Wella Company Global Privacy Notice

Welcome to Wella Company's website (Wella Company) (the "Site"). We are called "we", "us", "our", or "Wella Company" in this Privacy Notice (the "Notice"), which includes Wella Company International Operations Switzerland S.à.r.l. (our headquarters) and its affiliates and subsidiaries. For more information 'About Us', please see here or you can contact us here.

Wella Company provides beauty products and services (our "services") to consumers and professionals (our “Customers”).

This Notice explains how we use information about you if:

• You visit and browse our websites and mobile applications (“Wella Company Websites”).
• You contact us or engage with one of our promotions.
• You contact or engage with us through social media or adverts and content on third party websites.
• You sign up for newsletters or other marketing from us.
• You purchase products or services directly from Wella Company or our brands (including via their websites, collectively "Wella Company Websites") or join our loyalty programmes.
• You visit our offices, sites, salons, studios, or stores.
• You interact with our virtual and/or augmented reality technologies (e.g., our virtual try-on tool, which is available only in certain jurisdictions).
• Otherwise engage with us, for example by contacting our customer services or consumer affairs teams, attending an education event, tradeshow or other Wella Company event, or taking part in a survey or competition.

If you're applying for a job at Wella Company, please see our Global Applicant Privacy Notice here.

This Notice provides a global overview of our approach to processing personal data and how we use it in accordance with data privacy laws. Unless otherwise defined in this Notice, capitalized terms used in this Notice have the same meaning as in our Terms of Use.

For residents of the following jurisdictions, this Notice is supplemented by the relevant Annex included at the relevant link:

• Argentina – Annex A
• Australia – Annex B
• Brazil – Annex C
• Canada – Annex D
• China – Annex E
• India – Annex F
• Japan – Annex G
• Kingdom of Saudi Arabia – Annex H
• Mexico – Annex I
• New Zealand – Annex J
• Thailand – Annex K
• Turkey – Annex L
• United States – Annex M

To help you find information quickly on any question you might have, we have set out an index below. Just click on the question you would like answered and you will be taken to the relevant section:

• What categories of personal data does Wella Company collect about me and how is it used?
• We may obtain information from third party sources
• How are advertisements personalized for me?
• Who will Wella Company share my personal data with?
• What happens if Wella share my personal data outside its original country
• How long will Wella Company keep my personal data for?
• What rights do I have in respect of my personal data?
• How do I stop receiving marketing communications?
• How old do I have to be to use the Wella Company Websites?
• How do we protect your information?
• Who can I contact about data privacy?
• Other websites
• Updating this Privacy Notice
• Annexes

Personal data means any information relating to you from which you are or could be identified. We explain here what personal data we collect about you, how we use it, and the relevant legal reason (called a 'lawful basis') for each way that we use it.

If you visit and use our Wella Company Websites or purchase our products or services or join our loyalty programmes;

If you contact us or interact with one of our promotions;

If you sign up for updates or other marketing from Wella Company;

If you visit one of our locations or attend one of our events;

If you interact with a Wella brand page on a social media network;

You can obtain further information on the processing of your personal data and how to exercise your privacy rights from the respective provider.

We use social media platforms including Meta, Instagram, TikTok, and LinkedIn. If you would like more information or a full list, please contact us as set out below (“Who can I contact about data privacy?”).

If you access or use a social media network or public forum through a Wella Company Website;

You may not always be required to share the above information, however if you do not provide certain information to us, you may not be able to take advantage of some of our products and services.

We may aggregate and anonymize your information to create customer segments and share with our licensees and partners for analytical purposes (e.g. to share statistics on consumers' characteristics). This kind of data is no longer personal data.

From time to time, we may receive information about you from third party sources. We will only do this where we have checked that these third parties either have your consent or are otherwise legally permitted or required to share your personal data with us. Examples of this are:

• Our social media partners may share with us your user ID for that site, the name, email address and location associated with the user ID and any other information permitted under the privacy policy for that website. We may also share information about you to that social networking site. This is to enhance your experience between platforms, such as to allow you to engage with sites, interact with discussion forums, and sign-in to our Site using your social media log-in details.
• Our retailers, distributors and third-party brand partners may pass information to us including any of the data categories listed above such as your name, contact details, information automatically collected via cookies, information in relation to products purchased at their stores, for example, (whether in store or online through their own website or similar), and services requested using their websites and/or applications.
• Our technology partners and market research organizations may share information with us, including your browsing patterns, geo-location, and device identifiers.

We may use your data to provide you with personalized recommendations for our products or services that we think you might like, tailor our content to better suit your interests or, at your request and where available, offer personalized and customized products or services. We will also use your personal data across the Wella Company Websites to provide a seamless user experience. Please see the section "How does Wella Company use cookies?" in our Cookie Notice here for more information.

We take care to restrict access to your personal data on a ‘need to know’ basis. Whenever we share your data with a third party, we will implement appropriate measures to ensure it is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

Here is some more information about when we will share your personal data:

• Within Wella Company. We have offices located across the globe, which all partially share responsibilities when processing your information to provide you with our services.
• Regulators, authorities, and other third parties. Sometimes we may have a legal obligation to share your personal data with regulators, courts, and other authorities (e.g. tax and law enforcement authorities).
• Our service providers. Wella Company engages third party service providers to perform functions on Wella Company 's behalf, for example website and data hosting, communication distribution, marketing lists management, customer service, market research, consultants, providing loyalty programmes and IT support and other services. These providers may process your personal data on our behalf, as necessary to perform their support functions, and following our instructions and data protection law.
• Acquiring entities. If the Wella Company entity that processes your personal data is sold or transferred, your personal data may be transferred to the new owner.
• Third party providers. For example, our retailers, distributors and third-party brand partners, and auditors, legal advisers, and other professional advisers.
• Third party advertisers. We may also share aggregated and de-identified information (which can include your email address, usage and/or information collected from cookies) (where appropriate) to our third party advertisers such as Meta and Google, who will match it with data from other sources to understand our customers better and provide us with more accurate analytics, which will help us to target customers with similar interests and enable us to develop our advertising and direct marketing campaigns.

As you may expect, some of the recipients we share personal data with may be in countries outside of the jurisdiction which we collect the data from. Some of these countries have a legal regime which provides an adequate level of protection for this data.

If recipients are in countries which do not provide adequate protections for personal data, we will take all necessary measures to ensure that transfers of personal data to these countries are adequately protected as required by applicable data protection law. This may include using appropriate safeguards such as the EU Standard Data Protection Clauses. You can ask for a copy of such appropriate safeguards by contacting us as set out below.

We won't keep it for any longer than we need to, either to comply with the law or to ensure that we are complying with our obligations to you. Generally, we will keep personal data for as long as necessary for the original reasons we collected it.

We may keep your personal data for a longer period:

• in the event of a complaint,
• if we reasonably believe there is a prospect of legal proceedings,
• if we are aware of pending or ongoing legal proceedings, or
• in some circumstances, if applicable law says we must.

If you opt in to receive marketing from us, we will keep your relevant information for as long as you are receiving marketing. If you later decide to opt out (or object to any other use of your personal information), we may keep a record of your opt-out or objection so we can respect your preferences and demonstrate our compliance.

Where personal data is kept, that period will be determined based on the applicable local law. Please contact us as set out below to request further information.

You have rights in relation to your personal data. These can differ by country, but can be summarised in broad terms as follows:

1. Right of access

   You have the right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients of that data. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy, we may charge a fee.

2. Right to rectification

   You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

3. Right to erasure (right to be forgotten)

   You may have the right to ask us to erase personal data concerning you. This is not an absolute right but if a request is refused in whole or in part, we will provide reasons for the refusal.

4. Right to restriction of processing

   In limited circumstances, you may have the right to request that we restrict processing of your personal data, unless we think we have a legitimate interest for processing your data which overrides your request.

5. Right to data portability

   You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit that data to another entity.

6. Right to object and rights relating to automated decision-making

   Under certain circumstances you may have the right to object, on grounds relating to your situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data. This may include requesting human intervention in relation to an automated decision so that you can express your view and to contest the decision.

To exercise any of these rights, find out more, or lodge a complaint, please contact us as set out below. We may apply any exceptions or other conditions available under law when responding to correction, deletion, or other requests. You also have the right to lodge a complaint with the competent data protection supervisory authority.

We will only send you marketing communications if you consent to this, or if we are otherwise permitted by law. If at any time you decide that you no longer wish to receive marketing communications from us, you may opt out by clicking on the relevant ‘unsubscribe’ link in the communication you receive, or by contacting us here.

Please note, whilst we will honour your request to stop receiving marketing communications, we will continue to send you service-related communications such as emails confirming purchases through the Wella Company Websites and may keep your information for record keeping purposes.

You must be aged 13 or over to use the Wella Company Websites and our other digital offerings, including our social media.

We take your privacy very seriously and we understand the importance of taking extra precautions to protect the privacy and safety of children who use Wella Company’s products and services. We do not solicit or knowingly collect personal data from children aged 13 and under. If we are made aware that we have received such information, without verification of parental consent, or any information in violation of our policy, we will use reasonable efforts to locate and remove that information from our records.

If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us below.

We understand that you care how your personal data is used and/or shared with others, and we value your trust and seek to safeguard your personal data.

We implement appropriate technical and organizational security measures, including physical, administrative and technical safeguards to protect your personal data from unauthorized access, use and disclosure. To ensure the security of your personal data, we communicate our privacy and security guidelines to all Wella Company employees and enforce privacy safeguards within our company.

The measures we use to protect your personal data are designed to provide a level of security appropriate to the risk of processing your personal data. However, please be aware that no electronic transmission of information can be entirely secure. We cannot guarantee that the security measures that we have in place to safeguard personal data will never be defeated or fail, or that those measures will always be sufficient or effective.

If you have any questions regarding this Notice or how we handle your personal data, you may contact our Wella Company Privacy Team and Global Data Privacy Officer using this form.

Alternatively, you can email our Global Data Privacy Officer, Lisa Townsend, at wella.data.privacy@wella.com.

We may sometimes link to other websites. We are not responsible or liable for these websites, any content on them, or their policies and notices. A link does not mean we endorse the views of the linked website. We have no control over the availability of any of these websites. As such, you should read the privacy notices and terms of use for any third-party site you link to from our Sites, including social media platforms and other websites or services with user-generated content features.

We may update this document from time to time, for example if we implement new systems or processes that involve a change to the way we use personal data. We will publish an updated Notice here with the 'Last updated' date at the top of this Notice.

For residents in Argentina only, Annex F applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For Argentine data subjects, the Argentine Data Protection Law No. 25,326, its Regulatory Decree No. 1558/2001 and resolutions and dispositions issued from time to time by the Argentina Data Protection Authority shall apply.

In the event of any conflict between the terms of this Annex F and the terms of the Notice, the terms of this Annex F will govern and control.

Your personal data is stored in a database the responsible for which is Wella Argentina SRL domiciled at OLGA COSSETTINI 1545, PISO: 3 - (1107) CAPITAL FEDERAL (Buenos Aires) – ARGENTINA.

For residents in Argentina, we will rely on the legal basis of consent, compliance with legal obligations or our contractual relationship with you when processing personal data.

We will not rely on the legal basis of consent when your personal data (i) has been obtained from unrestricted public access sources; and/or (ii) is limited to name, ID number, tax or social security ID number, profession, date of birth and domicile.

The provisions relating to legitimate interests stated in the Notice shall not apply.

If you provide inaccurate personal data, you will not be able to take advantage of some of our products and services.

You acknowledge that the Access to Public Information Agency, as the enforcing authority of Law 25,326, has the power to attend the reports and claims from those who are affected in their rights consequence of non-fulfilment of data protection provisions.

For residents in Australia only, Annex E applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For residents of Australia only, the following paragraph will apply in addition to the provisions above in the section "What rights do I have in respect of my personal data?":

When making a complaint. In most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If we fail to respond to your complaint within a reasonable time of receiving it in writing or if you are dissatisfied with the response that you receive from us, you may have the right, depending on the jurisdiction, to make a complaint to the applicable regulator.

For residents in Brazil only, or individuals that were in Brazil at the moment that the personal data was collected, Annex C applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For Brazil data subjects the Brazilian Internet Legal Framework (Law No. 12,965/2014 and the Brazilian General Data Protection Law ("LGPD") and other laws and/or regulations regarding data privacy in Brazil apply.

For residents of Brazil only, or individuals that were in Brazil at the moment that the personal data was collected, the following provisions shall replace the "What rights do I have in respect of my personal data?" section above:

You have rights in relation to your personal data and can be summarised in broad terms as follows:

1. Right of confirmation and right of access

   You have the right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients of that data.

2. Right to rectification

   You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

3. Right to erasure or anonymization

   You may have the right to ask us to erase, block or anonymise personal data concerning you that is deemed as unnecessary, excessive or processed in non-compliance with privacy laws. This is not an absolute right but if a request is refused in whole or in part, we will provide reasons for the refusal.

4. Right to data portability

   You may have the right to request us to share your personal data with another service provider.

5. Right to information on data recipients

   You have the right to request information about the public and private entities with which we have shared your personal data.

6. Right not to provide consent and to be informed of the consequences thereof

   You have the right to refuse to provide your consent (where consent is the legal basis for processing) and to be informed of the consequences thereof.

7. Right to object

   Under certain circumstances you may have the right to oppose to the processing of your personal data that is based on one of the waiver of consent hypothesis, where such processing infringes applicable privacy laws.

8. Right to review automated decision-making

   You have the right to review decisions made solely based on automated processing that affect your interests, including decisions aimed at defining your personal, consumer and credit profile, or other aspects of your personality.

9. Right to petition the competent data protection authority

   You have the right to lodge a complaint against Wella Company before the competent data protection authority, in relation to your personal data.

10. Right to withdraw consent

    If you have consented to any processing of your personal data, you have the right to withdraw your consent at any time.

For residents in Canada only, Annex G applies to the collection, use, and disclosure of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For residents in Canada only, references to “personal data” in the Notice shall mean “personal information” as understood under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) or substantially similar provincial privacy laws in Canada, as applicable.

For residents in Canada only, we will rely on the lawful basis of consent when collecting, using or disclosing personal data, as required under applicable privacy laws. Provisions in the Notice referring to lawful bases other than consent shall not apply if inconsistent with applicable laws in Canada.

For residents in Canada’s only, for a list of the Wella Company entities and third parties that we may share your data with, please contact us as set out below (“Who can I contact about data privacy?”).

For residents in Canada’s Province of Quebec only, you must be aged 14 or over to use the Wella Company Websites and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

For residents in China only, Annex A applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For China data subjects the Personal Information Protection Law of the People’s Republic of China ("PIPL") and other laws and/or regulations regarding data privacy in the People’s Republic of China apply.

For residents in China only, the data controller of your personal data is HFC (Shanghai) Cosmetics Co., with address Ltd. Room 311, 5th Floor, No. 728, South Lingyan Road, Pudong New District, Shanghai.

By providing your personal data to us or interacting with us, you will be deemed as having accepted and fully agreed to be bound by, and you consent to our processing of your personal data in accordance with this Notice, including the processing of your sensitive personal data and the cross-border sharing of your personal data with recipients located within or outside of China as described in this Notice.

For residents in China, we will rely on the legal basis of consent when processing personal data. The provisions relating to legitimate interests stated above shall not apply.

The following paragraph will also apply to China residents in relation to sensitive personal data:

Among the personal data we collect and process as stated in the "What categories of personal data do Wella Company collect and how is it used?" section above and the Cookies Notice here, the following may be deemed as sensitive personal data in relation to residents in China:

1. transaction information (including information about the purchases you made and the date and time of the purchase),
2. photos, images and video recordings (to the extent containing your facial features),
3. sensitive health data/information as detailed above, and
4. communications information including your correspondence with us.

In each case, we will make sure that the processing of sensitive personal data is necessary to achieve the specific purposes as described above, and our processing of sensitive personal data will be equipped with strict security measures and be conducted in a manner of having the least impact on your personal rights and interests.

You may contact us as set out below to obtain information regarding the third parties who act in the capacity of independent data controllers and with whom we share your personal data (to the extent required under applicable law).

For China residents only, the following paragraph will apply in addition the provisions above in the section "What happens if Wella Company transfers my personal data outside its original country?":

Your personal data may be transferred to or processed by Wella Company International Operations Switzerland S.à.r.l. and its affiliates and subsidiaries located outside of China for the specific purposes of processing set out in the "What categories of personal data do Wella Company collect and how is it used?" section. We will take measures to protect your information in accordance with applicable law. Where required by applicable law, the details of the cross-border transfer of your personal data and the overseas recipients will be made available to you upon your request.

For China residents only, you must be aged 14 or over to use the Wella Company Websites and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

For residents in India only, this Annex H applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) shall govern any processing of personal data (a) within the territory of India; or (b) outside the territory of India, if such processing is in connection with any activity relating to offering of goods or services to data subjects within the territory of India (where (a) and (b) shall hereinafter be referred to as “India-governed Personal Data”).

The DPDP Act does not offer any sub-categories of personal data, and all personal data shall be governed and handled similarly in accordance with the terms herein.

For residents of India or in case of processing of India-governed Personal Data only, the sub-sections “Lawful basis” for each of the uses of circumstances under which personal data may be collected, as set out under the section titled "What categories of personal data does Wella Company collect about me and how is it used?", will be deemed replaced and substituted with the following, to the extent of any conflict:

• Your acceptance of this Privacy Notice denotes free, specific, informed, unconditional and unambiguous consent to such processing of your personal data as set out above, for the purposes set out above, in accordance with the terms of the above Notice read with this Annex H.
• We do this in our legitimate interests (where we consider these are not overridden by your rights), such as to manage our business effectively, or to comply with our legal obligations (e.g. commercial sales and goods law).
• We may also do this to take steps to enter into any contract with you or your employer or to fulfil our obligations under any contract with you (including for our Virtual Try-On Tool services (where available), for example, or Terms of Use).
• We may also do this where you may have voluntarily provided your personal data to Wella Company and have not indicated that you do not consent to the use of such personal data.

For residents of India or in case of processing of India-governed Personal Data only, Wella Company will ensure that no transfers of personal data of Indian residents or of India-governed Personal Data shall be made to countries or territories outside of India that are identified as restricted or prohibited territories under the DPDP Act, as notified from time to time by the Government of India.

For residents of India or data subjects from whom Wella Company has collected India-governed Personal Data only, sub-sections (a), (b) and (c) of section "What rights do I have in respect of my personal data?" will be deemed amended and substituted as follows:

1. Right of access

   You have a right to seek information regarding all other persons (including third parties) who may have access to and are processing your personal data that is collected by Wella Company in accordance with the Notice. Such information should include the identity details of such third party controllers or processors of such personal data and a description of the personal data shared by Wella Company with such third parties/persons.

2. Right to rectification

   You have the right to rectify/complete/update inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

3. Right to erasure (right to be forgotten)

   You have the right to ask us to erase personal data concerning you.

   In addition to the above amendments to the section "What rights do I have in respect of my personal data?" and the remaining rights set out therein, for residents of India or data subjects from whom Wella Company has collected India-governed Personal Data only, the following additional rights shall also be available:

The section will also include the following two further provisions:

4. Right to grievance redressal

   You have a right to grievance redressal from Wella Company in respect of any act or omission by us in relation to the performance of obligations in relation to (i) the personal data of data subjects; and (ii) exercise of his/her/their rights under the DPDP Act.

5. Right to nominees

   You have a right to nominate any other individual who shall, in the event of death or incapacity, exercise your rights as a data subject.

For residents of India only, you must be aged 18 or over to use the Wella Company Websites and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

For residents in Japan only, Annex B applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For Japan data subjects the Protection of Personal Information ("APPI") of Japan and other laws and/or regulations regarding data privacy in Japan apply.

With respect to residents of Japan only, the following provisions shall replace the "What rights do I have in respect of my personal data?" above:

1. Right of disclosure

   You have the right to request us to disclose records of your personal data we retain. You also have the right to request us to disclose records of the provision of your personal data to third parties. We may refuse to disclose information in certain cases, such as when the disclosure is likely to seriously impede the proper operation of our business or if the disclosure violates laws and regulations. If we refuse to disclose this information, we will notify you of our decision not to disclose.

2. Right to rectification

   You may have the right to request correction, addition or deletion of personal data concerning you if it is incorrect. We will inform you if we decide not to take the requested action, for example, if the information was actually correct.

3. Right to deletion and discontinuation of processing or transfer

   If it was obtained in violation of Japanese law, you have the right to request the deletion of your personal data. Similarly, you may also request the discontinuation of either the use of your personal data, or the discontinuation of the transfer of your personal data to third parties. We will review the request and take appropriate measures. In cases where certain measure cannot be taken, we will take alternative measures to protect your interests. In instances where it is no longer necessary for us to use the personal data or there is a possibility for your rights or legitimate interests to be violated, you may also request the deletion of your personal data, or the discontinuation of either the use of your personal data, or the discontinuation of the transfer of your personal data to third parties.

With respect to residents of Japan only, the following sentence shall be included in addition to the "How do we protect your information?" section above:

For more information on measures for the management of the security of information we take, please contact us through the inquiry form provided in "Who can I contact about data privacy?"

For residents in the Kingdom of Saudi Arabia ("KSA") only, or individuals whose personal data is processed in KSA, Annex I applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For KSA data subjects the Personal Data Protection Law promulgated by Royal Decree No. M/19, dated 09/02/1443H on 24 September 2021 ("PDPL") and its Implementing Regulation and Regulation on Personal Data Transfer outside the Kingdom issued on 22/02/1445H (07/09/2023G) (each the Implementing Regulations and Data Transfer Regulations and together, the "Regulations") and other laws and/or regulations regarding data privacy in KSA apply.

Capitalised terms used below and not defined have the meaning set out in the PDPL and Regulations.

For KSA data subjects only, the data controller of your personal data is Wella Regional Trading FZE, with address 08-137 & 08- 139, Floor 08, The Offices 4 - One Central, Dubai World Trade Centre, Dubai.

For KSA data subjects only, "What categories of personal data does Wella Company collect about me and how is it used?" will include the following provision:

With respect to KSA data subjects only, please note that where we obtain your consent to process sensitive categories of data or sensitive health data, we will always obtain your explicit consent. 'Sensitive categories of data' means personal data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown. 'Sensitive health data' means any personal data related to an individual's health condition, whether their physical, mental or psychological conditions, or related to Health Services received by that individual.

For KSA data subjects only, "We may obtain information from third party sources" will include the following provision:

Where we receive information about you from third party sources, we will only do so in accordance with applicable law.

For KSA data subjects only, "How are advertisements personalized for me?" will include the following provision:

Where we use your data to provide you with personalized recommendations for our products and services, tailor our content to better suit your interests or offer personalised and customised products and services, we will always obtain your consent before doing so.

For KSA data subjects only, "Who will Wella Company share my personal data with?" will include the following provision:

Where we share your personal data with third parties, we will only do so in accordance with applicable law.

For KSA data subjects only, "What happens if Wella Company transfers my personal data outside its original country?" is replaced with the following:

As you may expect, some of the recipients we share personal data with may be in countries outside of the jurisdiction which we collect the data from. Some of these countries have a legal regime which provides an adequate level of protection for this data.

If recipients are in countries which do not provide adequate protections for personal data, we will take all necessary measures to ensure that transfers of personal data to these countries are adequately protected as required by applicable data protection law. This may include using appropriate safeguards such as Standard Contractual Clauses. You can ask for a copy of such appropriate safeguards by contacting us as set out in the main body of the Notice.

For KSA data subjects only, "What rights do I have in respect of my personal data?" is replaced with the following:

You have rights in relation to your personal data. These can be summarised in broad terms as follows:

1. Right to access

   You have the right to confirm with us whether we process your personal data, and to access the personal data we hold on you.

2. Right to request access

   Subject to certain conditions, you have the right to request access to a copy of your personal data in a clear and readable format.

3. Right to rectification

   You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

4. Right to erasure

   You may have the right to ask us to erase personal data concerning you, however please note that this is not an absolute right.

5. Right to contact the competent authority

   You have the right to contact the data protection regulator in the Kingdom of Saudi Arabia if you are not satisfied with our use of your Personal Data or response to the exercise of your rights. The relevant data protection regulator is the Saudi Data and AI Authority (SDAIA). They can be contacted here: https://sdaia.gov.sa/en/Contact/Pages/ContactUs.aspx

   To exercise any of these rights, find out more, or lodge a complaint, please contact us using the details in the main body of the Notice. We may apply any exceptions or other conditions available under law when responding to correction, deletion, or other requests.

6. Right to withdraw consent

   When relying on your consent to process your Personal Data, you have the right to withdraw your consent at any time by using the mechanisms provided by us to that end or by contacting us as set out in the main body of the Notice. Please be aware that the withdrawal of your consent will not affect the lawfulness of any processing of Personal Data carried out on the basis of your consent prior to withdrawal.

For KSA data subjects only, "How old do I have to be to use the Wella Company Websites?" is replaced with the following:

For residents in KSA only, you must be aged 18 or over to use the Wella Company Websites and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

For data subjects in Mexico, the Federal Law for Protection of Personal Data held by Private Parties, and its Regulations ("FDPL") apply. This Annex J applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For Mexico data subjects only, the data controllers of your personal data are as follows:

• HFC Cosmetics S. de R.L. de C.V., with address Montes Urales 424 PBC-106 04A-103 Lomas de Chapultepec V Sección CP 11000 Alcaldía Miguel Hidalgo
• HFC Prestige International S. de R.L. de C.V., with address Montes Urales 424 PBC-106 04A-103 Lomas de Chapultepec V Sección CP 11000 Alcaldía Miguel Hidalgo
• Galeria Productora de Costeticos S. de R.L. de C.V, with address Av. Ferrocarril Norte 100, Col. Caleras de Ameche, 38177, Apaseo el Grande Guanajuato, Mexico
• Wella Mexico S. de R.L. de C.V. (Mexico), with address Av. Ferrocarril Norte 100, Col. Caleras de Ameche, 38177, Apaseo el Grande Guanajuato, Mexico

If you visit and use our Wella Company Websites or purchase our products or services;

If you sign up for updates or other marketing from Wella Company;

Processing your personal data for these purposes is not necessary for the existence, maintenance and compliance of the legal relationship that you may have with us, and you always have the choice not to receive marketing information. For instructions on opting out, please contact us as described in this Privacy Notice.

We will rely on your consent for the collection and processing of your personal data. The provisions relating to legitimate interests stated above shall not apply.

We will only send you marketing communications if you consent to this. If at any time you decide that you no longer wish to receive marketing communications from us, you may opt out by clicking on the relevant ‘unsubscribe’ link in the communication you receive, or by contacting us here.

We note that any of the transfers referred to above, may be national or international.

With respect to data subjects in Mexico only, the following provisions shall replace the "What rights do I have in respect of my personal data?" above:

1. Right of access

   You have the right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing, and the recipients or categories of recipients of that data.

2. Right to rectification

   You may at any time request to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

3. Right to cancelation

   You have the right to ask us to cancel and remove your personal data from our records or databases. The cancellation of your personal data will give rise to a blocking period after which the data will be deleted.

4. Right to object

   You can object to the use of your personal data for specific purposes.

5. Right to revoke your consent

   You may revoke the consent you have given us for the processing of your personal data. However, not in all cases we will be able to fulfil your request or terminate the use immediately, since due to a legal obligation we may need to continue processing your personal data.

6. Limit the usage or disclosure of your personal data

   You may limit how we use or disclose your personal data for advertising or promotion communications.

For residents in Mexico only, you must be aged 18 or over to use the Wella Company Websites and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

For residents in New Zealand only, Annex K applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For residents of New Zealand only, paragraph “(b) Right to rectification” in the section "What rights do I have in respect of my personal data?" is replaced with the following:

2. Right to rectification

   You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible. If you make a request to rectify or correct of any of your personal information that we hold, you have the right to provide to us a statement of the correction sought (Correction Statement). If we do not make the correction you have requested, you can request that we attach the Correction Statement to the information and we will take reasonable steps to ensure that this occurs.

For residents of New Zealand only, an additional new paragraph is to be added to the end of the section "What rights do I have in respect of my personal data?" as follows:

When making a complaint, in most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If you are dissatisfied with the response that you receive from us, you can refer your complaint to the Office of the Privacy Commissioner (OPC). You can contact the OPC:

• by telephoning – (04) 474 7590 or (09) 302 8680;
• by writing to – PO Box 10 094, The Terrace, Wellington 6143; or
• by submitting an online complaint form, located at the OPC website: www.privacy.org.nz

For residents in Thailand only, Annex L applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For Thai data subjects, the Personal Data Protection Act, B.E.2562 (2019), its subordinate regulations ("PDPA") and other laws and/or regulations regarding data privacy in Thailand apply.

For residents in Thailand only, if you’re unable to provide certain personal data which is necessary for us to provide our products and services to you or as required by law or as required by the contract, we may not be able to provide you with those products and services. Additionally, this may affect the compliance with any laws that we or you are obligated to comply with.

For residents in Thailand only, the section "What rights do I have in respect of my personal data?" will replace and include three further provisions:

7. Right to object

   Under certain circumstances you may have the right to object, on grounds relating to your situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data.

8. Right to withdraw consent

   You have the right to withdraw your consents you have given for the processing of your Personal Data any time.

   The withdrawal of consent will not affect the lawfulness of the collection, use, and/or disclosure of your Personal Data and sensitive data based on your consent before it was withdrawn. If you do not provide consent or your Personal Data (or withdraw) your consent, we may not be able to provide certain or all of our services or products to you.

9. Right to lodge a complaint

   You can complain to a data protection authority or the competent authority where you believe our collection, use, and/or disclosure of your Personal Data is unlawful or noncompliant with applicable data protection law where applicable. We would, however, appreciate the chance to deal with your concerns before you approach the authority, so please contact us in the first instance.

For residents in Türkiye only, Annex M applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For data subjects residing in Türkiye, the Law No. 6698 on the Protection of Personal Data ("LPPD") and other laws and/or regulations regarding data privacy in Türkiye apply.

Your personal data are collected by written and electronic means.

With respect to data subjects residing in Türkiye only, the following sentence shall apply instead of the "What happens if Wella Company transfers my personal data outside its original country?" section above:

In the event that your personal data is transferred abroad, it is transferred in accordance with Article 9 of the LPPD.

For data subjects residing in Türkiye only, the section "What rights do I have in respect of my personal data?" will include following provisions as per the Article 11 of the LPPD:

1. Right to learn whether your personal data are processed or not;
2. Right to request information regarding your data, if your personal data are processed;
3. Right to learn the purpose of processing of your personal data, and whether your personal data are used for the intended purposes or not;
4. Right to learn the identity of third parties to whom your personal data are transferred in Türkiye or abroad;
5. Right to request completion or correction of your data, if your personal data are processed incompletely or inaccurately;
6. Right to request deletion or destruction of your personal data;
7. If your personal data are corrected, deleted or destroyed, to request notification of these transactions to third parties to whom your personal data are transferred;
8. Right to raise objections against any consequences that may arise in disfavour of you as a result of analysis of the processed data solely and exclusively through automatic systems; and
9. Right to claim indemnification of your damages and losses, if any, incurred due to illegal or unlawful processing of your personal data.

If you have any question concerning your rights in relation to processing of your personal data please contact us as set out below. The requests in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest.

If you have any questions regarding this Notice or how we handle your personal data, you may contact our Wella Company Privacy Team and Global Data Privacy Officer using this form.

Alternatively, you can email our Global Data Privacy Officer, Lisa Townsend, at wella.data.privacy@wella.com.

For residents in the United States (excluding California) only, Annex D Part I is applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For residents of the United Sates (excluding California) only, the section "What rights do I have in respect of my personal data?" will include two further provisions:

7. Right to opt-out of processing for certain purposes

   Under certain circumstances, you may have the right to opt-out of processing for purposes of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

8. Right to appeal

   Under certain circumstances, you may have the right to appeal denial of the rights as described above.

For residents of California only, Annex D Part II applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

CA Personal Information. Consistent with the "What categories of personal data do Wella Company collect and how is it used?" section above and the Cookies Notice here, we collect certain categories and specific pieces of information about individuals that are considered 'Personal Information' in California (CA Personal Information). Specifically, we may collect the following types of CA Personal Information:

• Identifiers: name, title, organization, address, email address, phone number, date of birth, age, gender, and government identifiers.
• Internet or other electronic network activity information: internet protocol (IP) address, your login data, browser type and version, device IDs, time zone setting and location, browser plug-in types and versions, operating system and platform, pages and services you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).
• Audio, electronic, visual, or similar information: phone, audio, or video calls, texts and other digital messaging, emails, and any in-person conversations you have with us.
• Geolocation data: IP address.

Certain CA Personal Information that we collect about you may be considered Sensitive Personal Information within the meaning of California Privacy Law, including geolocation information (only with your permission, in order to provide location services) and government identifiers (to manage our Customer relationships).

We only use and disclose Sensitive Personal Information as necessary in connection with the performance of services and the provision of goods, compliance with federal, state, or local laws, and as otherwise permitted by CA Privacy Law.

Sources. We collect certain categories of CA Personal Information either directly from you or from other third parties as described in the "We may obtain information from third party sources" section above. The categories of third parties from whom we collect CA Personal Information include:

• Third-party partners (e.g., IT service providers, analytics service providers);
• Business partners;
• Commercial clients;
• Public sources; and
• Publications.

Purposes of collection and use. We may collect and use CA Personal Information for:

• Business purposes, including:
  • improving our Wella Company Websites and services;
  • operating our Wella Company Websites;
  • providing you with information and services you request from us, or we think you may be interested in;
  • providing you with location services (only if you ask or allow us to);
  • carrying out and complying with our agreement with the Customer;
  • administering and managing our product offering tiers and fees, invoicing, and billing; and
  • complying with our legal obligations, including carrying out required checks on new customers, and to prevent money laundering or fraud.
• Commercial purposes, including:
  • marketing communications (including direct marketing);
  • customer service;
  • providing you with special offers and other information we believe will be of interest to you; and
  • inviting you to participate in surveys and provide feedback to us.

Disclosure of CA Personal Information. We also share and/or disclose your CA Personal Information as follows:

• Business Purposes. We may disclose the above categories of CA Personal Information to third-party partners, third party applications; and other companies or organizations, such as market research firms and data aggregators, for any of the business purposes described above.
• Commercial Purposes. We may share the above categories of CA Personal Information with third-party partners; third party applications; advertising service providers and partners; and other companies or organizations, such as market research firms and data aggregators, for any of the commercial purposes described above.

Retention of CA Personal Information. We retain your CA Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include (i) for as long as we have an ongoing relationship with you; (ii) as required by a legal obligation to which we are subject to; or (iii) as advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations).

Your Rights under California Privacy Law. Subject to certain exceptions detailed in California law and other applicable laws and regulations, as a California resident, you have the right to: (i) request to know/access your CA Personal Information, including the specific pieces and the categories of CA Personal Information we have collected or shared about you and the categories of sources from which we have collected the CA Personal Information; (ii) request deletion of your CA Personal Information; (iii) receive information about the CA Personal Information about you that we have "sold" to (as such term is defined under California law) or “shared” with third parties within the past twelve (12) months, including the categories of third parties; and (iv) request correction of your CA Personal Information; and (iv) opt-out of the “sale” or “sharing” of your CA Personal Information, as such terms are defined under California Privacy Law.

Exercising California Consumer Rights. If you are a California resident and wish to request the exercise of these rights as detailed above or have questions regarding the CA Personal Information collected or shared with third parties, please call 800-252-4765.

• You may be asked to provide additional proof of identification so that we can verify your identity and validate the request.
• Please note that you are limited by law in the number of requests you may submit per year. In some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the CA Personal Information that we maintain relates to you. In other instances, we may decline to honor your request where an exception under California Privacy Law applies, such as where the disclosure of CA Personal Information would adversely affect the rights and freedoms of another consumer.
• In any case, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.

Authorized Agents. To the extent that you elect to designate an authorized agent to make a request on your behalf, they must provide appropriate documentation including written signed permission from you, proof of your identity, and verification of their identity; or a valid, designated power of attorney as defined under the California Probate Code.

Do Not Track. Your browser or extension may allow you to automatically transmit Do Not Track signals. Except as required by law, we do not respond to such signals.

For residents of California only, the section "What rights do I have in respect of my personal data?" will include the following provisions:

California residents have the right to request (subject to certain exceptions detailed in California Privacy Law):

1. deletion of your CA Personal Information;
2. correction of inaccurate CA Personal Information;
3. the right to know / access the categories of CA Personal Information that we collect about you, including the specific pieces of CA Personal Information;
4. the categories of CA Personal Information disclosed for a business purpose; and
5. information about the categories of CA Personal Information about you that we have shared (as such term is defined under CA Privacy Law) and the categories of third parties to whom the CA Personal Information was shared.