Last updated: January 2025

ghd Global Privacy Notice

Introduction

Welcome to ghd’s website (the "Site"), which is operated by Jemella Limited (trading as ghd). We are called "we", "us", "our", or "ghd" in this Privacy Notice (the "Notice"). ghd is part of Wella Company ("Wella Company") which includes Wella Company International Operations Switzerland S.à.r.l. (our parent company) and its affiliates and subsidiaries. For more information about Wella Company, please see here or you can contact us here.

Wella Company provides beauty products and services (our "services") to consumers and professionals (our "Customers").

This Notice explains how we use information about you if:

You visit and browse our websites and mobile applications ("ghd Websites").
You contact us or engage with one of our promotions.
You contact or engage with us through social media or adverts and content on third party websites.
You sign up for newsletters or other marketing from us.
You purchase products or services directly from ghd or other Wella Company brands (including via their websites, collectively "Wella Company Websites", which includes ghd Websites) or join our loyalty programmes.
You visit our offices, sites, salons, studios, or stores.
You otherwise engage with us, for example by contacting our customer services or consumer affairs teams, attending an education event, tradeshow or other ghd event, or taking part in a survey or competition.

If you're applying for a job at ghd, please see our Global Applicant Privacy Notice each job listing which can be found here.

This Notice provides a global overview of our approach to processing personal data and how we use it in accordance with data privacy laws. Unless otherwise defined in this Notice, capitalized terms used in this Notice have the same meaning as in our Terms of Use.

For residents of the following jurisdictions, this Notice is supplemented by the relevant Annex included at the relevant link:

Australia – Annex A
Canada – Annex B
China – Annex C
New Zealand – Annex D
United States – Annex E

Quick Links

To help you find information quickly on any question you might have, we have set out an index below. Just click on the question you would like answered and you will be taken to the relevant section:

What categories of personal data does ghd collect about me and how is it used?. 2

We may obtain information from third party sources………………………………..7

How are advertisements personalized for me?. 8

Who will ghd share my personal data with?. 9

What happens if ghd shares my personal data outside its original country……………………………….............................................................................9

How long will ghd keep my personal data for?. 9

What rights do I have in respect of my personal data?. 10

How do I stop receiving marketing communications?. 11

How old do I have to be to use the ghd Websites?. 11

How do we protect your information?. 11

Who can I contact about data privacy?. 12

Other websites. 12

Updating this Privacy Notice. 12

Annexes…………………………………………………….………………………………12

What categories of personal data does ghd collect about me and how is it used?

Personal data means any information relating to you from which you are or could be identified. We explain here what personal data we collect about you, how we use it, and the relevant legal reason (called a 'lawful basis') for each way that we use it.

If you visit and use the ghd Websites or purchase our products or services or join our loyalty programmes;

We collect:

· Identification and demographic information, for example your first name, last name, email address, postal address, date of birth, phone number, gender, country of residence, lifestyle/interests, login name, password, loyalty programme information, answers to security questions.

· Information automatically collected, for example your IP address, Device type (i.e. make and model), unique device identification numbers, browser-type; time zone settings, broad geographic location (e.g. country or city-level location); pages accessed and links clicked, how you navigate to and from the ghd Websites and ghd content (such as how you scroll over them, which parts you click and how long you spend on each page), your preferences, the products and/or services that you have viewed or searched for, crashes, download errors and response times and any phone number or social media handle used to call or contact our customer services or consumer affairs teams – for more information, please see our Cookie Notice here.

· Transaction information, for example details regarding your transactions with us, including information about the purchases you (or your employer) made and the date and time of the purchase.

· Information in connection with the performance of a contract, for example your job title, employer, professional qualifications, membership of professional bodies or information obtained from credit reference agencies or other background checks which are required for us to perform a contract we have with you or your employer.

We use this to:

· set up your account and process payments (where we may use our payment service providers for orders made online) or manage orders;

· analyse how individuals use ghd Websites and services, so we can improve the services we offer and the design and functionality of ghd Websites.

· ensure content on ghd Websites is presented effectively for you and for your device.

· provide you with products, information, and services you request from us, or we think you may be interested in.

· provide location services (if you ask or permit us to), so we can deliver content or other services that are dependent on knowing where you are, like checking for fraudulent transfers and transactions, or finding a stockist near you.

· display information, content and advertising for products and services from our Wella Company portfolio of brands on other websites if you visit our Wella Company Websites and opt-in to cookies.

· recommend products or services that we consider may be suited to you.

Lawful basis:

We do this in our legitimate interests (where we consider these are not overridden by your rights), such as to manage our business effectively, or to comply with our legal obligations (e.g. commercial sales and goods law).

We may also do this to take steps to enter into any contract with you or to fulfil our obligations under any contract with you for example, or Terms of Sale and/or our Terms of Use).

Where required, we will ask for your consent (e.g. for non-strictly necessary cookies and sensitive categories of data).

If you contact us or interact with one of our promotions;

We collect:

· Contact information including basic contact information you choose to provide, for example: first and last name, email address and phone number(s), company role/title, company name and address, sector/industry, social media handle.

· Communications information including your correspondence with us. This includes emails, texts and other digital messaging, phone, audio or video calls, and any in-person conversations you have with us.

We use this to:

· contact you if you have asked us to do so, including to respond to your queries, troubleshoot problems, and help with any issues you may have with our services.

· discuss your account and log-in details, and/or verify your identity.

· provide you with information you might request about our products or services.

· provide and administer in-person or virtual events and product demos.

· provide you with technical and other service updates (for example, if we update any Terms of Use).

Lawful basis:

We do this in our legitimate interests (where we consider these are not overridden by your rights), such as to handle your queries and maintain your account, or to comply with our legal obligations.

We may also do this to take steps to enter into any contract with you or to fulfil our obligations under any contract with you (including our Terms of Sale and/or Terms of Use).

Where required, we do this with your consent.

We will never contact you to ask for your password. Please be careful if you receive any communications from people requesting this information.

If you sign up for updates or other marketing from ghd;

We collect:		· Consumer information including how you interact with our products and services, lifestyle/interests, style, and purchases. · Contact information (as explained above). · Marketing preferences what information you would or would not like to receive from us, and if you have opted out of any direct marketing. · Information about your registration / sign-up for example IP address, date and time of registration.
We use this to:		· send you our newsletters, updates, and other marketing material. · send you surveys, campaigns, or other occasional activities. · ask you for feedback, including through surveys and other marketing research. We may send these via emails, text, or other digital messaging, depending on your preferences.
Lawful basis:	Where required, we do this with your consent. In certain circumstances, we may do this in our legitimate interests (where we consider these are not overridden by your rights), such as to offer our products and services to you depending on your interests. You can opt-out of further marketing at any time by selecting the "unsubscribe" link at the end of our marketing emails.

If you visit one of our locations or attend one of our events;

We collect:

· Information you provide when you visit us, for example your appointment details, Contact information (as explained above), and vehicle licence plate number.

· Event information, including registration, attendance and any accessibility requirements and dietary preferences.

· Images and video recordings, including CCTV or if you agree to be photographed at one of our events.

· In certain circumstances, we may receive sensitive health data related to product usage and medical history (such as allergy information and dietary requirements and other features).

· In certain circumstances we may ask our visitors to show a form of identification which is used for verification purposes only and will not be recorded.

· If you use our guest WiFi at one of our locations, we record the device address and log your traffic information including the sites you visited, duration and dates sent/received.

We use this to:

· manage our business, events and tradeshows, for example, and to provide our services to you.

· recommend our products and demonstrate products on you.

· maintain the security of our locations.

· ensure we meet our health and safety obligations and record accidents and incidents.

· develop our products or conduct research, where you have participated in such voluntary consumer research, product development or trials.

Lawful basis:

We do this in our legitimate interests (where we consider these are not overridden by your rights) such as to organise events, or to comply with our legal obligations (i.e. for health and safety, or security and criminal prevention).

We may also require your data to fulfil our obligations under any contract with you or your employer.

Where required, we will ask for your consent (e.g. for sensitive health data or to participate in trials).

If you interact with a ghd page on a social media network;

We collect:

· User profiles, that are created based on your behaviour and interests.

We use this:

· for market research and advertising purposes, for example to target advertisements to you.

Lawful basis:

We do this in our legitimate interests (where we consider these are not overridden by your rights) such as to improve your interaction with ghd.

We may also require your data to enter into or fulfil our obligations under any contract with you.

Where required, we do this with your consent.

You can obtain further information on the processing of your personal data and how to exercise your privacy rights from the respective provider.

We use social media platforms including Meta, Instagram, TikTok, and LinkedIn. If you would like more information or a full list, please contact us as set out below (“Who can I contact about data privacy?”).

If you access or use a social media network or public forum through a ghd Website;

We collect:

· Your social media interactions, for example when you make a 'comment', 'share' or 'like' something on the ghd Websites using a third-party social media plug-in.

· Your communications via public forums, for example for reviews, discussion forums, message boards, photographs, and other public features (“Public Forums").

· Your social media account details, for example your username and social media handle.

· Information automatically collected, for example cookies such as Facebook Pixels, as well your IP address, information about your browser and device, and the web page address of the Site.

We use this to:

· provide a harmonized user experience across ghd Websites and other related websites, including social media sites.

· authenticate you between websites and allow you to sign-in using the same details across websites.

· help us understand your activity including the ghd content you see, whether you have a social media account, and if you are logged into that account so that we may improve the ghd content and the functionality of the ghd Website.

· recommend our products and show you content you might be interested in on the social sites and measure the effectiveness of that content.

Lawful basis:

We do this in our legitimate interests (where we consider these are not overridden by your rights) such as to improve your interaction with the ghd Websites or other websites or services.

We may also require your data to enter into or fulfil our obligations under any contract with you.

Where required, we do this with your consent.

Please note: In each instance, such third party’s privacy policy will apply to your interaction with that website or service. We do not restrict the distribution of personal data that you voluntarily disclose in Public Forums, so please be aware that any information you disclose there may be collected and used by ghd and others. For this reason, we encourage you to refrain from providing or sharing personal data about yourself in the Public Forums. ghd cannot prevent third parties from using such information in a way that may violate this Notice or applicable law.

See also the 'Other websites' section below for more information.

You may not always be required to share the above information, however if you do not provide certain information to us, you may not be able to take advantage of some of our products and services.

We may aggregate and anonymize your information to create customer segments and share with our licensees and partners for analytical purposes (e.g. to share statistics on consumers' characteristics). This kind of data is no longer personal data.

We may obtain information from third party sources:

From time to time, we may receive information about you from third party sources. We will only do this where we have checked that these third parties either have your consent or are otherwise legally permitted or required to share your personal data with us. Examples of this are:

Our social media partners may share with us your user ID for that site, the name, email address and location associated with the user ID and any other information permitted under the privacy policy for that website. We may also share information about you to that social networking site. This is to enhance your experience between platforms, such as to allow you to engage with sites, interact with discussion forums, and sign-in to our Site using your social media log-in details.
Our retailers, distributors and third-party brand partners may pass information to us including any of the data categories listed above such as your name, contact details, information automatically collected via cookies, information in relation to products purchased at their stores, for example, (whether in store or online through their own website or similar), and services requested using their websites and/or applications.
Our technology partners and market research organizations may share information with us, including your browsing patterns, geo-location, and device identifiers.

How are advertisements personalized for me?

We may use your data to provide you with personalized recommendations for our products or services that we think you might like, tailor our content to better suit your interests or, at your request and where available, offer personalized and customized products or services. We will also use your personal data across the Wella Company Websites to provide a seamless user experience. Please see the section "How does ghd use cookies?" in our Cookie Notice here for more information.

Who will Wella Company share my personal data with?

We take care to restrict access to your personal data on a ‘need to know’ basis. Whenever we share your data with a third party, we will implement appropriate measures to ensure it is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

Here is some more information about when we will share your personal data:

Within Wella Company. We have offices located across the globe, which all partially share responsibilities when processing your information to provide you with our services.
Regulators, authorities, and other third parties. Sometimes we may have a legal obligation to share your personal data with regulators, courts, and other authorities (e.g. tax and law enforcement authorities).
Our service providers. Wella Company engages third party service providers to perform functions on Wella Company 's behalf, for example website and data hosting, communication distribution, marketing lists management, customer service, market research, consultants, providing loyalty programmes and IT support and other services. These providers may process your personal data on our behalf, as necessary to perform their support functions, and following our instructions and data protection law.
Acquiring entities. If the Wella Company entity that processes your personal data is sold or transferred, your personal data may be transferred to the new owner.
Third party providers. For example, our retailers, distributors and third-party brand partners, and auditors, legal advisers, and other professional advisers.
Third party advertisers. We may also share aggregated and de-identified information (which can include your email address, usage and/or information collected from cookies) (where appropriate) to our third party advertisers such as Meta and Google, who will match it with data from other sources to understand our customers better and provide us with more accurate analytics, which will help us to target customers with similar interests and enable us to develop our advertising and direct marketing campaigns.

What happens if Wella Company transfers my personal data outside its original country?

As you may expect, some of the recipients we share personal data with may be in countries outside of the jurisdiction which we collect the data from. Some of these countries have a legal regime which provides an adequate level of protection for this data.

If recipients are in countries which do not provide adequate protections for personal data, we will take all necessary measures to ensure that transfers of personal data to these countries are adequately protected as required by applicable data protection law. This may include using appropriate safeguards such as the EU Standard Data Protection Clauses. You can ask for a copy of such appropriate safeguards by contacting us as set out below.

How long will Wella Company keep my personal data for?

We won't keep it for any longer than we need to, either to comply with the law or to ensure that we are complying with our obligations to you. Generally, we will keep personal data for as long as necessary for the original reasons we collected it.

We may keep your personal data for a longer period:

in the event of a complaint,
if we reasonably believe there is a prospect of legal proceedings,
if we are aware of pending or ongoing legal proceedings, or
in some circumstances, if applicable law says we must.

If you opt in to receive marketing from us, we will keep your relevant information for as long as you are receiving marketing. If you later decide to opt out (or object to any other use of your personal information), we may keep a record of your opt-out or objection so we can respect your preferences and demonstrate our compliance.

Where personal data is kept, that period will be determined based on the applicable local law. Please contact us as set out below to request further information.

What rights do I have in respect of my personal data?

You have rights in relation to your personal data. These can differ by country, but can be summarised in broad terms as follows:

Right of access

You have the right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients of that data. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy, we may charge a fee.

Right to rectification

Right to erasure (right to be forgotten)

You may have the right to ask us to erase personal data concerning you. This is not an absolute right but if a request is refused in whole or in part, we will provide reasons for the refusal.

Right to restriction of processing

In limited circumstances, you may have the right to request that we restrict processing of your personal data, unless we think we have a legitimate interest for processing your data which overrides your request.

Right to data portability

You may have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit that data to another entity.

Right to object and rights relating to automated decision-making

Under certain circumstances you may have the right to object, on grounds relating to your situation, at any time to the processing of your personal data, including profiling, by us and we can be required to no longer process your personal data. This may include requesting human intervention in relation to an automated decision so that you can express your view and to contest the decision.

To exercise any of these rights, find out more, or lodge a complaint, please contact us as set out below. We may apply any exceptions or other conditions available under law when responding to correction, deletion, or other requests. You also have the right to lodge a complaint with the competent data protection supervisory authority.

How do I stop receiving marketing communications?

We will only send you marketing communications if you consent to this, or if we are otherwise permitted by law. If at any time you decide that you no longer wish to receive marketing communications from us, you may opt out by clicking on the relevant ‘unsubscribe’ link in the communication you receive, or by contacting us below.

Please note, whilst we will honour your request to stop receiving marketing communications, we will continue to send you service-related communications such as emails confirming purchases through the ghd Websites and may keep your information for record keeping purposes.

How old do I have to be to use the Wella Company Websites?

You must be aged 13 or over to use the Wella Company Websites and our other digital offerings, including our social media.

We take your privacy very seriously and we understand the importance of taking extra precautions to protect the privacy and safety of children who use Wella Company’s products and services. We do not solicit or knowingly collect personal data from children aged 13 and under. If we are made aware that we have received such information, without verification of parental consent, or any information in violation of our policy, we will use reasonable efforts to locate and remove that information from our records.

If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us below.

How do we protect your information?

We understand that you care how your personal data is used and/or shared with others, and we value your trust and seek to safeguard your personal data.

We implement appropriate technical and organizational security measures, including physical, administrative and technical safeguards to protect your personal data from unauthorized access, use and disclosure. To ensure the security of your personal data, we communicate our privacy and security guidelines to all Wella Company employees and enforce privacy safeguards within our company.

The measures we use to protect your personal data are designed to provide a level of security appropriate to the risk of processing your personal data. However, please be aware that no electronic transmission of information can be entirely secure. We cannot guarantee that the security measures that we have in place to safeguard personal data will never be defeated or fail, or that those measures will always be sufficient or effective.

Who can I contact about data privacy?

If you have any questions regarding this Notice or how we handle your personal data, you may contact ghd using this form (stating “My Privacy” as your contact reason) .

Alternatively, you can email our Global Data Privacy Officer, Lisa Townsend, at wella.data.privacy@wella.com.

Other websites

We may sometimes link to other websites. We are not responsible or liable for these websites, any content on them, or their policies and notices. A link does not mean we endorse the views of the linked website. We have no control over the availability of any of these websites. As such, you should read the privacy notices and terms of use for any third-party site you link to from the ghd Websites, including social media platforms and other websites or services with user-generated content features.

Updating this Privacy Notice

We may update this document from time to time, for example if we implement new systems or processes that involve a change to the way we use personal data. We will publish an updated Notice here with the 'Last updated' date at the top of this Notice.

Annex A – Supplementary Privacy Notice for Australian Residents

For residents in Australia only, Annex A applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What rights do I have in respect of my personal data?

For residents of Australia only, the following paragraph will apply in addition to the provisions above in the section "What rights do I have in respect of my personal data?":

When making a complaint. In most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If we fail to respond to your complaint within a reasonable time of receiving it in writing or if you are dissatisfied with the response that you receive from us, you may have the right, depending on the jurisdiction, to make a complaint to the applicable regulator.

Annex B – Supplementary Privacy Notice for Canada Residents

For residents in Canada only, Annex B applies to the collection, use, and disclosure of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What categories of personal data does Wella Company collect about me and how is it used?

For residents in Canada only, references to “personal data” in the Notice shall mean “personal information” as understood under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) or substantially similar provincial privacy laws in Canada, as applicable.

For residents in Canada only, we will rely on the lawful basis of consent when collecting, using or disclosing personal data, as required under applicable privacy laws. Provisions in the Notice referring to lawful bases other than consent shall not apply if inconsistent with applicable laws in Canada.

What happens if Wella Company transfers my personal data outside its original country?

For residents in Canada’s only, for a list of the Wella Company entities and third parties that we may share your data with, please contact us as set out below (“Who can I contact about data privacy?”).

How old do I have to be to use the Wella Company Websites?

For residents in Canada’s Province of Quebec only, you must be aged 14 or over to use the Wella Company Websites and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

Annex C – Supplementary Privacy Notice for China Residents

For residents in China only, Annex C applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For China data subjects the Personal Information Protection Law of the People’s Republic of China ("PIPL") and other laws and/or regulations regarding data privacy in the People’s Republic of China apply.

Introduction

For residents in China only, the data controller of your personal data is HFC (Shanghai) Cosmetics Co., with address Ltd. Room 311, 5th Floor, No. 728, South Lingyan Road, Pudong New District, Shanghai.

By providing your personal data to us or interacting with us, you will be deemed as having accepted and fully agreed to be bound by, and you consent to our processing of your personal data in accordance with this Notice, including the processing of your sensitive personal data and the cross-border sharing of your personal data with recipients located within or outside of China as described in this Notice.

What categories of personal data does Wella Company collect about me and how is it used?

Lawful Basis

For residents in China, we will rely on the legal basis of consent when processing personal data. The provisions relating to legitimate interests stated above shall not apply.

Sensitive Personal Data

The following paragraph will also apply to China residents in relation to sensitive personal data:

Among the personal data we collect and process as stated in the "What categories of personal data do Wella Company collect and how is it used?" section above and the Cookie Notice here, the following may be deemed as sensitive personal data in relation to residents in China:

(a) transaction information (including information about the purchases you made and the date and time of the purchase),

(b) photos, images and video recordings (to the extent containing your facial features),

(c) sensitive health data/information as detailed above, and

(d) communications information including your correspondence with us.

In each case, we will make sure that the processing of sensitive personal data is necessary to achieve the specific purposes as described above, and our processing of sensitive personal data will be equipped with strict security measures and be conducted in a manner of having the least impact on your personal rights and interests.

Who will Wella Company share my personal data with?

You may contact us as set out below to obtain information regarding the third parties who act in the capacity of independent data controllers and with whom we share your personal data (to the extent required under applicable law).

What happens if Wella Company transfers my personal data outside its original country?

For China residents only, the following paragraph will apply in addition the provisions above in the section "What happens if Wella Company transfers my personal data outside its original country?":

Your personal data may be transferred to or processed by Wella Company International Operations Switzerland S.à.r.l. and its affiliates and subsidiaries located outside of China for the specific purposes of processing set out in the "What categories of personal data do Wella Company collect and how is it used?" section. We will take measures to protect your information in accordance with applicable law. Where required by applicable law, the details of the cross-border transfer of your personal data and the overseas recipients will be made available to you upon your request.

How old do I have to be to use the Wella Company Websites?

For China residents only, you must be aged 14 or over to use the Wella Company Websites and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Wella Company Websites” shall accordingly be construed.

Annex D – Supplementary Privacy Notice for New Zealand Residents

For residents in New Zealand only, Annex D applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What rights do I have in respect of my personal data?

For residents of New Zealand only, paragraph “(b) Right to rectification” in the section "What rights do I have in respect of my personal data?" is replaced with the following:

Right to rectification

You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible. If you make a request to rectify or correct of any of your personal information that we hold, you have the right to provide to us a statement of the correction sought (Correction Statement). If we do not make the correction you have requested, you can request that we attach the Correction Statement to the information and we will take reasonable steps to ensure that this occurs.

For residents of New Zealand only, an additional new paragraph is to be added to the end of the section "What rights do I have in respect of my personal data?" as follows:

When making a complaint, in most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If you are dissatisfied with the response that you receive from us, you can refer your complaint to the Office of the Privacy Commissioner (OPC). You can contact the OPC:

by telephoning – (04) 474 7590 or (09) 302 8680;
by writing to – PO Box 10 094, The Terrace, Wellington 6143; or
by submitting an online complaint form, located at the OPC website: privacy.org.nz

Annex E Part I - Supplementary Privacy Notice for United States Residents (excluding residents of California)

For residents in the United States (excluding California) only, Annex E Part I applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What rights do I have in respect of my personal data?

For residents of the United Sates (excluding California) only, the section "What rights do I have in respect of my personal data?" will include two further provisions:

Right to opt-out of processing for certain purposes

Under certain circumstances, you may have the right to opt-out of processing for purposes of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

Right to appeal

Under certain circumstances, you may have the right to appeal denial of the rights as described above.

Annex E Part II – Supplementary Privacy Notice for California Residents

For residents of California only, Annex E Part II applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

CA Personal Information. Consistent with the "What categories of personal data do Wella Company collect and how is it used?" section above and the Cookie Notice here, we collect certain categories and specific pieces of information about individuals that are considered 'Personal Information' in California (CA Personal Information). Specifically, we may collect the following types of CA Personal Information:

Identifiers:name, title, organization, address, email address, phone number, date of birth, age, gender, and government identifiers.
Internet or other electronic network activity information: internet protocol (IP) address, your login data, browser type and version, device IDs, time zone setting and location, browser plug-in types and versions, operating system and platform, pages and services you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).
Audio, electronic, visual, or similar information: phone, audio, or video calls, texts and other digital messaging, emails, and any in-person conversations you have with us.
Geolocation data: IP address.

Certain CA Personal Information that we collect about you may be considered Sensitive Personal Information within the meaning of California Privacy Law, including geolocation information (only with your permission, in order to provide location services) and government identifiers (to manage our Customer relationships).

We only use and disclose Sensitive Personal Information as necessary in connection with the performance of services and the provision of goods, compliance with federal, state, or local laws, and as otherwise permitted by CA Privacy Law.

Sources. We collect certain categories of CA Personal Information either directly from you or from other third parties as described in the "We may obtain information from third party sources" section above. The categories of third parties from whom we collect CA Personal Information include:

Third-party partners (e.g., IT service providers, analytics service providers);
Business partners;
Commercial clients;
Public sources; and

Purposes of collection and use. We may collect and use CA Personal Information for:

Business purposes, including:
- improving our Wella Company Websites and services;
- operating our Wella Company Websites;
- providing you with information and services you request from us, or we think you may be interested in;
- providing you with location services (only if you ask or allow us to);
- carrying out and complying with our agreement with the Customer;
- administering and managing our product offering tiers and fees, invoicing, and billing; and
- complying with our legal obligations, including carrying out required checks on new customers, and to prevent money laundering or fraud.
Commercial purposes, including:
- marketing communications (including direct marketing);
- customer service;
- providing you with special offers and other information we believe will be of interest to you; and
- inviting you to participate in surveys and provide feedback to us.

Disclosure of CA Personal Information. We also share and/or disclose your CA Personal Information as follows:

Business Purposes. We may disclose the above categories of CA Personal Information to third-party partners, third party applications; and other companies or organizations, such as market research firms and data aggregators, for any of the business purposes described above.
Commercial Purposes. We may share the above categories of CA Personal Information with third-party partners; third party applications; advertising service providers and partners; and other companies or organizations, such as market research firms and data aggregators, for any of the commercial purposes described above.

Retention of CA Personal Information. We retain your CA Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include (i) for as long as we have an ongoing relationship with you; (ii) as required by a legal obligation to which we are subject to; or (iii) as advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations).

Your Rights under California Privacy Law. Subject to certain exceptions detailed in California law and other applicable laws and regulations, as a California resident, you have the right to: (i) request to know/access your CA Personal Information, including the specific pieces and the categories of CA Personal Information we have collected or shared about you and the categories of sources from which we have collected the CA Personal Information; (ii) request deletion of your CA Personal Information; (iii) receive information about the CA Personal Information about you that we have "sold" to (as such term is defined under California law) or “shared” with third parties within the past twelve (12) months, including the categories of third parties; and (iv) request correction of your CA Personal Information; and (iv) opt-out of the “sale” or “sharing” of your CA Personal Information, as such terms are defined under California Privacy Law.

Exercising California Consumer Rights. If you are a California resident and wish to request the exercise of these rights as detailed above or have questions regarding the CA Personal Information collected or shared with third parties, please call 800-252-4765.

You may be asked to provide additional proof of identification so that we can verify your identity and validate the request.
Please note that you are limited by law in the number of requests you may submit per year. In some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the CA Personal Information that we maintain relates to you. In other instances, we may decline to honor your request where an exception under California Privacy Law applies, such as where the disclosure of CA Personal Information would adversely affect the rights and freedoms of another consumer.
In any case, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.

Authorized Agents. To the extent that you elect to designate an authorized agent to make a request on your behalf, they must provide appropriate documentation including written signed permission from you, proof of your identity, and verification of their identity; or a valid, designated power of attorney as defined under the California Probate Code.

Do Not Track. Your browser or extension may allow you to automatically transmit Do Not Track signals. Except as required by law, we do not respond to such signals.

What rights do I have in respect of my personal data?

For residents of California only, the section "What rights do I have in respect of my personal data?" will include the following provisions:

California residents have the right to request (subject to certain exceptions detailed in California Privacy Law):

deletion of your CA Personal Information;
correction of inaccurate CA Personal Information;

the right to know / access the categories of CA Personal Information that we collect about you, including the specific pieces of CA Personal Information;

the categories of CA Personal Information disclosed for a business purpose; and
information about the categories of CA Personal Information about you that we have shared (as such term is defined under CA Privacy Law) and the categories of third parties to whom the CA Personal Information was shared.