Wella Company Global Privacy Notice

This Privacy Notice (the "Notice") describes how Wella Company International Operations Switzerland S.à.r.l. (our headquarters) and its affiliates and subsidiaries ("Wella Company", "we", "us") collect and use personal data (as defined below) when you visit our website (https://www.wellacompany.com/) and the website of our Brands ("Wella Websites") or otherwise interact with us online or in person. This Notice does not explain how we process personal data for recruitment purposes; please see our Global Applicant Privacy Notice here instead.

For the purposes of applicable data protection laws, the primary "data controller" is usually the Wella Company entity that you provide your personal data to or otherwise interact with. Wella Company uses shared services (such as for the management of our Wella Websites or marketing) and the Wella Company entity that you interact with may be a "joint controller" with other Wella Company entity.

Wella Company provides beauty products and services (our "Products and Services") to consumers and business professionals (our “customers”). In addition to our customers, we process personal data about people who visit Wella Websites, attend our sites, events and tradeshows, as well as people who engage with us across our social media accounts (collectively, “you”).

When we say “personal data” under this Notice we mean any information that can identify you (or could reasonably identify you), either on its own or when combined with other details.

Unless otherwise defined in this Notice, capitalized terms used in this Notice have the same meaning as in our Terms of Use. Depending on your location, the brand you interact with, or the features you use, additional notices, terms or jurisdiction‑specific rules may also apply; in which case you will be presented with those terms or notices prior to disclosing personal data with us. Where there is any inconsistency, those specific notices will take precedence for their respective context. We recommend you review any applicable privacy notices provided to you prior to disclosing any personal data with us.

We are committed to maintaining high standards of data protection when we process personal data. This Notice provides a global overview of our approach to processing personal data and how we use it in accordance with data privacy laws across the main regions, including, for example, the EU / UK General Data Protection Regulation (known as the “GDPR”) and any other local privacy laws applicable to the relevant jurisdiction in which we process personal data and where you are based.

For residents of the following jurisdictions, this Notice should therefore be read in conjunction with the relevant Annex linked below which covers supplementary information.

• Argentina – Annex A
• Australia – Annex B
• Canada – Annex C
• China – Annex D
• India – Annex E
• Kingdom of Saudi Arabia – Annex F
• Mexico – Annex G
• New Zealand – Annex H
• Thailand – Annex I
• Turkey – Annex J
• United States – Annex K

If your jurisdiction is not listed above, and you believe our Notice does not otherwise cover mandatory information for your jurisdiction elsewhere in the Notice, please contact us using our contact details below.

To help you find information quickly on any question you might have, we have set out an index below. Just click on the question you would like answered and you will be taken to the relevant section:

• What categories of personal data does Wella Company collect about me and how is it used?
• Who will Wella Company share my personal data with?
• What happens if Wella Company transfers my personal data outside its original country?
• How long will Wella Company keep my personal data for?
• What rights do I have in respect of my personal data?
• How do I stop receiving marketing communications?
• How old do I have to be to use the Wella Company Websites?
• How does Wella Company protect my information?
• What about the terms of other sites which are linked to Wella Company Websites?
• Who can I contact about data privacy?
• How do you update this Notice?

We have set out below the ways in which you might interact with Wella Company, the information we process about you and why we need it. We have also included the relevant legal reason for each processing activity (called a “lawful basis”) for each way that we use it.  Please use the links to take you to the scenario most appropriate to you.

Note that one lawful basis described below is “legitimate interests” that is applicable in certain jurisdictions. Relying on this lawful basis mean that we use your information in ways that are necessary for our business to operate effectively and deliver a high‑quality experience. This includes uses such as:

• Providing and improving our onsite and online services, including managing your appointments, treatments, and any accounts you create on our Wella Websites.
• Processing and fulfilling product purchases, whether made in store or online, including arranging delivery and providing customer support.
• Running and improving our business operations, such as organising events and trade shows, and delivering in‑person or virtual demonstrations.
• Keeping you informed about your bookings, orders and service updates, including appointment reminders, order confirmations, and changes to your booking.
• Supporting our business‑to‑business (“B2B”) relationships, such as onboarding your company as a customer or vendor and inviting you to relevant business events.
• Protecting the security and integrity of our Wella Websites, including preventing fraud, misuse or unauthorised access.
• Maintaining accurate internal records, including for administration, accounting and operational management.
• Sending you relevant updates or offers, based on services you’ve used or products you have purchased (you can opt out at any time – see more here).
• Understanding how our Websites and Products and Services are used, so we can fix issues, improve the experience and make our digital and in‑person services easier to navigate.

You may not always be required to share the below information, however if you do not provide certain information, we may not be able to provide you with our Products and Services.

(a) If you are a customer purchasing our Products and Services

(b) To assist you with any queries or respond to your questions for customer service purposes

(c) To promote our Products and Services

(d) To improve our Products and Services

(e) To manage our business events and tradeshows

(f) If you are a B2B customer

If you’re a B2B customer and you are interacting with us on behalf of your employer, please refer to the table below.

(g) When we use cookies and similar tracking technologies

(h) For security purposes

We may receive information about you from third party sources. We will only do this where we have obtained confirmation from these third parties that they have complied with appliable data protection laws to share your personal data with us. Examples of this are:

• Our social media partners may share with us your user ID for that site, the name, email address and location associated with the user ID and any other information permitted under the privacy policy for that website. We may also share information about you to that social networking site. This is to enhance your experience between platforms, such as to allow you to engage with sites, interact with discussion forums, and sign-in to our Wella Websites using your social media log-in details.
• Our retailers, distributors and third-party brand partners may pass information to us including any of the data categories listed above such as your name, contact details, information automatically collected via cookies, information in relation to our products purchased at their stores, for example, (whether in store or online through their own website or similar), and services requested using their websites and/or applications.
• Our technology partners and market research organizations may share information with us, including your browsing patterns, location, and device identifiers.

We take care to restrict access to your personal data on a ‘need to know’ basis. Whenever we share your data with a third party, we will implement appropriate measures to ensure it is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

Here is some more information about when we will share your personal data:

• Within Wella Company. We have offices located across the globe, which all partially share responsibilities when processing your information to provide you with our Products and Services.
• Regulators, authorities, and other third parties. Sometimes we may have a legal obligation to share your personal data with regulators, courts, and other authorities (e.g. tax and law enforcement authorities).
• Acquiring entities. If the Wella Company entity that processes your personal data is sold or transferred, your personal data may be transferred to the new owner.
• Our data processors. Wella Company engages third party service providers to perform functions on Wella Company's behalf, for example website and data hosting, e-commerce sites, payment processing, communication distribution, marketing lists management, research and analytics, customer service, identifying whether we know an anonymous visitor already to verify whether they have consented to marketing, chatbots, market research, consultants, providing loyalty programmes and IT support and other services. These providers may process your personal data on our behalf, as necessary to perform their support functions, and following our instructions and relevant local data protection laws.
• Third party service providers. Wella Company also engages other service providers such as professional advisers and auditors where necessary to obtain advice, manage risk, or comply with legal and regulatory requirements; business partners involved in delivering our Products and Services, such as distributors, logistics providers, couriers; and other partners who help us deliver orders, run events, or support our commercial operations.
• Third party advertisers and ad-tech partners. We may share certain information with our advertising partners - including platforms such as Meta and Google. This information may include your email address (where appropriate), device and usage data, and information collected through cookies or similar technologies. Please see our cookie notice here for further information.

Where we share personal data with third parties, we ensure that we do in compliance with applicable data protection laws. You may have rights to manage your preferences, withdraw consent, or object to certain types of data processing. For more information, please refer to What rights do I have in respect of my personal data? section of this Notice.

Some of the recipients we share personal data with, such as service providers and other third parties, may be in countries outside of the jurisdiction which we collect the data from or your country of residence.

If the recipients are in countries which do not provide adequate protections for personal data, we will implement mechanisms to ensure that the personal data continues to benefit from a level of protection that is essentially equivalent to that required in the jurisdiction of origin. We will also require any third-party recipients to maintain appropriate technical and organisational security measures to protect the personal data throughout the transfer and subsequent processing. Such mechanisms may include using relevant safeguards such as the EU/UK Standard Contractual Clauses or other applicable data transfer agreements which ensure personal data is protected to an appropriate standard and allow organizations to continue international data flows without compromising the safety of your personal data. You may ask for a summary of the safeguards which we put in place with our third parties via Who can I contact about data privacy?

We only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, to meet our legal or regulatory obligations, or to protect our legal rights. Once data is no longer required, we will securely delete or anonymise it. The specific retention period depends on the type of data we hold. For example:

• Customer account and support data: Contact details, account information, and correspondence are typically kept for up to 7 years after your last interaction with us, to maintain accurate records, manage ongoing customer relationships, and comply with commercial record keeping laws (e.g., contract limitation periods).
• Website and device data (e.g., analytics logs, cookies, IP addresses): Technical logs and analytics data collected through our Wella Company Websites are usually retained for 24 months, depending on the tool used, to help us understand website performance and user interaction patterns. Cookie lifespans vary by type, but marketing/analytics cookies typically last up to 24 months, unless you delete them sooner through your browser or privacy settings. Please refer to the Cookies Notice for more information.
• Marketing and advertising data: Marketing preferences, engagement data, and identifiers used for advertising (e.g., hashed email addresses, audience segment information) are generally retained for up to 2 years after your last interaction with our marketing materials. This allows us to manage opt out requests and assess campaign effectiveness. If you choose to receive marketing from us, we will keep the information we need for this purpose for as long as you continue to receive our marketing communications. If you later opt out, we will stop using your information for marketing and keep only what is necessary to record your marketing preferences.
• Transactional and payment data: Purchase records, invoices, and payment details are normally kept for 7 years to comply with tax and financial reporting obligations.
• Legal, compliance, and risk-related data: Where legally permissible, we may retain your personal data for longer in limited circumstances, such as:
  • if we need the data to handle or defend a complaint;
  • where we reasonably expect legal proceedings;
  • where legal proceedings are ongoing; or
  • where applicable law requires certain records to be kept for specific periods (e.g., commercial, financial, or audit requirements).

We regularly review our retention practices to ensure that personal data is not kept longer than necessary. Where personal data is retained, that period will comply with any applicable local law.

You may have several rights in relation to your personal data. The rights available differ depending on where you are located but may include:

• Right to be informed. The right to know how we collect, use, and store your personal data. This includes clear information about the data we collect, the purposes of processing, and the legal basis for doing so in accordance with applicable data protection laws. This is why we will share a privacy notice (such as this one) prior to you disclosing personal data to us. Please read these carefully.
• Right of access. The right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients of that data. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy, we may charge a fee if permissible under local law.
• Right to rectification. The right to rectify or correct inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.
• Right to erasure (right to be forgotten). The right to ask us to erase or delete personal data concerning you. This is not an absolute right but if a request is refused in whole or in part, we will provide reasons for the refusal.
• Right to restriction of processing. In limited circumstances, the right to request that we restrict processing of your personal data, unless we think we have a legitimate interest for processing your data which overrides your request.
• Right to data portability. The right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit that data to another entity.
• Right to withdraw consent. If you have consented to our processing of your personal data, you have the right to withdraw your consent at any time. This includes cases where you wish to opt out from marketing messages that you receive from us. 
• Right to object. The right to object, on grounds relating to your situation, at any time to the processing of your personal data, including profiling, by us and we may be required to stop processing your personal data.
• Rights relating to automated decision-making. Under certain circumstances, the right to request human intervention in relation to an automated decision so that you can express your view and to contest the decision.
• Right to lodge a complaint. When making a complaint to Wella Company, we may request that you put your complaint in writing to assist with our investigation. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint and in accordance with any local legal requirements. If we fail to respond to your complaint within the timeframes set by applicable laws or if you are dissatisfied with the response that you receive from us, you may also have the right to lodge a complaint with the competent data protection supervisory authority, depending on your jurisdiction.

If you would like to confirm which rights apply to you specifically, or to exercise any of these rights as applicable within your jurisdiction, find out more, or lodge a complaint, please contact us via Who can I contact about data privacy?. We may apply any exceptions or other conditions available under applicable privacy laws when responding to any requests submitted to us by you.

For more information about the use of cookies and similar technologies by Wella (including your opt-out choices) please see our Cookie Notice.

We will only send you marketing communications if you consent to this, or if we are otherwise permitted by law (for example, in some jurisdictions we are entitled to send marketing communications to you based on similar Products and Services which you have previously purchased or engaged with). If at any time you decide that you no longer wish to receive marketing communications from us, you may opt out by clicking on the relevant ‘unsubscribe’ link in the communication you receive, or by contacting us via Who can I contact about data privacy?.

You may also unsubscribe from receiving certain text (SMS) or multimedia (MMS) messages by replying “STOP” to the number sending the message. When we engage in SMS communications with you, separate terms we present to you may apply or supplement these terms.

Please note that whilst we will honour your request to stop receiving marketing communications, there may be a short period before your opt-out is fully processed, during which you may still receive some marketing messages. We will, however, continue to send you service-related communications such as emails confirming purchases through the Wella Websites and may keep your information for record keeping purposes (where legally applicable).

Age eligibility and parental authorisation requirements vary by brand and country. Our Wella Websites are intended for individuals who have reached the digital age of consent in their jurisdiction. To find the minimum age for your service, see the applicable Terms of Use for that brand.

If you are under the applicable age, we will require verifiable consent from your parent or legal guardian before processing your personal data where the law requires it. We do not knowingly collect or process personal data of individuals below this age. If we discover such data has been collected, we will delete it promptly. By accessing or using our Wella Websites, you confirm that you meet the applicable age requirement.

If you are under the digital age of consent, please do not use our Wella Company Websites or provide any personal data. If we are made aware that we have received such information, without verification of parental consent, or any information in violation of our policy, we will use reasonable efforts to locate and remove that information from our records. If you require further information, please contact us below.

If you have a parent or guardian and you are aware that your child has provided us with personal data without consent, please contact us below.

We implement appropriate technical and organizational security measures, including physical, administrative and technical safeguards to protect your personal data from unauthorized access, use and disclosure. To ensure the security of your personal data, we communicate our privacy and security guidelines to all Wella Company employees and enforce privacy safeguards within our company.

The measures we use to protect your personal data are designed to provide a level of security appropriate to the risk of processing your personal data. However, please be aware that no electronic transmission of information can be entirely secure. We cannot guarantee that the security measures that we have in place to safeguard personal data will never be defeated or fail, or that those measures will always be sufficient or effective.

We may sometimes link to other third party websites and social media platforms which are not operated by Wella Company. We are not responsible or liable for these websites, any content on them, or their policies and notices. A link does not mean we endorse the views of the linked website or social media platforms. We have no control over the availability of any of these websites or social media platforms. As such, you should read the privacy notices and terms of use for any third-party site you link to from our Wella Websites, including social media platforms and other websites or services particularly with user-generated content features.

If you have any questions regarding this Notice or how we handle your personal data, you may contact our Wella Company Privacy Team and Global Data Privacy Officer using this form. Alternatively, you can email our Global Data Privacy Officer at wella.data.privacy@wella.com.

You can also send postal mail to us at:

Wella Compliance Department, Data Privacy Team

St George's House, 5 St George's Road,

Wimbledon, London SW19 4DR

We may update this document from time to time, for example if we implement new systems or processes that involve a change to the way we use personal data. We will publish an updated Notice here with the 'Last updated' date at the top of this Notice.

Your continued use of our Products and Services after such updates means we will process your personal data in line with the updated Notice. If we are legally required to obtain your consent for updates to this Notice, we will explain this in the local annexes linked here under Applicable Laws.

Please ensure you review the latest version of the Notice, prior to sharing any personal data with Wella Company.

For residents in Argentina only, Annex A applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

The Argentine Data Protection Law No. 25,326, its Regulatory Decree No. 1558/2001 and resolutions and dispositions issued from time to time by the Argentina Data Protection Authority shall apply.

In the event of any conflict between the terms of this Annex A and the terms of the Notice, the terms of this Annex A will govern and control.

Your personal data is stored in a database the responsible for which is Wella Argentina SRL domiciled at OLGA COSSETTINI 1545, PISO: 3 - (1107) CAPITAL FEDERAL (Buenos Aires) – ARGENTINA

What categories of personal data does Wella Company collect about me and how is it used?

Lawful Basis

For residents in Argentina, we will rely on the legal basis of consent, compliance with legal obligations or our contractual relationship with you when processing personal data.

We will not rely on the legal basis of consent when your personal data (i) has been obtained from unrestricted public access sources; and/or (ii) is limited to name, ID number, tax or social security ID number, profession, date of birth and domicile.

The provisions relating to legitimate interests stated in the Notice shall not apply.

If you provide inaccurate personal data, you will not be able to take advantage of some of our Products and Services.

What rights do I have in respect of my personal data?

You acknowledge that the Access to Public Information Agency, as the enforcing authority of Law 25,326, has the power to attend the reports and claims from those who are affected in their rights consequence of non-fulfilment of data protection provisions.

For residents in Australia only, Annex B applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What happens if Wella Company transfers my personal data outside its original country?

For residents in Australia, for a list of the Wella Company entities and third parties that we may share your data with, and the countries they are located in, please contact us as set out below (“Who can I contact about data privacy?”).

For residents of Australia only, the following paragraph will apply in addition to the provisions above in the section "What rights do I have in respect of my personal data?":

When making a complaint. In most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If we fail to respond to your complaint within a reasonable time of receiving it in writing or if you are dissatisfied with the response that you receive from us, you may can make a complaint to the applicable regulator, the Office of the Australian Information Commissioner (OAIC). You can contact the OAIC at:

Email: enquiries@oaic.gov.au

Mail: GPO Box 5288, Sydney NSW 2001

Phone: 1300 363 992

Visit: oaic.gov.au

For residents in Canada only, Annex C applies to the collection, use, and disclosure of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What categories of personal data does Wella Company collect about me and how is it used?

References to “personal data” in the Notice shall mean “personal information” as understood under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) or substantially similar provincial privacy laws in Canada, as applicable.

We will rely on the lawful basis of consent when collecting, using or disclosing personal data, as required under applicable privacy laws. Provisions in the Notice referring to lawful bases other than consent shall not apply if inconsistent with applicable laws in Canada.

What happens if Wella Company transfers my personal data outside its original country?

For a list of the Wella Company entities and third parties that we may share your data with, please contact us as set out below (“Who can I contact about data privacy?”).

How old do I have to be to use the Wella Company Websites?

For residents in Canada’s Province of Quebec only, you must be aged 14 or over to use the Wella Company Websites and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites?” shall accordingly be construed.

For residents in China only, Annex D applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice. References to “data controller” in the above Notice shall mean “personal data processor” as understood under the Personal Information Protection Law of the People’s Republic of China ("PIPL") and/or regulations regarding data privacy.

Introduction

The personal data processor of your personal data is HFC (Shanghai) Cosmetics Co., Ltd. with address at Room 311, 5th Floor, No. 728, South Lingyan Road, Pudong New District, Shanghai.

By providing your personal data to us or interacting with us, you will be deemed as having accepted and fully agreed to be bound by, and you consent to our processing of your personal data in accordance with the above Notice, including the processing of your sensitive personal data and the cross-border sharing of your personal data with recipients located within or outside of China as described in the above Notice.

What categories of personal data does Wella Company collect about me and how is it used?

Lawful Basis

We will rely on the legal basis of your consent and/or other applicable legal bases under PIPL when processing personal data. The provisions relating to legitimate interests stated in the above Notice shall not apply.

Sensitive Personal Data

Among the personal data we collect and process as stated in the “What categories of personal data do Wella Company collect about me and how is it used?” section of the above Notice and the Cookies Notice here, the following may be deemed as sensitive personal data in relation to residents in China: transaction data, communications information, photographs, sensitive biometric data, sensitive health information, behavioural information, images and video recordings, and browsing information.

In each case, we will make sure that the processing of sensitive personal data is necessary to achieve the specific purposes as described above, and our processing of sensitive personal data will be equipped with strict security measures and be conducted in a manner of having the least impact on your personal rights and interests.

What happens if Wella Company transfers my personal data outside its original country?

Where required by the PIPL, the details of the cross-border transfer of your personal data and the overseas recipients will be made available to you upon your request.

How old do I have to be to use the Wella Company Websites?

For China residents only, you must be aged 14 or over to use the Wella Company Websites and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites?” shall accordingly be construed.

For residents in India only, this Annex E applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) shall govern any processing of personal data (a) within the territory of India; or (b) outside the territory of India, if such processing is in connection with any activity relating to offering of goods or services to data subjects within the territory of India (where (a) and (b) shall hereinafter be referred to as “India-governed Personal Data”).

Lawful Basis for Processing

For residents of India or in case of processing of India-governed Personal Data only, the sub-sections “Lawful basis” for each of the uses of circumstances under which personal data may be collected, as set out under the section titled "What categories of personal data does Wella Company collect about me and how is it used?", will be deemed replaced and substituted with the following, to the extent of any conflict:

• Your acceptance of this Privacy Notice denotes free, specific, informed, unconditional and unambiguous consent to such processing of your personal data as set out above, for the purposes set out above, in accordance with the terms of the above Notice read with this Annex D.
• We do this in our legitimate interests (where we consider these are not overridden by your rights), such as to manage our business effectively, or to comply with our legal obligations (e.g. commercial sales and goods law).
• We may also do this to take steps to enter into any contract with you or your employer or to fulfil our obligations under any contract with you (including for our Virtual Try-On Tool services (where available), for example, or Terms of Use).
• We may also do this where you may have voluntarily provided your personal data to Wella Company and have not indicated that you do not consent to the use of such personal data.

What happens if Wella Company transfers my personal data outside its original country?

For residents of India or in case of processing of India-governed Personal Data only, Wella Company will ensure that no transfers of personal data of Indian residents or of India-governed Personal Data shall be made to countries or territories outside of India that are identified as restricted or prohibited territories under the DPDP Act, as notified from time to time by the Government of India. 

What rights do I have in respect of my personal data?

For residents of India or data subjects from whom Wella Company has collected India-governed Personal Data only, sub-sections (a), (b) and (c) of section "What rights do I have in respect of my personal data?" will be deemed amended and substituted as follows:

• Right of access. You have a right to seek information regarding all other persons (including third parties) who may have access to and are processing your personal data that is collected by Wella Company in accordance with the Notice. Such information should include the identity details of such third party controllers or processors of such personal data and a description of the personal data shared by Wella Company with such third parties/persons.
• Right to rectification

You have the right to rectify/complete/update inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

• Right to erasure (right to be forgotten)

You have the right to ask us to erase personal data concerning you.

In addition to the above amendments to the section "What rights do I have in respect of my personal data?" and the remaining rights set out therein, for residents of India or data subjects from whom Wella Company has collected India-governed Personal Data only, the following additional rights shall also be available:

The section will also include the following two further provisions:

• Right to grievance redressal

You have a right to grievance redressal from Wella Company in respect of any act or omission by us in relation to the performance of obligations in relation to (i) the personal data of data subjects; and (ii) exercise of his/her/their rights under the DPDP Act.

• Right to nominees

You have a right to nominate any other individual who shall, in the event of death or incapacity, exercise your rights as a data subject.

How old do I have to be to use the Wella Company Websites?

For residents of India only, you must be aged 18 or over to use the Wella Company Websites and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites?” shall accordingly be construed.

For residents in the Kingdom of Saudi Arabia ("KSA") only, or individuals whose personal data is processed in KSA, Annex F applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For KSA data subjects the Personal Data Protection Law promulgated by Royal Decree No. M/19, dated 09/02/1443H on 24 September 2021 ("PDPL") and its Implementing Regulation and Regulation on Personal Data Transfer outside the Kingdom issued on 22/02/1445H (07/09/2023G) (each the Implementing Regulations and Data Transfer Regulations and together, the "Regulations") and other laws and/or regulations regarding data privacy in KSA apply.

Capitalised terms used below and not defined have the meaning set out in the PDPL and Regulations.

For KSA data subjects only, the data controller of your personal data is Wella Regional Trading FZE, with address 08-137 & 08- 139, Floor 08, The Offices 4 - One Central, Dubai World Trade Centre, Dubai.

What categories of personal data does Wella Company collect about me and how is it used?

With respect to KSA data subjects only, please note that where we obtain your consent to process sensitive categories of data or sensitive health data, we will always obtain your explicit consent. 'Sensitive categories of data' means personal data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown. 'Sensitive health data' means any personal data related to an individual's health condition, whether their physical, mental or psychological conditions, or related to Health Services received by that individual.

We may obtain information from third party sources.

Where we receive information about you from third party sources, we will only do so in accordance with applicable law.

How are advertisements personalized for me?

Where we use your data to provide you with personalized recommendations for our Products and Services, tailor our content to better suit your interests or offer personalised and customised Products and Services, we will always obtain your consent before doing so.

Who will Wella Company share my personal data with?

Where we share your personal data with third parties, we will only do so in accordance with applicable law.

What happens if Wella Company transfers my personal data outside its original country?

As you may expect, some of the recipients we share personal data with may be in countries outside of the jurisdiction which we collect the data from. Some of these countries have a legal regime which provides an adequate level of protection for this data.

If recipients are in countries which do not provide adequate protections for personal data, we will take all necessary measures to ensure that transfers of personal data to these countries are adequately protected as required by applicable data protection law. This may include using appropriate safeguards such as Standard Contractual Clauses. You can ask for a copy of such appropriate safeguards by contacting us as set out in the main body of the Notice.

What rights do I have in respect of my personal data?

You have rights in relation to your personal data. These can be summarised in broad terms as follows:

• Right to access

You have the right to confirm with us whether we process your personal data, and access to your personal data.

• Right to request access

Subject to certain conditions, you have the right to request access to a copy of your personal data in a clear and readable format.

• Right to rectification

You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

• Right to erasure

You may have the right to ask us to erase personal data concerning you, however please note that this is not an absolute right.

• Right to contact the competent authority

You have the right to contact the data protection regulator in the Kingdom of Saudi Arabia if you are not satisfied with our use of your Personal Data or response to the exercise of your rights. The relevant data protection regulator is the Saudi Data and AI Authority (SDAIA). They can be contacted here: https://sdaia.gov.sa/en/Contact/Pages/ContactUs.aspx 

To exercise any of these rights, find out more, or lodge a complaint, please contact us using the details in the main body of the Notice. We may apply any exceptions or other conditions available under law when responding to correction, deletion, or other requests.

• Right to withdraw consent

When relying on your consent to process your Personal Data, you have the right to withdraw your consent at any time by using the mechanisms provided by us to that end or by contacting us as set out in the main body of the Notice. Please be aware that the withdrawal of your consent will not affect the lawfulness of any processing of Personal Data carried out on the basis of your consent prior to withdrawal.

How old do I have to be to use the Wella Company Websites?

For residents in KSA only, you must be aged 18 or over to use the Wella Company Websites and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites?” shall accordingly be construed.

For data subjects in Mexico, the Federal Law for Protection of Personal Data held by Private Parties, and its Regulations ("FDPL") apply. This Annex G applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

Introduction

For Mexico data subjects only, the data controllers of your personal data are as follows:

• HFC Cosmetics S. de R.L. de C.V., with address Montes Urales 424 PBC-106 04A-103 Lomas de Chapultepec V Sección CP 11000 Alcaldía Miguel Hidalgo
• HFC Prestige International S. de R.L. de C.V., with address Montes Urales 424 PBC-106 04A-103 Lomas de Chapultepec V Sección CP 11000 Alcaldía Miguel Hidalgo
• Galeria Productora de Costeticos S. de R.L. de C.V, with address Av. Ferrocarril Norte 100, Col. Caleras de Ameche, 38177, Apaseo el Grande Guanajuato, Mexico
• Wella Mexico S. de R.L. de C.V. (Mexico), with address Av. Ferrocarril Norte 100, Col. Caleras de Ameche, 38177, Apaseo el Grande Guanajuato, Mexico

What categories of personal data does Wella Company collect about me and how is it used?

If you visit and use our Wella Company Websites or purchase our Products and Services;

We collect:

• Transaction information, for example details regarding your transactions with us, including information about the purchases you (or your employer) made and the date and time of the purchase. We may also collect your credit card and payment information. In this case, we will obtain your consent before we collect your financial information for the processing of the transaction.
• Sensitive health information, for example we may collect information about potential medical conditions through our consultations (including our online tools), including data relating to your hair, nail or skin/scalp conditions. We require your consent for the collection and processing of your health data. Therefore, before collecting your health data, we will ask for your consent.

If you sign up for updates or other marketing from Wella Company

Processing your personal data for these purposes is not necessary for the existence, maintenance and compliance of the legal relationship that you may have with us, and you always have the choice not to receive marketing information. For instructions on opting out, please contact us as described in this Privacy Notice.

Lawful Basis

We will rely on your consent for the collection and processing of your personal data. The provisions relating to legitimate interests stated above shall not apply.

How do I stop receiving marketing communications?

We will only send you marketing communications if you consent to this. If at any time you decide that you no longer wish to receive marketing communications from us, you may opt out by clicking on the relevant ‘unsubscribe’ link in the communication you receive, or by contacting us here.

Who will Wella Company share my personal data with?

We note that any of the transfers referred to above, may be national or international.

What rights do I have in respect of my personal data?

• Right of access. You have the right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing, and the recipients or categories of recipients of that data.
• Right to rectification. You may at any time request to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.
• Right to cancelation. You have the right to ask us to cancel and remove your personal data from our records or databases. The cancellation of your personal data will give rise to a blocking period after which the data will be deleted.
• Right to object. You can object to the use of your personal data for specific purposes.
• Right to revoke your consent. You may revoke the consent you have given us for the processing of your personal data. However, not in all cases we will be able to fulfil your request or terminate the use immediately, since due to a legal obligation we may need to continue processing your personal data.
• Limit the usage or disclosure of your personal data.

You may limit how we use or disclose your personal data for advertising or promotion communications.

How old do I have to be to use the Wella Company Websites?

For residents in Mexico only, you must be aged 18 or over to use the Wella Company Websites and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites?” shall accordingly be construed.

For residents in New Zealand only, Annex H applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What rights do I have in respect of my personal data?

• Right to rectification

You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible. If you make a request to rectify or correct of any of your personal information that we hold, you have the right to provide to us a statement of the correction sought (Correction Statement). If we do not make the correction you have requested, you can request that we attach the Correction Statement to the information and we will take reasonable steps to ensure that this occurs.

When making a complaint, in most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If you are dissatisfied with the response that you receive from us, you can refer your complaint to the Office of the Privacy Commissioner (OPC). You can contact the OPC:

• by telephoning – (04) 474 7590 or (09) 302 8680;
• by writing to – PO Box 10 094, The Terrace, Wellington 6143; or
• by submitting an online complaint form, located at the OPC website: www.privacy.org.nz

For residents in Thailand only, Annex I applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For Thai data subjects, the Personal Data Protection Act, B.E.2562 (2019), its subordinate regulations (“PDPA”) and other laws and/or regulations regarding data privacy in Thailand apply.

For residents in Thailand only, if you’re unable to provide certain personal data which is necessary for us to provide our Products and Services to you or as required by law or as required by the contract, we may not be able to provide you with those Products and Services. Additionally, this may affect the compliance with any laws that we or you are obligated to comply with.

What rights do I have in respect of my personal data?

For residents in Thailand only, the section "What rights do I have in respect of my personal data?" will replace and include three further provisions:

• Right to object. Under certain circumstances you may have the right to object, on grounds relating to your situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data.
• Right to withdraw consent. You have the right to withdraw your consents you have given for the processing of your Personal Data any time. The withdrawal of consent will not affect the lawfulness of the collection, use, and/or disclosure of your Personal Data and sensitive data based on your consent before it was withdrawn. If you do not provide consent or your Personal Data (or withdraw) your consent, we may not be able to provide certain or all of our Products and Services to you.
• Right to lodge a complaint. You can complain to a data protection authority or the competent authority where you believe our collection, use, and/or disclosure of your Personal Data is unlawful or noncompliant with applicable data protection law where applicable. We would, however, appreciate the chance to deal with your concerns before you approach the authority, so please contact us in the first instance.

For residents in Türkiye only, Annex J applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For data subjects residing in Türkiye, the Law No. 6698 on the Protection of Personal Data ("LPPD") and other laws and/or regulations regarding data privacy in Türkiye apply.

Your personal data are collected by written and electronic means.

What happens if Wella Company transfers my personal data outside its original country?

In the event that your personal data is transferred abroad, it is transferred in accordance with Article 9 of the LPPD.

What rights do I have in respect of my personal data?

• Right to learn whether your personal data are processed or not;
• Right to request information regarding your data, if your personal data are processed;
• Right to learn the purpose of processing of your personal data, and whether your personal data are used for the intended purposes or not;
• Right to learn the identity of third parties to whom your personal data are transferred in Türkiye or abroad;
• Right to request completion or correction of your data, if your personal data are processed incompletely or inaccurately;
• Right to request deletion or destruction of your personal data;
• If your personal data are corrected, deleted or destroyed, to request notification of these transactions to third parties to whom your personal data are transferred;
• Right to raise objections against any consequences that may arise in disfavour of you as a result of analysis of the processed data solely and exclusively through automatic systems; and
• Right to claim indemnification of your damages and losses, if any, incurred due to illegal or unlawful processing of your personal data.

If you have any question concerning your rights in relation to processing of your personal data please contact us as set out below. The requests in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest.

Who can I contact about data privacy?

If you have any questions regarding this Notice or how we handle your personal data, you may contact our Wella Company Privacy Team and Global Data Privacy Officer using this form.

Alternatively, you can email our Global Data Privacy Officer, Lisa Townsend, at wella.data.privacy@wella.com.

If you are a resident of a US state (excluding California) that has applicable privacy laws, including but not limited to, Colorado, Delaware, Oregon or Virginia, you may have the right to obtain confirmation that we maintain certain personal data relating to you, to verify its content, origin, and accuracy, as well as the right to access your personal data, request  updates or corrections to your personal data, and request deletion or portability of your personal data. You may also have the right to obtain the identities of the third parties to whom we disclose your personal data. You may also request restriction of the processing of your personal data, including for targeted advertising. Additionally, in certain states you may have the right to opt-out of the “sale” of your personal data, as the term is defined under applicable law.

In some states, you can designate an authorized agent to make a request on your behalf. Please note that we may need to retain certain information for recordkeeping purposes, to complete any transactions that you began prior to your request, or for other purposes as required or permitted by applicable law. In any event, should you choose to exercise any of your rights as detailed above, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.

We do not retaliate against customers who exercise any of their rights described in this Notice.

You can exercise your rights for any of the jurisdictions listed above by contacting us as detailed above.

How old do I have to be to use the Wella Company Websites? You must be aged 13 or over to use the Wella Company Websites and our other digital offerings, including our social media. Additionally, the Wella Company Websites are not intended for or directed to the residents of Colorado, Connecticut, Delaware, Maryland, or New Jersey who are under the age of 18 years. For these states, if we become aware that anyone under the age of 18 has provided us with personal information, we will delete the information from our records.

Incentive and Loyalty Programs

We may provide price discounts, coupons, services, and other perks for customers who have opted in to our marketing email lists and otherwise participate in our loyalty programs. Through these offerings, customers may provide us with CA Personal Information, as set out above, depending on how they choose to interact with us when and after they opt-in to our programs. There is no obligation to opt-in and customers may opt-out at any time. The details of each program are contained in the program offering.  Because these program offerings involve the collection of CA Personal Information and offering of certain benefits, they may be considered a “financial incentive” program under CA law. 

The value of any financial incentive we offer is reasonably related to the value of any CA Personal Information you provide to us. The precise value of the CA Personal Information collected will vary and is dependent on a number of factors, including, for example, whether and to what extent you take advantage of any offerings and whether and to what extent you opt out of any offerings.

For residents of California only, Annex K Part II applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

CA Personal Information. Consistent with the "What categories of personal data do Wella Company collect and how is it used?" section above and the Cookies Notice here, we collect certain categories and specific pieces of information about individuals that are considered 'Personal Information' in California (CA Personal Information). Specifically, we collected the following types of CA Personal Information in the preceding 12 months:

• Identifiers: name, title, organization, address, email address, phone number, date of birth, age, gender, and government identifiers.
• Internet or other electronic network activity information: internet protocol (IP) address, your login data, browser type and version, device IDs, time zone setting and location, browser plug-in types and versions, operating system and platform, pages and services you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).
• Audio, electronic, visual, or similar information: phone, audio, or video calls, texts and other digital messaging, emails, and any in-person conversations you have with us.
• Geolocation data: IP address.

Certain CA Personal Information that we collected about you in the preceding 12 months may be considered Sensitive Personal Information within the meaning of California Privacy Law, including:

• Precise geolocation information (only with your permission, in order to provide location services) and
• Social security, driver’s license, state identification card, or passport number (to manage our Customer relationships).

We only use and disclose Sensitive Personal Information as necessary in connection with the performance of services and the provision of goods, compliance with federal, state, or local laws, and as otherwise specified by Section 7027(m).

Sources. We collect certain categories of CA Personal Information either directly from you or from other third parties as described in the "We may obtain information from third party sources" section above. The categories of third parties from whom we collect CA Personal Information include:

• Third-party partners (e.g., IT service providers, analytics service providers);
• Business partners;
• Commercial clients;
• Public sources; and
• Publications.

Purposes of collection and use. We may collect and use CA Personal Information for:

• Business purposes, including:
  • improving our Wella Websites and Products and Services;
  • operating our Wella Websites;
  • providing you with information and Products and Services you request from us, or we think you may be interested in;
  • providing you with location services (only if you ask or allow us to);
  • carrying out and complying with our agreement with the customer;
  • administering and managing our product offering tiers and fees, invoicing, and billing; and
  • complying with our legal obligations, including carrying out required checks on new customers, and to prevent money laundering or fraud.
• Commercial purposes, including:
  • marketing communications (including direct marketing);
  • customer service;
  • providing you with special offers and other information we believe will be of interest to you; and
  • inviting you to participate in surveys and provide feedback to us.

Disclosure of CA Personal Information. We also disclosed your CA Personal Information as follows:

• Business Purposes. We may disclose the above categories of CA Personal Information to third-party partners, third party applications; and other companies or organizations, such as market research firms and data aggregators, for any of the business purposes described above.
• Commercial Purposes. We may share the above categories of CA Personal Information with third-party partners; third party applications;; and other companies or organizations, such as market research firms and data aggregators, for any of the commercial purposes described above.

Sale or Sharing of CA Personal Information.  Selling / sharing of information We disclosed personal information to advertising business partners for the purposes of supporting our advertising efforts.  Our use of online tracking technologies may be considered a “sale” / “sharing” under California law. You can opt out of being tracked by these third parties by clicking the “Your Privacy Choices” link at the bottom of our website and selecting your preferences.

If you are not logged into your account, your request to opt out of “sale” / “sharing” will be linked to your browser identifier only and not linked to any account information because the connection between your browser and the account is not known to us.

You may opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

Categories of personal information disclosed that may be considered “sale” / “sharing”: identifiers, device ID, Internet or other network activity, broad geolocation data (e.g. country or city-level location), and commercial data.

Categories of third parties to whom personal information was disclosed that may be considered “sale”/ “sharing” include advertisers and marketing partners, data analytics providers, and social media networks. To request a list of the specific third parties to whom personal information was disclosed that may be considered “sale”/ “sharing”, you can contact us as set out below.

We do not have actual knowledge that we sell or share for cross-context behavioural advertising, the personal information of California residents under 16 years of age.

Retention of CA Personal Information. We retain your CA Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include (i) for as long as we have an ongoing relationship with you; (ii) as required by a legal obligation to which we are subject to; or (iii) as advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations).

Your Rights under California Privacy Law. Subject to certain exceptions detailed in CA Privacy Law and other applicable laws and regulations, as a California resident, you have the right to: (i) request to know/access your CA Personal Information, including what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You may only exercise your right to know twice within a 12-month period; (ii) request deletion of your CA Personal Information; request correction of your CA Personal Information; ; (iii)request correction of your CA Personal Information; (iv) to limit the use of sensitive personal information. We only collect sensitive personal information, as defined by applicable privacy laws, for the purposes allowed by law or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you. Some of the purposes for the collection and processing of sensitive personal information allowed by law include: to perform the services or provide the goods reasonably expected; to prevent, detect, and investigate security incidents; to resist malicious, deceptive fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions; to ensure the physical safety of natural persons; for short-term, transient use; to perform services on behalf of us; and to verify or maintain the quality or safety of a product or service provided by us;       (v) opt-out of the “sale” or “sharing” of your CA Personal Information, as such terms are defined under California Privacy Law; and (vi) right not to be retaliated against for exercising privacy rights conferred by CA Privacy Law.

Exercising California Consumer Rights. If you are a California resident and wish to request the exercise of these rights as detailed above or have questions regarding the CA Personal Information collected or shared with third parties, please contact us as set out above or call 800-252-4765.

• You may be asked to provide additional proof of identification so that we can verify your identity and validate the request.
• Please note that you are limited by law in the number of requests you may submit per year. In some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the CA Personal Information that we maintain relates to you. In other instances, we may decline to honor your request where an exception under California Privacy Law applies, such as where the disclosure of CA Personal Information would adversely affect the rights and freedoms of another consumer.
• In any case, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.

Authorized Agents. To the extent that you elect to designate an authorized agent to make a request on your behalf, they must provide appropriate documentation including written signed permission from you, proof of your identity, and verification of their identity; or a valid, designated power of attorney as defined under the California Probate Code.

Opt-Out Preference Signals. We respond to opt-out preference signals communicated via the Global Privacy Control and will process such signals with respect to the browser or device communicating the signals, or with respect to you specifically if you have signed onto your Wella account while communicating Global Privacy opt-out preference signals. To use Global Privacy Control opt-out preference signals, please follow the instructions here: https://globalprivacycontrol.org/.

California Shine the Light. We do not disclose CA Personal Information to third parties for such third parties' use for direct marketing purposes. Under California’s Shine the Light law, California residents may request (i) a list of the categories of CA Personal Information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To make a request, please contact us as described above. We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year. 

California’s “Eraser Button” Law. If you are a California resident under 18 years old and a registered user of the Sites, you can request that we remove content or information that you have posted to the ghd Websites. Fulfillment of the request may not ensure complete or comprehensive removal (e.g., if the content or information has been reposted by another user). To request removal of content or information, you can contact us as set out below.

Financial incentive disclosure.  We offer our customers a loyalty program that provides certain perks, such as rewards and exclusive offers. We may also provide other programs, such as sweepstakes, contest, or other similar promotional campaigns (collectively, the “Programs”). When you sign up for one of these Programs, we typically ask you to provide your name and contact information (such as email address and/or telephone number). Because our Programs involve the collection of personal information and offering of certain benefits, they might be interpreted as a “financial incentive” program under California law.

Under California law, the value of your personal information to us is related to the value of the free or discounted products or services, or other benefits that you obtain or that are provided as part of the applicable Program, less the expense related to offering those products, services, and benefits to Program participants.

You may withdraw from participating in a Program at any time by contacting us using the designated method set forth in the applicable Program rules. Visit the terms and conditions page of each Program to view full details, including how to join.