U.S. STATE PRIVACY NOTICE

 U.S. STATE PRIVACY NOTICE

This U.S. State Privacy Notice ("State Notice") supplements the information in our Privacy Statement above and applies to residents of U.S. states with generally applicable consumer privacy laws, including (without limitation) California, Colorado, Connecticut, Virginia, Utah, Texas, Montana, Oregon, Florida, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Nebraska, and Rhode Island (each, a "Covered State"). We will extend this State Notice to residents of additional states as further state privacy laws take effect. When we use the term "personal data" in this State Notice, we include "personal information" as that term is defined under applicable state privacy laws. Any capitalized terms defined in applicable state privacy laws and used in this State Notice have the same meaning as in those laws.

A. Categories of Personal Data We Collect

We collect (and have collected within the preceding 12 months) the following categories of personal data:

·         Identifiers, including name, alias, email address, phone number, physical/shipping address, unique personal identifier, online identifier (including social media usernames), IP address, and similar identifiers.

·         Customer Records, including contact information, customer numbers, purchase order numbers, and purchase history.

·         Commercial Information, including records of products purchased, obtained, or considered.

·         Internet or Other Electronic Network Activity, including browsing history, clickstream data, search history, and information regarding your interactions with our Website, our advertisements, or our emails.

·         Geolocation Data, including general location information derived from your IP address, and, where enabled by you, precise location information from your device.

·         Audio, Electronic, Visual, or Similar Information, including call recordings if you contact our customer service department on a recorded line.

·         Inferences, including inferences drawn from the information described in this State Notice to reflect your preferences, characteristics, and behaviors.

·         Protected Classification Characteristics, including gender, age, and date of birth (collected in connection with account registration).

·         Sensitive Personal Data, including precise geolocation information (collected only where you have enabled location sharing on your device). We do not collect, use, or disclose sensitive personal data beyond the purposes authorized by applicable state privacy law.

Personal data does not include publicly available information lawfully made available from government records, information you have made publicly available and not restricted to a specific audience, or information otherwise excluded from the scope of applicable state privacy laws.

B. Sources of Personal Data

We generally collect personal data from the following categories of sources:

·         Directly or indirectly from you (for example, through your use of the Website, account registration, purchases, and communications with us);

·         Affiliates and group companies (acting as service providers);

·         Business partners;

·         Internet service providers;

·         Operating systems and platforms; and

·         Vendors and service providers.

C. Purposes for Collecting and Disclosing Personal Data

As described in Sections 4 and 5 of our Privacy Statement above, we collect and process personal data for the following business and commercial purposes:

·         Providing, supporting, and improving our Website and products;

·         Processing purchases, payments, and fulfillment;

·         Opening and managing user accounts;

·         Direct marketing (email and SMS);

·         Collecting and publishing product reviews;

·         Communicating with you and providing customer support;

·         Analytics and research;

·         Security, fraud detection, and protection of rights;

·         Compliance with legal obligations;

·         Establishing, exercising, or defending legal claims;

·         Auditing, reporting, and other internal operations; and

·         General business and operational support, including mergers, acquisitions, and other business transactions.

 

D. Disclosure of Personal Data to Third Parties

Category of recipient	Categories of personal data disclosed	Business/commercial purpose	Sale / Share / Targeted Advertising?
Affiliates and group companies (incl. KIKO S.p.A. as service provider)	Identifiers; Customer Records; Commercial Information; and other categories needed for operations	Operational support such as accounting, logistics, and IT infrastructure, under a Data Processing Agreement	No
IT and website hosting / CMP providers (e.g., Shopify, Pandectes)	Identifiers; Internet or Other Electronic Network Activity; consent records	Website hosting and management of the consent management platform for cookies and tracking tools	No
Payment providers (e.g., VISA, Mastercard, Amex, Discover, Diners Club, PayPal, Amazon Pay, Apple Pay, Google Pay, Klarna, Shop Pay)	Identifiers; Customer Records; Commercial Information (payment, billing, and purchase data)	Processing purchases and payments	No
Shipping and logistics providers	Identifiers (name, shipping address, phone); Customer Records	Order fulfillment, delivery, and home shipment	No
Email delivery and SMS marketing providers (e.g., Klaviyo)	Identifiers (name, email, mobile number); marketing preferences and consent records	Delivering email and SMS marketing communications	No
Customer support providers (e.g., Gorgias)	Identifiers; Customer Records; communications content; Audio/Visual information (call recordings)	Responding to inquiries, handling complaints, and providing support	No
Data analytics and processing providers (e.g., Google Analytics)	Internet or Other Electronic Network Activity; Identifiers (online identifiers); Inferences	Website analytics, performance measurement, and improvement	Yes
Review management providers	Identifiers (name or username); review text; uploaded images	Publishing and managing product reviews	No
Marketing and advertising networks	Identifiers; Internet or Other Electronic Network Activity	Cross-context behavioral / targeted advertising	Yes
Social media platforms (e.g., Meta, TikTok, Pinterest, Snapchat)	Identifiers; Internet or Other Electronic Network Activity (IP address, browser type, browsing activity)	Advertising and analytics via pixels and similar tools	Yes
Internet service providers / operating systems and platforms	Device and Browsing Information; Internet or Other Electronic Network Activity	Delivery and operation of the Website	No
Professional advisors (legal, tax, compliance, auditors)	Identifiers; Customer Records; and other categories as relevant to the matter	Legal, tax, audit, compliance, and defense of legal claims	No

 

E. Sales, Sharing, and Targeted Advertising

Certain state privacy laws define "sale" as disclosing or making available personal data to a third party in exchange for monetary or other valuable consideration, and "sharing" or "targeted advertising" as disclosing or making available personal data to a third party for purposes of cross-context behavioral advertising.

While we do not disclose personal data to third parties in exchange for monetary compensation, we "sell" or "share" personal data, or use personal data for "targeted advertising," as those terms are defined under applicable state privacy laws, by disclosing the following categories to third-party advertising networks, analytics providers, and social media platforms for marketing and advertising purposes: Identifiers and Internet or Other Electronic Network Activity.

We do not sell or share, or use for targeted advertising, personal data about individuals we know are under the age of 16.

F. Your Privacy Rights

Residents of Covered States may have the following rights regarding their personal data, subject to certain exceptions and qualifications under their respective state laws. We will not discriminate against you for exercising any of these rights.

·         Right to Know / Access. You may have the right to confirm whether we process personal data about you, and to request details about the categories of personal data we have collected, the categories of sources, the purposes for collection, the categories of recipients, and the specific pieces of personal data we have collected about you. You may also have the right to receive a copy of your personal data in a portable, readily usable format.

·         Right to Correction. You may have the right to request that we correct inaccurate personal data we hold about you.

·         Right to Deletion. You may have the right to request that we delete personal data we have collected about you, subject to certain exceptions (for example, where we are required to retain the data to comply with a legal obligation or to complete a transaction).

·         Right to Opt Out of Sale, Sharing, or Targeted Advertising. You have the right to opt out of the 'sale' or 'sharing' of your personal data, and to opt out of the use of your personal data for 'targeted advertising,' as those terms are defined under applicable state privacy laws. You may opt out of the sale, sharing, or use for targeted advertising of your personal data by clicking the 'Reject All' link in the cookie banner, clicking 'Reject Non-Functional' in Your Privacy Choices located in the footer of our Website, by using a Global Privacy Control (GPC) signal (see Section 8 of our Privacy Statement), or by submitting a request using the contact information in Section.

·         Right to Limit Use of Sensitive Personal Data. We do not engage in uses of sensitive personal data that would trigger a right to limit use and disclosure under applicable state privacy law.

·         Right to Opt Out of Profiling with Legal or Significant Effects. We do not engage in automated profiling that produces legal or similarly significant effects as defined under applicable state privacy law.

·         Non-Discrimination. We will not deny you goods or services, charge you different prices, or provide you with a different level or quality of service because you have exercised your privacy rights.

G. Exercising Your Privacy Rights

To exercise any of the privacy rights described in this State Notice, please submit a request by:

Emailing us at: privacykikous@kikocosmetics.com

Completing our webform at: https://us.kikocosmetics.com/pages/contact We will confirm receipt of your request within 10 business days (or as required by your state's law), and we will respond to your request within 45 days. If we need additional time to respond, we will notify you within the initial response period and explain the reason for the extension. We may respond within 90 days in total where permitted by applicable law.

·         To verify your identity, we will need your first and last name, email address, and, if applicable, your customer number. In some cases, we may request additional information. If we are unable to verify your identity after a good faith attempt, we may deny the request and will explain the basis for the denial.

·         Unless otherwise required by applicable state law, you may submit a request for access or data portability up to twice within a 12-month period.

Authorized Agents. You may designate an authorized agent to submit requests and act on your behalf. For security purposes, authorized agents will be required to provide proof of their authorization in their first communication with us, and we may require the relevant consumer to directly verify their identity and the agent's authority.

H. Right to Appeal

If we deny or reject your privacy rights request, you may have a right to appeal our decision under your state's privacy law. To appeal, please contact us at privacykikous@kikocosmetics.com with the subject line "Request to Appeal Privacy Rights Decision" and include sufficient information to locate your original request, such as any unique reference number provided to you. Our privacy office will review your appeal, our original determination, and will inform you of the outcome.