This Privacy Policy (“Policy”) describes the processing of information Combe Incorporated, and our affiliated and subsidiary companies and brands, collects from you including through our websites, applications, email communications, social media pages, and other interactive features and online services (“Services”), unless a separate privacy policy is specifically referenced or posted. It also describes rights you may have under applicable laws. To the extent that you provide us with information offline this Policy applies if we provide you with a link to this Policy or information on how to access it.

UPDATES TO THIS PRIVACY POLICY

Please note that we may change or update this Policy from time to time, so please review it periodically. The “Last Updated” legend at the top of this Policy indicates the last revisions of this Policy. Unless otherwise indicated, any changes become effective when we post the revised Policy on the Services. If we make material changes to how we treat Personal Information, we will notify you according to applicable law. We may also provide notice of changes to this Policy in other ways, such as through the contact information you have provided. Your continued use of the Services following these changes means that you accept the revised Policy to the fullest extent allowed by applicable law. Note, that in order to continue to use the Services you may need to affirmatively consent to our new policies. You are responsible for periodically checking the Services and this Policy to check for any changes.

INFORMATION WE MAY COLLECT 

We collect information from you in a variety of ways. Some of this information may be considered “Personal Information” under various applicable laws. Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. 

The categories of Personal Information we collect may include: 

• Contact Information – If you submit an inquiry, register for an account, or provide information on or through our Services, we may collect your contact information including your name, mailing address, email address, and phone number.
• Commercial Information – If you submit an inquiry, or provide information on our Services, we may collect commercial information including information about your purchases, subscriptions, and Services you have shown interest in.
• Usage Information – When you use our Services, we may automatically record information, including your Internet Protocol address (IP Address), geolocation of your device, browser type, referring URLs (e.g., the website you visited before our Services), domain names associated with your internet service provider, and any other information regarding your interaction with our Services.
• Communication Information – We may collect Personal Information contained within your communications with us via email, chat functionality, social media, telephone, or otherwise, and in certain cases we may use third-party service providers to do so. Where permitted by applicable law, we may collect and maintain records of calls and chats with our agents, representatives, or employees via message, chat, post, or similar functionality.
• Account Information – We may also collect information regarding your account with Combe (such as your user account ID and password).
• Photo – If you utilize our Virtual Try-on feature you are voluntarily providing us with a photograph of you for the purposes of the Virtual Try-on session.

HOW WE COLLECT INFORMATION

Information You Provide To Us Directly

This is information that you voluntarily provide as part of interacting with Combe. For example, we may ask you to provide information in order to fulfill your request for information, a product or support, such as when you sign-up for our newsletter or make a purchase. 

In certain circumstances we may collect information from you “offline”, such as when you contact Combe’s Consumer Resources department for support.

If you submit any personal information to us relating to other individuals or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Policy.

Information Collected Automatically

We and third party analytics and advertising companies and other business partners may use cookies and similar  technologies that automatically or passively collect certain information whenever you access our Services or otherwise interact with us or our content. For additional information regarding our use of these technologies, see the Cookies section below. 

Cookies and Other Tracking Technologies

We and our service providers may use cookies and similar technologies to collect usage and browser information about how you use our Services. We and our third party business partners process  this information collected through such technologies, which may include or be combined with Personal Information, for security purposes, to see how people use our Service and facilitate navigation, to display information and personalize your experience while using the Services, and to recognize your computer in order to assist your experience with our Services. We also gather statistical information to improve their design and functionality, understand how they are used, and assist us with resolving questions regarding them.

Website Delivery and Appearance – We may use third party providers to enable certain customer interaction opportunities, content delivery, or other service capabilities. Examples include, but are not limited to, the following functionality: 

• Chat-based Customer Support: We use a live chat feature to enable live customer service and technical support via our website. When you engage in the live chat, we will automatically collect and share certain information (such as personal identifiers, usage information, and message content) with the chat provider to provide the customer service and technical support enabled by the live chat tool. 

Website Analytics and Session Replay – We use analytics and session replay services that use cookies and other technologies that collect your Personal Information, to assist with analyzing traffic and usage on our website to optimize, maintain, and secure our website and inform subsequent business decisions (including e.g., advertising). These include, but are not limited to, the following third-party services: 

• Google Analytics: To learn more about how Google uses data, visit Google’s Privacy Policy and Google’s page on “How Google uses data from sites or apps that use our services.” You may download the Google Analytics Opt-out Browser Add-on for each web browser you use, but this does not prevent the use of other analytics tools. To learn more about Google Analytics cookies, visit Google Analytics Cookie Usage on Websites. 

• Meta Pixels: We use Meta pixels to track user activity on our Site and improve downstream offerings, including interest-based advertising for our services and those of our partners and service providers.

Interest-Based Advertising – We may also allow or enable third parties to collect Personal Information to provide their interest-based advertising on behalf of our products and services, or their own. Interest-based advertising occurs when advertisements are shown to you based on information collected from your online interactions over time and across multiple websites, devices, or online services that you visit or use. Some companies may engage in cross-context behavioral advertising to predict your preferences and show you advertisements that are most likely to be of interest or relevant to you. We do not control these third parties' collection or use of your information for these purposes, or the opt-out options they may individually offer you via their terms, conditions, and privacy policies. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. Examples of the third-party service providers we engage to serve interest-based advertisements include Google Ads (including Google Dynamic Remarketing and DoubleClick), Meta Ads (including Meta Pixels and Facebook advertising services), LinkedIn marketing solutions (including LinkedIn Ads and Analytics), and Microsoft Advertising. 

Selling or Sharing Personal Information – While we do not sell Personal Information in exchange for monetary consideration, we do share Personal Information for other benefits that could be deemed a “sale” or “sharing” under various data protection laws, because they are sometimes broadly defined to include activities such as the delivery of interest-based advertising on websites or allowing third parties to receive certain information, such as cookies, IP address, and/or browsing behavior. We similarly engage in interest-based advertising when we use data about your activities on our Site to serve you ads on websites owned or controlled by third parties. It is in this context that we have provided advertising networks, data analytics providers, social networks, and video sharing platforms with Personal Information such as your IP address, device information, Internet and other electronic network activity information, and geolocation information in the last twelve months.

Cookie Choices – You can adjust your cookie settings via Cookies Preferences or most browsers allow you to disable cookies, either by website or overall, either automatically or on a case-by-case basis at a particular website. For more information about cookies the following website is a good starting point: http://www.allaboutcookies.org/manage-cookies/index.html. You should also acquaint yourself with your browsers’ privacy and data settings.

Note, if you choose to disable cookies on your device, you may experience some inconvenience in your use of the Services or some features may not function properly. For example, we may not be able to recognize your computer, and you may need to log-in every time you visit. You also may not receive advertising or other offers from us that are relevant to your interests – we leave the choice up to you.

We may use a variety of companies to serve our advertisements. Some of these companies are members of the Network Advertising Initiative (“NAI”) or the Digital Advertising Alliance (“DAA”) Self-Regulatory Program for Online Behavioral Advertising and you may want to visit the following webpages, which provide “opt-out” mechanisms for participating companies: http://networkadvertising.org/managing/opt_out.asp and http://www.aboutads.info/choices/.

You may opt-out from interest based advertising on your mobile device through your mobile device settings. Please note opting out through these mechanisms does not opt you out of being served advertising and you will continue to receive generic ads while online.

Please see Exercising Your Privacy Rights section below for more information on how to opt out. 

Information Third Parties Provide About You

Combe may receive information about you from third parties, including but not limited to business partners, advertising networks, social networks, mobile device providers, Internet or mobile service providers, data providers.  We may supplement the information we collect with outside records from third parties, such as public databases, publicly available web pages, and third parties who enhance the information we have about you. We use this information to better provide you with information and products, to tailor our content and the offers we show you, and for other business purposes.

Links to Third Party Websites and Social Media Interactions

We are not responsible for the practices employed by any websites or services linked to or from our Services, including the information or content contained within them. We encourage you to investigate and ask questions before disclosing Personal Information to third parties, since any Personal Information disclosed will be handled in accordance with the applicable third party’s privacy policy. 

The Services may link to our pages on an interactive third party website or and may facilitate interactions with third party social media, such giving you the opportunity to “like” or “share” content. You may also be able to log-in through or otherwise connect your account on a social media service (e.g., Facebook or Twitter). When you interact with social media through our Services, we will receive information about you from that third-party service and they may set their own cookies and collect information about your use of the Services, including your IP address or other Device Identifier and which page you are visiting on the Services. Your interactions with social media and postings on social media are subject to the policies and terms of the third party social media company.

HOW WE USE INFORMATION

To the extent permitted by applicable law Combe (as well as service providers who act on our behalf and other business partners) may use Personal Information for the following purposes:

Providing the functionality of the Services and fulfilling your requests.

• To provide the Services’ functionality to you.
• To respond to your inquiries and fulfill your requests, such as to send you newsletters.
• To complete and fulfill your purchase.
• To send administrative information to you, such as changes to our terms, conditions, and policies.
• To provide you with related customer service.
• We engage in these activities at your request, to manage our contractual relationship with you, to conduct our business and/or to comply with a legal obligation.
• If you do not provide us with certain information that we request, we may not be able to provide you with the requested Services.

Providing you with our newsletter and/or other marketing materials.

• To send you marketing related emails or other communications, with information about our company and our products, services, and offers.
• We will engage in this activity only with your consent.

Analytics and analysis for business reporting and providing targeted advertising and personalized services.

• To analyze or predict our users’ preferences in order to prepare aggregated trend reports on how our Services are used, so we can improve our Services.
• To better understand you, so that we can personalize our interactions with you and provide you with information, advertisements and/or offers tailored to your interests.
• To better understand your preferences, so that we can deliver content via our Services that we believe will be relevant and interesting to you.
• We provide personalized services in accordance with applicable law. In the EU, we do so either with your consent or because we have a legitimate interest.

Allowing you to participate in polls, sweepstakes, contests, or promotions or similar activities.

• We may offer you the opportunity to participate in polls, sweepstakes, contests, and similar promotions.
• Some of these activities have additional rules containing information about how we will use and disclose your personal information.
• We use your personal information in this context to manage our contractual relationship with you, to conduct our business and/or to comply with a legal obligation.

Accomplishing our business purposes.

• For data analysis, for example, to improve the efficiency of our Services;
• For audits, to verify that our internal processes function as intended and are compliant with legal, regulatory, or contractual requirements;
• For fraud and security monitoring purposes, for example, to detect and prevent cyberattacks or attempts to commit identity theft;
• For developing new products and services;
• For enhancing, improving, or modifying our current products and services;
• For identifying usage trends, for example, understanding which parts of our Services are of most interest to users;
• For determining the effectiveness of our promotional campaigns, so that we can adapt our campaigns to the needs and interests of our users; and
• For operating and expanding our business activities, for example, understanding which parts of our Services are of most interest to our users so we can focus our energies on meeting our users’ interests.
• We will engage in these activities to manage our contractual relationship with you, to conduct our business, to comply with a legal obligation, and/or because we have a legitimate interest.

As part of a corporate transaction, such as in connection with the sale of part or all of our assets or business, the acquisition of part or all of another business or another business’ assets, or another corporate transaction, including bankruptcy.

We may also use Personal Information for any other purposes consistent with this Privacy  Policy, as disclosed at the time you provide your information, or otherwise with your consent.

WHEN WE MAY DISCLOSE INFORMATION

Combe shares non-personal information, which may include information that has been de-identified, with third parties. We do not share your Personal Information with third parties for those third parties’ own direct marketing purposes unless you consent (opt in or opt out) to such sharing. California residents, please see additional information for you in the “Notice to California Residents”.

We may share information we have collected about you as allowed by law and as disclosed at the time you provide your information, with your consent, and as described in this Privacy Policy, including in the following circumstances:

Combe Family of Companies.

• Combe includes several brands and companies, some of which operate as subsidiaries, affiliates or joint ventures. We may share Personal Information within our family of companies for their and our business and marketing purposes, including providing you with information about the Services we think may be of interest to you.
• The Combe Family of Companies may include, but is not limited to, the following entities: Combe Laboratories, Inc. (United States of America); Combe de Mexico, S. de R.L. de C.V. (Mexico); ClearVia Labs, LLC (United States of America); Combe Marketing Private Limited (India); Universal Revendedora de Produtos de Toucador Ltda. (Brazil); Ideal Commercial Ltda. (Brazil); Combe Asia-Pacific Pty Ltd (Australia); Combe de Brasil Proaganda e Mercadologia Ltda. (Brazil); Ward Laboratories (Thailand) Limited (Thailand); Combe International Limited (United Kingdom); Combe Europa S.L. (Spain); Advertising Operations, Assessoria, Planejamento e Propaganda Ltda. (Brazil); SP Pharma Distribuidora, Importadora e Exportadora Ltda, EPP (Brazil); Combe Italia S.r.l. (Italy); and Combe Products, Inc. (Puerto Rico).
• Combe Incorporated is responsible for managing jointly-used Personal Information.
• California residents, please see additional information for you in the “Notice to California Residents”.

Third Parties Providing Services on our Behalf.

• We may disclose Personal Information to third parties when explicitly requested or consented to by you, or for the purposes for which you disclosed the Personal Information to us as indicated at the time and point of the disclosure (or was obvious at the time and point of disclosure). These may include, but are not limited to, providers of services such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure provision, customer service, email delivery, auditing and other services.

Sweepstakes, Contests, Promotions.

• We may run certain promotions and sweepstakes from time to time. For information about any current financial incentives, please click here.

Administrative and Legal Reasons. We may also use and disclose your Personal Information as we have a good faith belief that such disclosure is necessary or appropriate, especially when we have a legal obligation or legitimate interest to do so:

• To comply with applicable law. This can include laws outside your country of residence.
• To respond to requests from public and government authorities. These can include authorities outside your country of residence.
• To cooperate with law enforcement. For example, when we respond to law enforcement requests and orders.
• For other legal reasons.
  • To enforce our Terms of Use; and
  • To enforce or investigate a potential violation of any agreement you have with us; and
  • Support auditing and compliance functions. 

To protect our rights, privacy, safety or property, and/or that of our affiliates, you or others. Business Transfers.

• We may disclose your Personal Information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings and in connection with due diligence inquiries in connection with a sale or similar corporate change). Where legally required, we will give you notice prior to such disclosure. 

SECURITY

We use commercially reasonable organizational, technical and administrative measures designed to protect Personal Information from unauthorized access, use, alteration, and disclosure. Unfortunately, no data transmission over the Internet, wireless transmission, or storage system can be guaranteed to be 100% secure. Combe cannot ensure or warrant the security of any Personal Information you provide to us or that we collect about you. You use the Services and provide us information at your own risk.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please immediately notify us in accordance with the “Contacting Us” section below.

EXERCISING YOUR PRIVACY RIGHTS

Depending on where you live, you may have the following rights with respect to your Personal Information under applicable data protection laws:

• Access – The right to request access to and obtain a copy of any Personal Information we may have about you.

• Deletion – The right to delete your Personal Information that we have collected or obtained, subject to certain exceptions.

• Correction – The right to request that we correct any inaccuracies in your Personal Information, subject to certain exceptions.

• Opt Out of Certain Processing – The right to: (a) opt out of the processing of your Personal Information for purposes of targeted advertising, (b) opt out of the sale or sharing of your Personal Information; (c) limit the use of your sensitive Personal Information (if applicable), and (c) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. 

• Objection/Restriction of Processing – The right to object or restrict us from processing your Personal Information in certain circumstances.

• Withdraw Consent – The right to withdraw your consent where we are relying on your consent to process your Personal Information.

• Automated Decision-Making – The right to know when you are subject to automated decision-making, the Personal Information used to render the decision, the principal factors and parameters involved in the decision, and human review or correction of the decision (or its underlying data, where appropriate). You may also have the right to consent or opt out of this automated decision-making, depending on your location.

• Lodge a Complaint ­– The right to lodge a complaint with a supervisory authority or other regulatory agency if you believe we have violated any of the rights afforded to you under applicable data protection laws. We encourage you to first reach out to us so we have an opportunity to address your concerns directly before you do so.

To exercise any of the privacy rights afforded to you under applicable data protection laws, e-mail us at privacy@combe.com or call us at 1 800-431-2610. You may also exercise your opt out rights by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use.

You will not be discriminated against in any way by virtue of your exercise of the rights listed in this Policy. However, should you withdraw your consent or object to processing of your Personal Information, or if you choose not to provide certain Personal Information, we may be unable to provide some, or all, of our Services to you.

Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child. We must verify your identity before fulfilling your requests, and if we cannot verify your identity, we may request additional information from you. If you are an authorized agent making a request on behalf of another person, we will also need to verify your identity, which may require proof of your written authorization or evidence of a power of attorney. We endeavor to respond to requests within the time period required by applicable law. If we require more time, we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your requests unless they are excessive or repetitive. If we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We may deny certain requests, or only fulfill some in part, as permitted or required by law. If you are not satisfied with the resolution of your request and you are afforded a right to appeal such decision, you will be notified of our appeal process in our response to your request.

If you are a California resident, please see our “Notice to California Residents” page for additional information. If you are a Nevada resident, please see our “Notice to Nevada Residents” for more information on additional rights you may have.

RETENTION PERIOD

We retain Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law.

The criteria used to determine our retention periods include:

• The nature and length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account with us or keep using the Services);
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them);
• Whether we have an ongoing business purpose for retaining your Personal Information, such as communicating with you about ongoing or perspectives Services you requested; or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

GENERAL AUDIENCE SITES

The Services are intended for a general audience and we do not knowingly Personal Information from individuals younger than the age of 16. If we learn that we have inadvertently collected Personal Information from a user who is younger than age 16, we will delete the information from our active databases. If you believe we might have any information from or about a child, please contact us at Privacy@combe.com. 

JURISDICTION AND CROSS-BORDER TRANSFER

Your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers, and, by using the Services, you understand that information we collect about you may be  transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.

If you are located in the EEA: Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en. For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission, to protect your Personal Information. You may obtain a copy of these measures by contacting us at privacy@combe.com.

SENSITIVE INFORMATION

We ask that you not send us, and you not disclose, any sensitive Personal Information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Services or otherwise to us.

We do not capture, convert, store, share, sell, collect, purchase, receive, or otherwise obtain your biometric identifiers or biometric information, and do not intend to without first notifying you and obtaining your prior consent. Biometric identifiers or biometric information may include things such as retina or iris scans, fingerprints or voiceprints, or hand or facial geometry scans.

NOTICE TO NEVADA RESIDENTS

Combe does not currently sell your covered information as those terms are defined under applicable Nevada law. However, you may still submit an opt-out request and we will honor that request as required by Nevada law if Combe were to ever engage in such a sale in the future. If you are a Nevada resident and would like to opt-out of future sales of your covered information, please submit your request to privacy@combe.com. Your request must include your full name, street address, city, state, zip code, and an email address so that we can contact if needed regarding this request. You may also be required to take reasonable steps as we determine from time to time in order to verify your identity and/or the authenticity of the request. Combe will respond to your request within sixty (60) days either confirming that your request has been processed or indicating that we need an additional thirty (30) days to complete the request.

ADDITIONAL INFORMATION FOR INDIVIDUALS IN THE EEA, EU, Switzerland, and the UK

This section provides additional information regarding Combe’s processing of personal data of people located in the European Union (EU), European Economic Area (EEA), Switzerland, and the United Kingdom (UK) in accordance with the EU Data Protection Regulation, UK Data Protection Regulation, and the Swiss Federal Data Protection Act. 

Legal Bases for Processing

Our legal basis for processing Personal Information depends on the Personal Information involved and the context in which we process it. Where Combe acts as a controller, we process your Personal Information: with your consent; where necessary to perform a contract; to comply with our legal obligations; and where doing so is in our legitimate interests (including the purposes described in this Policy) and such interests are not outweighed by your rights and freedoms.

Special Category Data

Combe only collects Special Category Data where we have a lawful basis for doing so that is permitted under Article 9 of the GDPR. We may collect data that reveals your racial or ethnic origin, trade union membership, sexual orientation, or health to fulfill our obligations, exercise our rights and otherwise continue our providing our Services. 

If you are located in the EEA, you may lodge a complaint with a data protection authority competent for your country or region or where an alleged infringement of applicable data protection law occurs. A list of data protection authorities is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

CONTACTING US

Combe Incorporated, located at 1101 Westchester Avenue, White Plains, New York 10604, is the company responsible for collection, use and disclosure of your Personal Information under this Privacy Policy.

If you have any questions about this Privacy Policy, please contact us at Privacy@combe.com, or:
Combe Incorporated
Attn: Office of the General Counsel
1101 Westchester Avenue
White Plains, New York 10604

Because email communications are not always secure, please do not include credit card or other sensitive information in your emails to us.

NOTICE TO CALIFORNIA RESIDENTS

This notice supplements Combe’s Privacy Policy and applies only to California residents. This California Privacy Notice sets forth the disclosures and rights for California consumers regarding their Personal Information, as required by the California Consumer Privacy Act and its implementing regulations, as amended by the California Privacy Rights Act (“CCPA”).. Terms used in this California Privacy Notice have the same meanings given in the CCPA or CPRA and the regulations of the Attorney General implementing the CCPA, unless otherwise defined.

This notice provides information about the categories of information that we collect from California residents during the twelve months preceding the date on which this Notice was last updated, the sources of the information, the purposes for which we use the information, and the categories of third parties to whom we disclose the information for business purposes and to whom we sell Personal Information as defined by CCPA, as well as information on how to opt-out.

INFORMATION COMBE COLLECTS

Combe collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (”Personal Information”).

The Personal Information we collect about you will depend upon how you use our Services or otherwise interact with us. Accordingly, we may not collect all of the below information about you. We may also collect and/or use additional types of information after providing notice to you before collection and obtaining your consent (to the extent such notice and consent is required by the CCPA).

California Shine the Light – Under California Civil Code Section 1798.83, individual customers who reside in California and who have an existing business relationship with us may request information about our disclosure of certain categories of Personal Information to third parties for the third parties’ direct marketing purposes, if any. To make such a request, please contact us at privacy@combe.com. Please be aware that not all information sharing is covered by these California privacy rights requirements and only information on covered sharing will be included in our response. This request may be made no more than once per calendar year.