no later than one month. This period may be longer if your request is complex or occurs in a context justifying such an extension. We will inform you if this is the case. 

We will comply with your requests to the extent required by law; in some cases, we may be legally required or permitted to retain your data. In such a case, we will inform you.  

To exercise your rights, you can contact our Customer Service whose contact details can be found on our website, in the "Contact Us" section.

You can obtain more information about the data we collect and use and your rights by consulting our Privacy Policy, which can be accessed by clicking here. 

You can also access the full text of our BCRs by clicking here.

Finally, if you feel that your answers are not included in these documents, you can contact our Customer Service whose contact details are provided in our Privacy Policy, under the heading "How to Contact Us".