Privacy Policy

Privacy Notice

Effective as of September 25, 2024

At e.l.f. Beauty (“we” or “us”), we believe in being clear and open about how we collect and use personal information related to you. In the spirit of transparency, this Privacy Notice provides you with details about the types of personal information we collect, how we use such personal information and to whom and under what circumstances we disclose it.

This Privacy Notice applies to personal information we collect from you, or that you provide to us, and communications from us, in connection with your use of, or participating in, the e.l.f. Beauty family of brands’ websites and mobile applications, promotions in which we are involved, and social media involving our family of brands. Please read this Privacy Notice carefully so that you understand how we will collect, use, and process your personal information, and the rights you may have in relation to your personal information. Please note that certain of our websites, mobile applications, and social media may not be available in your country and that certain of our brands may not provide products or other services to consumers in your country.

If you do not agree with this Privacy Notice in general or any part of it, you should not use our websites, our mobile applications, request marketing material from us, or take part in our promotions or social media activity, as applicable.

California Residents: If you are a California resident, please see the California Residents Privacy Addendum for additional information about our privacy practices and your rights as a California resident.

Colorado Residents: If you are a Colorado resident, please see the Colorado Residents Privacy Addendum for additional information about our privacy practices and your rights as a Colorado resident.

EEA and UK Residents: If you are located in the European Economic Area (the “EEA”) or the United Kingdom and the applicable e.l.f. Beauty brand provides products or other services to consumers in your country, please see the EU/UK Privacy Addendum for additional information about our privacy practices and your rights under the General Data Protection Regulation and the UK GDPR (as applicable, the “EU/UK GDPR”). Please note that, as of the date of this Privacy Notice, neither Naturium nor Well People provide products or other services to consumers in the EEA or the United Kingdom (except through third party retailers), and as such the EU/UK Privacy Addendum will not apply to Naturium’s or Well People’s websites and mobile applications.

Please note that all operations for the e.l.f. Beauty family of brands are operated through our primary operating companies:

l.f. Cosmetics, Inc. (with respect to e.l.f. Cosmetics, e.l.f. SKIN, and Keys Soulcare);
W3LL People, Inc. (with respect to Well People);
Naturium LLC (with respect to Naturium); and
l.f. Beauty UK Ltd (with respect to www.elfcosmetics.co.uk and www.elfcosmetics.com/eu).

Click on the links below to jump to the different sections of this Privacy Notice.

What Information Do We Collect, How Do We Collect It, And How Do We Use It?
Cookies and Traffic Data
How Do We Share Your Personal Information?
Your Rights and Choices
Security of Your Personal Information
Complaints
Internet Based Advertising
Our Policies Concerning Children
Third Party Websites
Changes to this Privacy Notice
Contact Us
California Residents Privacy Addendum
Colorado Residents Privacy Addendum
EU/UK Privacy Addendum

WHAT INFORMATION DO WE COLLECT, HOW DO WE COLLECT IT, AND HOW DO WE USE IT?

We collect information about you in many ways from many places. Some of the information we collect may include information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your device (“personal information”). To the extent required by law, when we collect personal information from you, we indicate any personal information that you are required to provide to us, and the consequences of the failure to do so.

Whenever we use your personal information, we will have a reason to do this.

We use your personal information for one or more of the following legitimate business purposes:

• to fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our products, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product, we will use that information to process your payment and facilitate delivery. We also save your information to facilitate new product orders or process returns;
to provide, support, and develop our websites, mobile applications, products, and services;
to create, maintain, customize, and secure your account with us;
to process your requests, purchases, transactions, and payments and prevent transactional fraud;
to provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses;
to personalize your website or mobile application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our websites or mobile applications and via email or text message (with your consent, where required by law);
to help maintain the safety, security, and integrity of our websites, mobile applications, products, and services, including to detect, prevent, or otherwise address fraud, security, or technical issues; and
to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our users is among the assets transferred.

In particular, in the table below, we explain:

what activity or scenario you are involved in when we use or collect your personal information;
what categories of personal information we collect when you take part in a particular activity;
what we do with your personal information, and the purposes for collecting and using it; and
solely for purposes of the EU/UK GDPR, if applicable (which is only applicable to residents of the EEA or the United Kingdom, as applicable, our legal basis for using your personal information)

What Personal Information We Collect

How We Use the Personal Information

Our Legal Basis for Processing, Using, and Storing the Personal Information for Purposes of the EU/UK GDPR

Purchases and Order Management

Identifiers and commercial information that we collect, or you give us, when you place an order, including:

· your contact details including: your first and last name, billing address, phone number, mailing address, email address; and

· the product(s) you purchased.

We use this personal information to:

· fulfill your requests and orders for products;

· take payment from or give you a refund;

· help us ensure that our consumers are genuine and to prevent fraud;

· manage and keep your order history (including by adding to your account if you have one);

· send you personalized offers, shopping ideas or other marketing materials;

· enhance your shopping experience while on our websites or mobile applications by showing you personalized content; and

· run analytics, statistics, and research.

We base this processing on:

· performance of a contract—so we can perform our contract for the sale of our products to you and manage the associated logistics;

· our legitimate business interest in (i) maintaining records relating to our business for commercial, tax, accounting, auditing and anti-money laundering purposes, (ii) improving our products and services; (iii) preventing fraud; and (iv) securing our tools; and

· to comply with our specific statutory retention obligations arising from, in particular, applicable commercial, tax, accounting, auditing or anti money laundering laws).

Account Creation/Loyalty Program Account Creation; Management of Accounts; Loyalty Programs

Identifiers and characteristics of protected classifications that we collect, or you give us, when you create an account or manage your account, including:

· your contact details including: your first and last name, billing address, mailing address, phone number and email address;

· your account password; your birthdate;

· your credit card information ⁽¹⁾;

· your order history;

· your wish list;

· your social media account handles; and

· your gender.

We use this personal information to:

· manage and keep your order history;

· allow you to manage your preferences;

· operate and manage your account and any associated loyalty program;

· enhance your shopping experience while on our websites or mobile applications by showing you personalized content;

· send you personalized offers, shopping ideas or other marketing materials; and

· run analytics, statistics, and research.

We base this processing on:

· performance of a contract—so you can create and manage your account and so that we can operate and manage our loyalty programs;

· our legitimate business interest in improving our products and services; and

· your consent to us processing any personal information that may reveal a health; condition and/or race and ethnicity for the purposes of us recommending products ⁽²⁾.

Marketing and Promotional Materials

Identifiers that we collect, or you give us, when you sign up for our marketing materials:

· your email address; or your mobile phone number; and

· information we collect in relation to communicating with you, including how you engaged with the message, the details of your communication with us and related metadata.

We use this personal information to:

· send you offers, shopping ideas or other marketing materials (which may be personalized based on the personal information we know or learn about you);

· deliver targeted advertising, such as advertisements and content on social media platforms and other websites;

· enhance your shopping experience while on our websites or mobile applications by showing you personalized content;

· keep an up to date suppression list if you have asked not to be contacted; and

· run analytics, statistics, and research

We base this processing on:

· your consent to receiving marketing communications from us (other than targeted advertising); and

· our legitimate business interest in improving our products and services.

Questions and Customer Service

Identifiers that we collect, or you give us, when you communicate with us whether in person, through our websites, mobile applications, through via email, over the phone, through social media or via any other medium, including:

· your contact details including: your first and last name, mailing address, email address, social media account name, or whatever method you use to contact us;

· the details of your communications with us;

· the details of our communications to you; and

· information we collect in relation to communicating with you.

Please note that if you communicate with us over the phone or via chat through our websites or mobile applications, your communications with us may be recorded by us or an agent acting on our behalf. By communicating with us over the phone or via chat through our websites or mobile applications, you expressly consent to the recording of such communications.

We use this personal information to:

· answer and manage your questions;

· provide consumer service to you; and

· run analytics, statistics, and research.

We base this processing on:

· performance of a contract—so that we can answer and manage your questions and provide consumer service to you; and

· our legitimate business interest in (i) improving our products and services; and (ii) securing our tools.

Online Browsing

Identifiers and internet or other electronic network activity that we collect through your use of our websites, mobile applications and communications with you (which may be through cookies), including:

· Internet Protocol (IP) address; MAC address;

· browser type; operating system;

· device identifying personal information;

· the specific web pages visited during your connection;

· the domain name from which you accessed our websites; and

· your browsing behavior, such as the date and time you visit our websites, the areas or pages of our websites that you visit, the amount of time you spend viewing our websites, the number of times you return to our websites or mobile applications, the products you selected to create your basket, whether you left items in your basket or “abandoned” your basket, and other clickstream data.

For more information on cookies, see “b” section.

We use this information to:

· allow our websites or mobile applications to function properly (for example, to ensure the proper display of content, to create and remember your shopping cart and to create and remember your account login details);

· improve our websites or mobile applications (for example, by testing new ideas or layouts);

· ensure our websites or mobile applications are secure and safe, and to protect you against fraud or misuse of our websites or services (for example through performing troubleshooting);

· enhance your shopping experience while on our websites or mobile applications by showing you personalized content;

· send you personalized offers, shopping ideas or other marketing materials;

· deliver targeted advertising, such as advertisements and content on social media platforms or other websites; and

· run analytics, statistics, and research.

We base this processing on:

· your consent to storing cookies on your device. For more information on cookies, see “Cookies and Traffic Data” section; and

· our legitimate business interest in (i) operating and improving our websites, products and services; (ii) preventing fraud; and (iii) securing our tools.

Information from Third Parties

Identifier and commercial information, including:

· your contact details including: your first and last name, mailing address and email address;

· your credit card information ⁽¹⁾;

· your social media account handles; and

· information about your skin such as your skin tone, type, complexion, preferences and concerns, and related images (if you choose to provide this to us).

· We collect this information from our third-parties, including:

· payment processing companies;

· address update services; and

· public relations/communications companies (with respect to influencers).

We use this information to:

· take payment from or give you a refund;

· enhance your shopping experience while on our websites or mobile applications by showing you personalized content;

· help us ensure that our consumers are genuine and to prevent fraud; and

· communicate with influencers and media contacts.

We base this processing on:

· performance of a contract—so we can perform our contract for the sale of our products to you; and

· our legitimate business interest in (i) maintaining records relating to our business for commercial, tax, accounting, auditing and anti-money laundering purposes, and (ii) preventing fraud.

Use of Social Media ⁽³⁾

Identifiers and internet or other information that we collect when you publicly share or engage with content through social media, including:

· information about you that you have made publicly available through your social media profile.

Identifiers and other information that we collect when you publicly mention us on social media platforms, including:

· social media handle;

· photos and/or video; and/or

· any comments, replies or responses mentioned in your post.

We use this information to:

· understand how consumers view our products/services;

· identify beauty trends; and

· run analytics, statistics, and research.

Where possible, we do this in way that we are unable to directly identify you.

We base this processing on:

· our legitimate business interest in improving our products and services.

Promotions

Identifiers that we collect, or you give us, when you participate in a sweepstakes, contest, or other promotion, including:

· your name;

· your contact details; birthdate or age range;

· address or country of residence;

· your social media handle and promotion entry (if the promotion is run on a social media platform); and

· user generated content/promotion entries.

We use this information to:

· manage and operate the promotion;

· use the content you have created and/or shared in accordance with the specific terms and conditions accepted by you;

· understand how consumers view our products/services;

· identify beauty trends; and

· run analytics, statistics, and research.

We base this processing on:

· performance of a contract—so you can enter into the sweepstakes, contest or other promotion, we can contact you about these events, and we can deliver the prize;

· your consent to the use of content you have created and/or shared in accordance with the specific terms and conditions accepted by you; and

· our legitimate business interest in (i) improving our products and services; and (ii) securing our tools.

User Generated Content

Identifiers and other information that we collect, or you give us, when you submit content (for example images or ratings and reviews) on our websites, mobile applications, or social media platforms, when you interact with/participate in our quizzes or other questionnaires, when you access and use our NFTs (if available), when you publicly tag us on a social media post, or accept our reuse of any content you posted on social media platforms.

We use this information to:

· use the content you have created and/or shared in accordance with the specific terms and conditions accepted by you;

· understand how consumers view our products/services;

· enhance your shopping experience while on our websites or mobile applications by showing you personalized content;

· identify beauty trends; and

· run analytics, statistics, and research.

We base this processing on:

· your consent to the use of content you have created and/or shared in accordance with the specific terms and conditions accepted by you; and

· our legitimate business interest in improving our products and services.

(1) Please note that your credit card information is not stored or retained by us even if you save your credit card information in your account—we use a third-party payment processor to process credit card transactions.

(2) Please note that we do not collect nor do we ask for sensitive information such as race, ethnicity, or health conditions.

(3)Please note that you may be able to control what information you share through the privacy settings for your social media accounts—please refer to the applicable social media’s privacy policies and terms of use for more details and information.

We obtain all of the above personal information directly from you, except for personal information that we (i) receive from payment processing companies and address update services, (ii) obtain from publicly available social media profiles and social media engagement with our content, and (iii) obtain with respect to media contacts and influencers, as indicated below.

Influencer Data

We obtain contact details and other personal information regarding media contacts and influencers from a variety of sources including Cision. If you wish to know more about how such information is collected and used, please see Cision’s privacy policy at www.cision.com/us/legal/privacy-policy.

Please note that this Privacy Notice and Cision’s privacy policy does not apply to personal information we obtain from content creators and influencers that we engage to work with us.

International Orders Through eShopWorld

With respect to e.l.f. Cosmetics / e.l.f. Skin and Keys Soulcare products purchased through www.elfcosmetics.com or www.keyssoulcare.com, we work with US Direct E-Commerce Limited (trading as eShopWorld) to sell and deliver our products to consumers in certain countries/regions outside of the United States. If you reside in one of the countries/regions where our international shipping is supported by eShopWorld and you purchase products through www.elfcosmetics.com or www.keyssoulcare.com, you will navigate away from our websites to a co-branded checkout service “powered by eShopWorld.” eShopWorld’s Privacy Policy (which can be viewed at https://esw.com/privacy-policy), and not our Privacy Notice, will apply to personal information that you provide on that checkout site. Before proceeding to make a purchase through eShopWorld, please read eShopWorld’s Privacy Policy for more information on how eShopWorld collects, uses, and shares your personal information.

COOKIES AND TRAFFIC DATA

Cookies

Certain cookies and web beacons that we employ are necessary for the operation of our website. Other cookies that we employ are not necessary for the operation of our websites but are employed to enhance your use of our websites and shopping experience.

Our cookies include session cookies (temporary cookies that identify and track users within our websites which are deleted when you close your browser or leave your session) or persistent cookies (cookies which enable our websites to “remember” who you are and to remember your preferences within our websites and which will stay on your computer or device after you close your browser or leave your session).

Category	Description
Strictly Necessary	These are cookies which are needed for our websites to function properly, for example, these cookies allow you to access secure areas of our websites or to remember what you have put into your shopping basket.
Performance	These cookies allow us to keep a record of traffic data, count visits, traffic sources, access rates, page hits and page views so we can measure and improve the performance of our website. They help us know which pages are the most and least popular and see how visitors move to and from and around our website.
Functional	These cookies allow our websites to remember choices you make (such as your username, language, or the region you are in) and provide enhanced, more personal features. These cookies allow the provision of enhance functionality and personalization, such as chats. They are set by us or by third party providers whose services we have added to our pages.
Targeting	These cookies are set through our websites by our advertising partners. They are used by those companies to build a profile of your interests and show you relevant ads on other websites. They record a user’s visit to a website, the pages a user has visited and the links a user has followed. Companies will use this information to make the website more relevant to users. Companies may also share this information with third parties for this purpose.
Social Media	These cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit.

You can find more general information about cookies and generally how to manage them at www.allaboutcookies.org and www.youronlinechoices.com.

We use third-party advertising companies (with your consent if you are located in the EEA or the United Kingdom) that use tracking technologies to serve our advertisements across the Internet. These companies collect personal information about your visits to our websites and other website/applications and your interaction with our advertising and other communications. These advertising companies serve ads on behalf of us and others on non-affiliated website, and some of those ads will be personalized, meaning that they are intended to be relevant to you based on personal information collected about your visits to our websites and elsewhere over time. Other companies may also use such technology to advertise on our website.

Google Analytics

We use Google Analytics, which is a web analytics tool that helps us understand how users engage with our website. Like many services, Google Analytics uses first-party cookies to track user interactions, as in our case, where they are used to collect details about how users use our website. This information is used to compile reports and to help us improve our website.

The reports disclose trends without identifying individual visitors.

Google Analytics services are provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and elsewhere by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA and other affiliated Google entities.

Google Analytics uses cookies to collect information about visitors to our websites (data related to the user’s device/browser, IP address and on-site activity). They measure and report on user interactions on our websites. This includes details of the volume and nature of traffic to our websites (for example, which pages users visit first, which pages are most popular, how long users stay on the site, and geographical region of users). Google may also use data collected from these reports to improve their own services, for benchmarking purposes and to provide technical support.

You can find out more about how Google uses personal information here: https://policies.google.com/privacy.

For residents of the EEA or the United Kingdom that are subject to the EU/UK GDPR, we base the use of Google Analytics on your consent.

You can opt out of Google Analytics without affecting how you visit our websites–for more information on opting out of being tracked by Google Analytics across all websites you use, visit this Google page: https://tools.google.com/dlpage/gaoptout.

eShopWorld

As noted in the “International Orders Through eShopWorld” section, we work with eShopWorld to sell and deliver certain of our products to consumers in certain countries/regions outside of the United States. eShopWorld’s Cookie Policy (which can be viewed at https://esw.com/cookie-notice) will apply to any cookies and web beacons that eShopWorld employs on the co-branded checkout service “powered by eShopWorld”. Before proceeding to make a purchase through eShopWorld, please read eShopWorld’s Cookie Policy.

Turning off Cookies

Please see the “Withdrawing Your Consent for (Opting-Out of) Cookie Tracking” section for information on how you can turn off cookies on our websites.

HOW DO WE SHARE YOUR PERSONAL INFORMATION?

We may share the categories of personal information described above that we collect from, and about, you with certain third parties, as described in this section.

For Business Purposes

We share personal information with service providers who help us run our business, including order management and shipping processors (including eShopWorld), payment processors, customer service providers, shopping experience service providers, customer relationship management service providers, analytics service providers, advertisers, loyalty program providers, product review program providers, cloud storage providers, and IT service providers. We share only the personal information needed for these service providers to complete the tasks we request. We also share personal information with professional advisors, such as auditors, law firms and accounting firms.

For Advertising

We share personal information with advertisers, advertising publishers, and marketing service providers to serve you targeted advertising.

With Your Consent

In certain circumstances and where required by law, we disclose personal information with companies, organizations or individuals with your express consent or with your direction.

For Legal Reasons

We also share personal information with third-parties if we are legally required to do so, or if we have a good-faith belief that access, use, preservation or disclosure of the personal information is reasonably necessary to:

comply with any applicable federal, state, local or international law, regulation, civil, criminal or regulatory inquiry, investigation legal process, judicial order or enforceable governmental request;
respond to legal process (such as a search warrant, subpoena, summons or court order);
enforce our Terms of Use (or other terms of service for our websites or mobile applications), including investigation of potential violations;
detect, prevent or otherwise address security, fraud or technical issues;
cooperate with law enforcement agencies concerning conduct or activity that we reasonably and in good faith believes violate federal, state, local or international law; or
exercise or defend legal claims, protect against harm to our rights, property or safety or the rights, property or safety of third-parties, our consumers, or the public as required or permitted by law (including exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction).

Affiliated Brands and Companies

We also share personal information with our corporate affiliates, including our parent company, e.l.f. Beauty, Inc., or other brands in the e.l.f. Beauty portfolio. For additional information regarding our corporate affiliates or other brands, please visit elfbeauty.com.

In Connection with a Sale or Merger

If we directly or indirectly undergo a business transition (including proposed transactions), like a merger, acquisition by another company, or sale of all or part of our assets, we may disclose or transfer personal information to the successor organization in the transition.

Aggregated, Non-Personally Identifiable Information

We share aggregated, non-personally identifiable information with our service providers in order for those service providers to enhance and optimize their services and for statistical analysis, research, and other purposes.

YOUR RIGHTS AND CHOICES

Privacy Rights

Subject to applicable law, you may have certain rights with respect to your personal information.

EEA/UK Privacy Rights. If you are located in the EEA or the United Kingdom, please see the EU/UK Privacy Addendum for additional information about the rights that may be applicable to you.
S. Privacy Rights. Depending on your state of residence, you may have certain rights with respect to your personal information.
- California Consumer Privacy Rights. If you are a California resident, please see the California Residents Privacy Addendum for additional information about your privacy rights.
- Colorado Consumer Privacy Rights. If you are a Colorado resident and you interact with us in an individual or household capacity (and not in a commercial or employment context), please see the Colorado Residents Privacy Addendum for additional information about your privacy rights.
- Connecticut, Oregon, Texas, Utah and Virginia Consumer Privacy Rights. If you are a resident of Connecticut, Oregon, Texas, Utah or Virginia and you interact with us in an individual or household capacity (and not in a commercial or employment context), depending on your state of residence, you may have the right under applicable laws to:

How to Submit a Request: You may access certain personal information by signing into your account for the relevant brand. From there, you can update, correct, or modify that personal information (other than your order history)—you will need to update, correct, or modify your personal information in each of your accounts with our brands as changes in one brand account will not automatically update your other brand accounts. Please note that deleting any personal information in your account will not completely delete that information from our systems—to request that we delete your personal information from our systems, you must follow the directions in the following bullet. Please also note that if you are a member of one of our loyalty programs and you request that your personal information is deleted, you will be removed from that particular brand loyalty program.

If you (1) wish to access any personal information that is not contained in your relevant brand account profile, (2) do not have an account and wish to access your personal information, or (3) wish to submit a correction or deletion request or exercise another right described above, please submit your request by using the relevant Privacy Rights Request Form linked below, writing to us at the address provided in the “Contact Us” section, or calling us at (888) 315-9814. If you write to us or call us, please let us know with respect to which e.l.f. Beauty brand that you are exercising your privacy rights, so that we can process your request in an efficient manner.

e.l.f. Cosmetics / e.l.f. SKIN	Keys Soulcare
Privacy Rights Request Form	Privacy Rights Request Form

Naturium	Well People
Privacy Rights Request Form not available at this time—please email us at info@naturium.com with your request	Privacy Rights Request Form

o You may opt out of the processing of your personal information for purposes of targeted advertising using the relevant opt-out form linked below.

e.l.f. Cosmetics / e.l.f. SKIN	Keys Soulcare
Do Not Sell or Share My Personal Info/Opt Out of Targeted Ads	Do Not Sell or Share My Personal Info/Opt Out of Targeted Ads

Naturium	Well People
Please use the link entitled “Do Not Sell / Share My Information” in the footer of naturium.com	Do Not Sell or Share My Personal Info/Opt Out of Targeted Ads

To submit a request as an authorized agent on behalf of a resident of a state listed above, please email us at elfcare@elfcosmetics.com (for e.l.f. Cosmetics, e.l.f. SKIN, Well People, and Keys Soulcare) or info@naturiun.com (for Naturium) with the subject line “Authorized Agent—Privacy Rights Request” and in the body of the email, please let us know which privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your privacy rights, so that we can process your request in an efficient manner. We will request that your authorized agent have written permission from you to make requests on your behalf (or that you otherwise directly confirm the agent has permission to submit the request) and will need to verify your identity.
To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
To the extent permitted by applicable law, you may appeal our decision with respect to a request you have submitted by following any of the methods to exercise a privacy right or by contacting us using the contact information detailed in the “Contact Us” section. So that we can process your appeal in an efficient manner, we ask that you email us at elfcare@elfcosmetics.com (for e.l.f. Cosmetics, e.l.f. SKIN, Keys Soulcare, and Well People brands) or info@naturium.com (for Naturium) with the subject line “Decision Appeal—Privacy Rights” and in the body of the email, please let us know which privacy right decision you are appealing and with respect to which e.l.f. Beauty brand that you are exercising your privacy rights.

Updating Your Information

If you maintain an account with us, you may view, update, correct or modify certain of your personal information by signing into your account. Please note that you need to update, correct, or modify your personal information in each of your accounts with our brands as changes in one brand account will not automatically update your other brand accounts.

Withdrawing Your Consent for (Opting-Out of) Promotional Emails

If you do not wish to receive email communications from us about special offers and promotions, you can opt-out of receiving these communications by following the instructions contained in the messages you receive. Even if you opt-out of receiving these messages, we reserve the right to send you certain communications relating to the services we provide, service announcements and administrative messages. We do not offer you the opportunity to opt-out of receiving those service or administrative communications.

Withdrawing Your Consent for (Opting-Out of) of SMS Text Messages (US Residents only)

If you are a resident of the United States and you do not wish to receive text message communications from us about special offers and promotions, you can opt-out of receiving these communications by following the applicable instructions in the Text Message Terms and Conditions.

Withdrawing Your Consent for (Opting-Out of) of Mobile Application Push Messages

If you use our mobile application and you do not wish to receive push notifications from us on your device, click "Don't Allow" or a similar button when prompted asking if you would like to allow push notifications. If you have allowed push notifications from us but later decide you no longer want to receive them, you can adjust your settings options, or turn them off through your device notifications settings.

Withdrawing Your Consent for (Opting-Out of) Cookie Tracking

You can set your browser to reject cookies, warn you about attempts to place cookies on your computer or device, or limit the type of cookies you allow. You can also manually delete individual or all the cookies on your computer or device by following your browser’s or device’s help file directions. You can also set your browser or device to delete cookies every time you finish browsing. Please note that browser- and device-management tools for cookies are outside of our control and we cannot guarantee their effectiveness. Please also note that flash cookies operate differently than browser cookies and cookie management tools available may not remove flash cookies.

For certain of our websites, you may also turn off cookies that are not necessary for the operation of our websites by using the “Cookie Settings” or “Manage Consent” link in the footer of our website (depending on which website you are visiting).

Please note that if you turn off cookies that are not necessary for the operation of our websites, your browser or device is set to reject cookies, or you manually delete cookies, some or all the features and functionality of our websites may not function properly (including features we add to our websites in the future).

Opting Out of Third-Party Tailored Advertising

If you are interested in more information about tailored advertising and your choices to prevent third parties from delivering tailored web and mobile web advertising, please visit the following websites:

These opt-out tools are provided by third parties (and not by us). We do not control or operate these tools or the choices that advertisers and others provide through these tools.

SECURITY OF YOUR PERSONAL INFORMATION

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide against accidental, unlawful or unauthorized access, destruction, loss, alteration, disclosure or use. Please be aware that, despite our efforts, no security measures are perfect and we cannot guarantee “perfect security”. Any information you transmit to us, you do at your own risk.

COMPLAINTS

We strive to be transparent about the ways in which we collect and use personal information and welcome your questions and concerns. If you have any concern or complaint about the way we handle your personal information, please contact us using the contact information detailed in the “Contact Us” section.

To the extent you believe we have not addressed your concerns or otherwise choose to do so, you have the right to complain to a supervisory authority in the country where you reside. In the United Kingdom, contact details for the relevant supervisory authority are available here. In the EEA, contact details for the relevant supervisory authority are available here.

INTERNET BASED ADVERTISING

We use third-party advertising companies that use tracking technologies to serve our advertisements across the Internet. These companies may collect personal information about your visits to our websites or mobile applications and other websites/applications and your interaction with our advertising and other communications. These advertising companies serve ads on behalf of us and others on non-affiliated websites, and some of those ads may be personalized, meaning that they are intended to be relevant to you based on personal information collected about your visits to our websites and elsewhere over time. Other companies may also use such technology to advertise on our website.

OUR POLICIES CONCERNING CHILDREN

Our websites and mobile applications are not directed to children, nor do we knowingly collect any personal information from children under the age of 13 (or with respect to residents the EEA, children under the age of 16) without verifiable parental or legal guardian consent.

THIRD PARTY WEBSITES

Our websites or mobile applications contain links to third-party websites, such as social media websites (for example, Instagram, Facebook, YouTube, TikTok, Pinterest, X, and Snapchat), each of which have privacy policies that differ from this Privacy Notice. We are not responsible for the activities and practices that take place on these websites. Accordingly, we recommend that you review the privacy policy or privacy notice/statement posted on any external website before disclosing any personal information. Please contact those websites directly if you have any questions about their privacy policies.

CHANGES TO THIS PRIVACY NOTICE

We may change this Privacy Notice from time to time, including as required to keep current with rules and regulations, new technologies and security standards. When we do, we will post the change(s) on the applicable privacy notice page of our websites. For significant changes, we will notify you by posting a notice on the applicable website indicating at the top of the Privacy Notice when it was most recently updated or notify you in another appropriate manner consistent with applicable law. If you wish to review a copy of the privacy notice effective prior to the effective date of this Privacy Notice, please contact us using the contact information detailed in the “Contact Us” section.

CONTACT US

If you have questions or concerns about this Privacy Notice or how we collect and use the personal information of our consumers, please contact us using the contact information provided below.

e.l.f. Cosmetics / e.l.f. SKIN
Webform	www.elfcosmetics.com/contact-us/contact-us.html


Phone	(212) 239-1530 Weekdays 9:30am-5:30pm ET


Email	elfcare@elfcosmetics.com or elfcare.eu@elfcosmetics.com (for EEA or United Kingdom residents)


Writing	e.l.f. Cosmetics, Inc. 570 10th Street Oakland, CA 94607 ATTN: Legal Department RE: Privacy Info

Naturium
Email	info@naturium.com


Writing	Naturium LLC c/o e.l.f. Cosmetics, Inc. 570 10th Street Oakland, CA 94607 ATTN: Legal Department RE: Privacy Info

Keys Soulcare
Webform	www.keyssoulcare.com/contact-us.html


Phone	(212) 239-1530 Weekdays 9:30am-5:30pm ET


Email	customercare@keyssoulcare.com


Writing	Keys Soulcare c/o e.l.f. Cosmetics, Inc. 570 10th Street Oakland, CA 94607 ATTN: Legal Department RE: Privacy Info

Well People
Webform	www.wellpeople.com/contact-us.html


Phone	(212) 239-1530 Weekdays 9:30am-5:30pm ET


Email	support@wellpeople.com


Writing	W3LL People, Inc. 570 10th Street Oakland, CA 94607 ATTN: Legal Department RE: Privacy Info

CALIFORNIA RESIDENTS PRIVACY ADDENDUM

Last Updated: September 25, 2024

Please note that the California Residents Privacy Addendum only applies to California residents.

COLLECTION AND SHARING OF PERSONAL INFORMATION

Collection of Personal Information

During the 12-month period prior to the last update of this California Residents Privacy Addendum, we have collected the personal information listed in the “What Information Do We Collect, How Do We Collect It, And How Do We Use It?” section of the Privacy Notice.

We do not collect or process sensitive personal information for purposes of inferring characteristics about consumers.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

Disclosure of Personal Information

In the table below, we explain the categories of personal information we have disclosed to third parties for a business purpose during the 12-month period prior to the last update of this California Residents Privacy Addendum, and the categories of third-party recipients.

What We Disclosed	Who We Disclosed It To
Identifiers, including your first and last name, billing address, mailing address, phone number, email address, and internet protocol (IP) address	We disclosed this information to: · order management and shipping processors; · payment processors; customer service providers; · shopping experience service providers; · customer relationship management service providers; · analytics service providers; · advertisers, advertising publishers and marketing service providers (including for purposes of targeted advertising); · loyalty program providers; · product review program providers; cloud storage providers; · IT service providers; and · our affiliated entities and subsidiaries
Personal information listed in the California Customer Records statute, including your first and last name, billing address and mailing address	We disclosed this information to: · order management and shipping processors; · payment processors; customer service providers; · shopping experience service providers; · customer relationship management service providers; · analytics service providers; advertisers, advertising publishers and · marketing service providers (including for purposes of targeted advertising); · loyalty program providers; · product review program providers; cloud storage providers; · IT service providers; and · our affiliated entities and subsidiaries
Commercial information, including purchase and order management information	We disclosed this information to: · order management and shipping processors; · payment processors; customer service providers; · shopping experience service providers; · customer relationship management service providers; · analytics service providers; · advertisers, advertising publishers and marketing service providers (including for purposes of targeted advertising); · loyalty program providers; · product review program providers; cloud storage providers; · IT service providers; and · our affiliated entities and subsidiaries.
Internet or other electronic network activity information, including browsing history, search history, and information regarding your interaction with our website, applications and electronic communications	We disclosed this information to: · order management and shipping processors; · payment processors; customer service providers; · shopping experience service providers; · customer relationship management service providers; · analytics service providers; · advertisers, advertising publishers and marketing service providers (including for purposes of targeted advertising); · loyalty program providers; · product review program providers; cloud storage providers; · IT service providers; and · our affiliated entities and subsidiaries.

In addition to the categories of third parties identified above, during the 12-month period prior to the last updated date of this California Residents Privacy Addendum, we may have disclosed personal information about you to government entities and third parties in connection with corporate transactions, such as mergers, acquisitions or divestitures.

Financial Incentive

We offer certain loyalty and rewards programs that may be considered financial incentives under California law, such as the e.l.f. Beauty Squad Loyalty Program, the Soulcare Rewards Loyalty Program, the Naturium Consistency Club Loyalty Program, and exclusive offers and promotions via email. When you sign up for and participate in these programs, we may ask you to provide us with contact information and identifiers such as your name and email address, and commercial information such as your purchase history. Participation in these programs is voluntary and no purchase is required to become a member of these loyalty programs. While we cannot calculate the precise value of your information, our programs generally reflect the value of the relationships that we have with the individuals who participate in them. You may withdraw from our loyalty programs at any time by contacting us using the designated method set forth in the applicable rules, such as by closing your account or opting out from our email and SMS communications.

Sale or Sharing of Personal Information

We do not sell your personal information for monetary compensation. However, like most online businesses, we share some information with advertisers, advertising publishers, and marketing service providers to serve you targeted advertising (including cross-device marketing or advertising campaigns (where we can infer that a particular browser, device, or pseudonymous identifier belongs to you)). These third parties may collect personal information via automated technologies on our websites for cross-context behavioral advertising purposes. This kind of sharing may be considered a “sale” of personal information under California law when the personal information is exchanged for non-monetary consideration.

We may sell or share for cross-context behavioral advertising purposes (and, during the 12-month period prior to the last update of this California Residents Privacy Addendum, we may have sold or shared) the following categories of personal information with these third parties:

email address, phone number, IP address and internet and electronic network activity including information regarding interactions with our websites and/or mobile applications.

You have the right to opt out of this disclosure of your personal information. If you wish to request that we do not sell or share your personal information, please contact us using the contact information detailed in the “Exercising Your California Privacy Rights” section of this California Residents Privacy Addendum.

We do not have actual knowledge that we sell or share personal information of individuals that are California residents under the age of 16.

Retention of Personal Information

We will retain your personal information for the time period reasonably necessary to achieve the purposes described in this Privacy Notice and California Residents Privacy Addendum, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.

CALIFORNIA PRIVACY RIGHTS

You have certain choices regarding your personal information, as described below.

Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed, and sold or shared about you.
Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
Deletion: You have the right to request that we delete certain personal information we have collected from you.
Opt-Out of Sale or Sharing: You have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.

If you choose to exercise any of your rights under California law, we will not discriminate against you because you have exercised any of these rights.

Shine the Light Requests

California law permits our consumers who are California residents to request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and can be made once a year using the contact information detailed in the “Exercising Your California Privacy Rights” section of this California Residents Privacy Addendum.

Online Eraser Law

If you are under 18 years of age, reside in California, and have a registered account with us, you have the right to request removal of unwanted information that you publicly post on the applicable website or mobile application. To request removal of such information, please contact us using the contact information detailed in the “Exercising Your California Privacy Rights” section of this California Residents Privacy Addendum, with details on where the information is posted. Upon receiving such a request, we will make reasonable good faith efforts to ensure that the information is not publicly available on the applicable website or mobile application, but the information will not be completely or comprehensively removed from our systems and databases.

Additional Requests

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and/or across different websites. Because there is no standard interpretation or practice for Do Not Track signals, like many websites, our website does not support Do Not Track requests at this time.

However, to opt-out of cookie and web beacon tracking, please see the “Withdrawing Your Consent for (Opting-Out of) Cookie Tracking” section of the Privacy Notice, or to opt-out of website-based third-party interest-based or online behavioral advertising, please see the “Opting Out of Third-Party Tailored Advertising” section of the Privacy Notice.

EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS

To make any of the requests or exercise any of your California privacy rights described above, please contact us using one of following methods. Please note that you can only make a verifiable request for access twice within a 12-month period.

You may access certain personal information by signing into your account for the relevant brand. From there, you can update, correct, or modify that personal information (other than your order history)—you will need to update, correct, or modify your personal information in each of your accounts with our brands as changes in one brand account will not automatically update your other brand accounts. Please note that deleting any personal information in your account will not completely delete that information from our systems—to request that we delete your personal information from our systems, you must follow the directions below.

If you wish to access any personal information that is not contained in your relevant brand account profile, if you do not have an account and wish to access your personal information, if you wish to otherwise request information from us about the information we collected about you over the past 12 months, or if you wish to submit a deletion request, please contact us as detailed in the “Contact Us” section of this California Residents Privacy Addendum.

Please note that if you are a member of one of our loyalty programs and you request that your personal information is deleted, you will be removed from that particular brand loyalty program.

Via the Internet

Privacy Rights Request Form. If you wish to submit an access or deletion request or if you wish to request that we do not sell your personal information or share your personal information for cross-context behavioral advertising, please click the “Privacy Rights Request Form” link in the footer of the applicable website. Please follow the instructions on the form to make your request.

For your convenience the links for the Privacy Request Form and the “Do Not Sell or Share My Personal Info/Opt Out of Targeted Ads” are set forth in the “Your Rights and Choices” section of the Privacy Notice.

You also can opt out of the sale or sharing of your personal information by broadcasting the Global Privacy Control signal from a supported browser.

By mail

To submit an access, correction, deletion, Shine the Light or Online Eraser request, you can also write to us at the address detailed in the “Contact Us” section of this California Residents Privacy Addendum. Please include your full name, mailing address, and any email address associated with your activity with us (for example, the email you used to receive marketing emails or order confirmations, or the email you have used in connection with your account (if you are a member)), and let us know which California privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your California privacy rights so that we can process your request or exercising of your rights in an efficient manner.

By telephone

To submit an access, correction, deletion, Shine the Light or Online Eraser request via telephone, please call us at the following toll-free number: (888) 315-9814. When you call us, please let us know which California privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your California privacy rights, so that we can process your request in an efficient manner.

Verifying Requests

To protect your information, we may need to verify your identity before processing any requests to exercise your right to access and right to request deletion. This will include verifying that the email address you provide in connection with your request matches the email address we maintain on file for you. In some cases, we may ask that you provide additional information to verify your identity, such as your full name or date of birth.

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

Requests by Authorized Agents

You can exercise these rights yourself or you can designate an authorized agent to make these requests on your behalf. We will request that your authorized agent have written permission from you to make requests on your behalf (or that you otherwise directly confirm the agent has permission to submit the request) and will need to verify your identity.

To submit a request as an authorized agent on behalf of a consumer, please email us at elfcare@elfcosmetics.com with the subject line “Authorized Agent—California Privacy Rights Request” and in the body of the email, please let us know which California privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your California privacy rights, so that we can process your request in an efficient manner. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

CONTACT US

If you have questions or concerns about this California Residents Privacy Addendum, please contact us using the contact information in the “Contact Us” section of the Privacy Notice.

COLORADO RESIDENTS PRIVACY ADDENDUM

Last Updated: September [X], 2024

Please note that the Colorado Residents Privacy Addendum only applies to Colorado residents who interact with us in an individual or household (not commercial or employment) capacity.

This Colorado Residents Privacy Addendum supplements the information in our Privacy Notice and uses certain terms that have the meaning given to them in the Colorado Privacy Act (“CPA”).

COLLECTION, USE AND SHARING OF PERSONAL INFORMATION

We may collect, use, and share personal information as described in the chart below.

Category of Personal Information	Processing Purpose(s) (see full list below)	Used for Targeted Advertising?	Sold or Shared
Identifiers such as contact details (including name, mailing address and email address), date of birth, gender and account password	· Process your requests, purchases, transactions and payments; · Provide, support, and develop our websites, mobile applications, products, and services; · Create, operate, maintain, customize, and secure your account or loyalty program membership with us; · Enhance your shopping experience; · Provide you with support and respond to your inquiries; · Personalize your website or mobile application experience and to deliver content and product and service offerings relevant to your interests; · Conduct analytics, statistics and research; and · Maintain the safety, security and integrity of our websites;	Yes	Sold to: · Advertising networks Shared with: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Payment processors · Marketing service providers · Our corporate affiliates · Advertising networks · Professional advisors such as auditors, law firms and accounting firms
Commercial information such as details of products purchased and wish lists	· Process your requests, purchases, transactions and payments; · Provide, support, and develop our websites, mobile applications, products, and services · Create, operate, maintain, customize, and secure your account or loyalty program membership with us; · Enhance your shopping experience; · Provide you with support and respond to your inquiries; · Personalize your website or mobile application experience and to deliver content and product and service offerings relevant to your interests; · Conduct analytics, statistics and research; · Maintain the safety, security and integrity of our websites; and · Evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.	Yes	Sold to: · Advertising networks Shared with: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Payment processors · Marketing service providers · Our corporate affiliates · Advertising networks · Professional advisors such as auditors, law firms and accounting firms
Payment information ⁽¹⁾	· Process your requests, purchases, transactions and payments	No	Please note that your credit card information is not stored or retained by us even if you save your credit card information in your account—we use a third-party payment processor to process credit card transactions.
Social media account handles and other information made publicly available through your social media profile	· Conduct analytics, statistics and research.	No	Not sold. Shared With: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Marketing service providers · Our corporate affiliates · Professional advisors such as auditors, law firms and accounting firms
Information we collect in relation to communicating with you	· Provide, support, and develop our websites, mobile applications, products, and services; · Create, operate, maintain, customize, and secure your account with us; · Provide you with support and respond to your inquiries; · Conduct analytics, statistics and research; · Maintain the safety, security and integrity of our websites; and	No	Not sold. Shared with: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Our corporate affiliates · Professional advisors such as auditors, law firms and accounting firms
Information about your skin such as skin tone, type, complexion, preferences and concerns	· Enhance your shopping experience; · Provide you with support and respond to your inquiries; · Personalize your website or mobile application experience and to deliver content and product and service offerings relevant to your interests; and · Conduct analytics, statistics and research.	Yes (but only with respect to information inferred by us in connection with your purchases, interaction with our marketing materials, or use of our websites or mobile applications)	Sold to: · Advertising networks Shared With: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Marketing service providers · Our corporate affiliates · Advertising networks · Professional advisors such as auditors, law firms and accounting firms
Internet or other electronic network identifiers and activity	· Process your requests, purchases, transactions and payments; · Provide, support, and develop our websites, mobile applications, products, and services; · Create, operate, maintain, customize, and secure your account with us; · Enhance your shopping experience; · Provide you with support and respond to your inquiries; · Personalize your website or mobile application experience and to deliver content and product and service offerings relevant to your interests; · Conduct analytics, statistics and research; · Maintain the safety, security and integrity of our websites; and · Evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.	Yes	Sold to: · Advertising networks Shared with: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Payment processors · Marketing service providers · Our corporate affiliates · Advertising networks · Professional advisors such as auditors, law firms and accounting firms
Other information you choose to provide, such as photos, videos, comments, replies or responses	· Provide you with support and respond to your inquiries; and · Conduct analytics, statistics and research;	No	Not sold. Shared with: · Service providers who help us run our business, such as order management and shipping processors, customer service and shopping experience providers, analytics service providers, IT service providers, and similar entities · Marketing service providers · Our corporate affiliates · Advertising networks · Professional advisors such as auditors, law firms and accounting firms

Processing Purposes:

to process your requests, purchases, transactions, and payments and prevent transactional fraud;
to provide, support, and develop our websites, mobile applications, products, and services;
to create, operate, maintain, customize, and secure your account with us;
to enhance your shopping experience while on our websites or mobile applications;
to provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses;
to personalize your website or mobile application experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our websites or mobile applications and via email or text message (with your consent, where required by law);
to conduct analytics, statistics and research;
to help maintain the safety, security, and integrity of our websites, mobile applications, products, and services, including to detect, prevent, or otherwise address fraud, security, or technical issues; and
to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our users is among the assets transferred.

We do not knowingly process personal information from children under the age of 13. We also do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the CPA. To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

YOUR COLORADO PRIVACY RIGHTS

If you are a Colorado consumer who interacts with us in an individual or household capacity (and not in a commercial or employment context), you may have the right to:

request access to, correction of or deletion of your personal information; and
opt-out of the processing of your personal information for purposes of targeted advertising or the sale of your personal data.

In addition, you may have the right to obtain your personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal information to another entity.

How to Submit a Request

Via the Internet

Privacy Rights Request Form. If you wish to access any personal information that is not contained in your relevant brand account profile, if you do not have an account and wish to access your personal information, or if you wish to submit a correction or deletion request, please click the “Privacy Rights Request Form” link in the footer of the applicable website. Please follow the instructions on the form to make your request. For your convenience the links for the Privacy Request Form are set forth in the “Your Rights and Choices” section of the Privacy Notice.

Do Not Sell or Share My Personal Information/Opt Out of Targeted Advertising. If you wish to request that we do not sell your personal information or share your personal information for cross-context behavioral advertising, please click the “Do Not Sell or Share My Personal Info/Opt Out of Targeted Ads” in the footer of the applicable website. Please follow the instructions. For your convenience the links for the “Do Not Sell or Share My Personal Info/Opt Out of Targeted Ads” are set forth in the “Your Rights and Choices” section of the Privacy Notice.

You also can opt out of the sale or sharing of your personal information by broadcasting the Global Privacy Control signal from a supported browser.

By mail

You may exercise your Colorado privacy rights by writing to us at the address detailed in the “Contact Us” section of this Colorado Residents Privacy Addendum. Please include your full name, mailing address, and any email address associated with your activity with us (for example, the email you used to receive marketing emails or order confirmations, or the email you have used in connection with your account (if you are a member)), and let us know which Colorado privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your Colorado privacy rights so that we can process your request or exercising of your rights in an efficient manner.

By telephone

You may exercise your Colorado privacy rights by calling us at the following toll-free number: (888) 315-9814. When you call us, please let us know which Colorado privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your Colorado privacy rights, so that we can process your request in an efficient manner.

Requests by Authorized Agents

To submit an opt-out request as an authorized agent on behalf of a Colorado consumer, please email us at elfcare@elfcosmetics.com (for e.l.f. Cosmetics, e.l.f. SKIN, Keys Soulcare, and Well People brands) or info@naturium.com (for Naturium) with the subject line “Authorized Agent—Colorado Privacy Rights Request” and in the body of the email, please let us know which Colorado privacy right you are exercising on behalf of a consumer and with respect to which e.l.f. Beauty brand that you are exercising the Colorado privacy rights, so that we can process your request in an efficient manner.

If you submit a request through an authorized agent, we will request that your authorized agent have written permission from you to make requests on your behalf (or that you otherwise directly confirm the agent has permission to submit the request) and may require that you also verify your identity.

How We Verify Your Identity to Complete Your Requests

To protect your information, we may need to verify your identity before processing your access, correction or deletion request. This will include verifying that the email address you provide in connection with your request matches the email address we maintain on file for you. In some cases, we may ask that you provide additional information to verify your identity, such as your full name or date of birth.

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

How to Submit an Appeal

You may appeal our decision regarding your privacy rights request by following any of the methods to exercise a privacy right or by contacting us using the contact information detailed in the “Contact Us” section of the Privacy Notice. So that we can process your appeal in an efficient manner, we ask that you email us at elfcare@elfcosmetics.com with the subject line “Decision Appeal—Privacy Rights” and in the body of the email, please let us know which privacy right decision you are appealing and with respect to which e.l.f. Beauty brand you are exercising your privacy rights.

BONA FIDE LOYALTY PROGRAMS

We may offer you various financial incentives, such as discounts and special offers, when you sign up with one of our brand loyalty programs, including the e.l.f. Beauty Squad Loyalty Program, the Keys Soulcare Rewards, or the Naturium Consistency Club Loyalty Program. To enroll in our loyalty programs, you are required to provide us with your name, date of birth (except for the Naturium Consistency Club Loyalty Program) and email address and create an account password. Once you enroll in the applicable loyalty program, we will also collect information about purchases you may make.

In connection with our loyalty programs, you can receive benefits and financial incentives based on certain purchases and other activities. You can join our loyalty programs and find program details, terms and conditions on our participating websites. You may opt out of receiving such financial incentives at any time by deactivating your loyalty program account(s). To deactivate your loyalty program account(s), visit the specific website of the loyalty program you wish to deactivate and provide your information as requested.

The categories of personal information collected through our loyalty program that may be sold or processed for targeted advertising include identifiers (such as your email address), Internet and other online activity information (such as IP address, browsing history and other information regarding your interactions with our websites), and commercial information (such as your order history and wish lists).

We may disclose personal information we collect through our loyalty programs to third parties such as service providers, data analytics providers, our corporate affiliates, and advertising networks. We do not provide the personal information we collect through our loyalty programs to data brokers, as defined by the Colorado Privacy Act.

If you exercise your right to request deletion of your personal information, it may be impossible for us to continue providing loyalty program benefits to you because we will no longer have the information required to provide you with certain benefits (such as information about qualifying purchases).

CONTACT US

If you have questions or concerns about this this Colorado Residents Privacy Addendum, please contact us using the contact information detailed in the “Contact Us” section of the Privacy Notice.

EU/UK PRIVACY ADDENDUM

Last Updated: September 25, 2024

Please note that, as of the date of this Privacy Notice, neither Naturium nor Well People provide products or other services to consumers in the EEA or the United Kingdom (except through third party retailers), and as such the EU/UK Privacy Addendum will not apply to Naturium’s or Well People’s websites and mobile applications.

WHO WE ARE AND WHEN THIS EU/UK PRIVACY ADDENDUM APPLIES

For purposes of EEA and United Kingdom data protection laws, e.l.f. Cosmetics, Inc., a corporation registered in the state of Delaware, USA is the controller of the personal information you provide to us, or that is collected or processed by or for us with respect to e.l.f. Cosmetics, e.l.f. Skin, or Keys Soulcare. Contact information for e.l.f. Cosmetics, Inc. can be found in the “Contact Us” section of the Privacy Notice.

Our representative for purposes of Article 27 of the General Data Protection Regulation is Thilo Noack at SBS Data Protect GmbH. The address and contact information for SBS Data Protect GmbH is:

SBS Data Protect GmbH
Attention: Thilo Noack Hans-Henny-Jahnn-Weg 49
22085 Hamburg, Germany
info@sbs-data.de
+49 40 7344086-0
+49 177 6422164

INTERNATIONAL OPERATIONS AND DATA TRANSFERS OUT OF EUROPEAN COUNTRIES

IMPORTANT: Your personal information will be sent to the United States and possibly other countries.

Our websites are hosted in the United States. If you are visiting one of our websites from outside the United States, your personal information will be transferred to, stored in, or processed in, the United States and transferred to, stored in, or processed in additional countries where our third-party service providers maintain facilities or operations. These countries include the United Kingdom, Ireland, the Netherlands, and Germany.

Where we transfer, store, or process your personal information outside of the EEA or the United Kingdom:

we do so to the extent such transfer, storage, or processing is necessary to fulfil a contract between us (for example, to manage your participation in our loyalty program or to fulfill your order); or
we rely on other methods to ensure an adequate level of data protection:
- Adequacy Decisions: Some of our third-party service providers are based in countries that the European Commission and competent authorities in the United Kingdom have found to have adequate levels of protection for personal information; or
- Standard Contractual Clauses: We rely on the European Commission’s model contracts for the transfer of personal information to third countries (i.e. the standard contractual clauses), and equivalent contracts issued by the relevant competent authority of the United Kingdom, when transferring personal information to our third-party service providers who are located in countries that the European Commission and the relevant competent authority of the United Kingdom as applicable have not found to have adequate levels of protection for personal information.

You can request a copy of the instruments we use by contacting us using the contact details provided in the “Contact Us” section of this EU/UK Privacy Addendum.

Please note that the data protection and other applicable laws of the United States or other countries may not be as comprehensive as those laws or regulations in your country or may otherwise differ from the data protection laws in your country. Your personal information may be available to government authorities under lawful orders and law applicable in such jurisdictions.

HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

How long we retain your personal information depends on why and how we collected it and how we use it. We will keep your personal information for as long as we need it for the purposes described in this Privacy Notice and to meet our legal obligations as explained further below.

To determine the retention period of your personal information, we consider several criteria to make sure that we do not keep your personal information for longer than is necessary or appropriate. These criteria include:

the purpose for which we hold your personal information;
our legal and regulatory obligations in relation to that personal information, for example any financial reporting obligations or statutory retention obligations (for example, under commercial or tax law which usually last from seven years);
whether our relationship with you is ongoing;
any specific requests from you in relation to the deletion of your personal information; and
our legitimate business interests in relation to managing our own rights, for example the assertion or defense of any claims within the statutes of limitation.

When we no longer need to retain your personal information, it will be deleted or be anonymized so that you can no longer be identified from it.

EU/UK GDPR PRIVACY RIGHTS

Accessing, Correcting, and Updating Your Personal Data

You have the right to access, correct, and update your personal information. You can access certain personal information by signing into your account for the relevant brand. From there, you can update, correct, or modify that personal information (other than your order history)—you will need to update, correct, or modify your personal information in each of your accounts with our brands as changes in one brand account will not automatically update your other brand accounts. Please note that deleting any personal information in your account will not completely delete that information from our systems—to completely have your personal information deleted, you must follow the directions in the “Requesting We Delete Your Personal Data” section of this EU/UK Privacy Addendum.

If you wish to access, correct, or modify any personal information that is not contained in your account profile (or if you wish to know the purposes for which your personal information is processed, the categories of data processed, third party recipients, if any, of your personal information, or third party sources, if any, of your personal information), please contact us using the contact information detailed in the “Exercising Your EU/UK GDPR Privacy Rights” section of this EU/UK Privacy Addendum.

Requesting Copies of Your Personal Data

You have the right to request a copy of your personal information held by us. In some circumstances you also have the right to request a copy in a structured, commonly used, and machine-readable format and/or request us to transmit this personal information to another service provider (where technically feasible). If you wish to request copies of your personal information held by us, please contact us using the contact information detailed in the “Exercising Your EU/UK GDPR Privacy Rights” section of this EU/UK Privacy Addendum.

Requesting We Delete Your Personal Data

You have the right to request that we delete your personal information in certain circumstances. If you wish to request that your personal information is deleted, please contact us using the contact information detailed in the “Exercising Your EU/UK GDPR Privacy Rights” section of this EU/UK Privacy Addendum.

Please note that if you are a member of one of our loyalty programs and you request that your personal information is deleted, you will be removed from that particular brand loyalty program.

We will need to retain certain records, for example those relating to open orders, payments, or customer service matters, or for legal and accounting purposes.

Note that if you have multiple email addresses linked to your account (or you used multiple email addresses in connection with purchases) you will need to make a data deletion request with respect to each email address in order for us to fully delete your personal information.

Objecting to Processing of Your Personal Data

You have the right to object, for legitimate purposes relating to your particular situation, to the processing of personal information as provided under applicable law. If you wish to object to processing of your personal information, please contact us using the contact information detailed in the “Exercising Your EU/UK GDPR Privacy Rights” section of this EU/UK Privacy Addendum.

Requesting that We Restrict Processing

You have the right to request that we restrict processing of your personal information. If you wish to request that we restrict processing of your personal information, please contact us using the contact information detailed in the “Exercising Your EU/UK GDPR Privacy Rights” section of this EU/UK Privacy Addendum.

WITHDRAWING CONSENT

If you wish to withdraw your consent to our processing of certain types of your personal data based on consent, or to promotional emails or third-party tailored advertising, please follow the applicable procedure in the “Your Rights and Choices” section of the Privacy Notice or, if not addressed, please contact us using the contact information detailed in the “Exercising Your EU/UK GDPR Privacy Rights” section of this EU/UK Privacy Addendum.

If you wish to withdraw your consent to cookie tracking, you can turn off cookies that are not necessary for the operation of our website. You can turn off these cookies by using the “Cookie Settings” or “Manage Consent” link in the footer of our website (depending on which website you are visiting).

Please note that if you withdraw consent for a particular feature, we cannot provide or continue to provide certain services or marketing communications to you and that withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Right to Give Us Postmortem Instructions (If Such Rights Exist in the Country Where You Reside)

If such rights exist in the country where you reside, and you wish to give us guidelines regarding the retention, erasure and disclosure of your personal information after your death, please contact us using the contact information detailed in the “Contact Us” section of this EU/UK Privacy Addendum. When you contact us, please be sure to note your country of residence and that you are giving us guidelines regarding the retention, erasure and disclosure of your personal information after your death in compliance with the law as well as with respect to which e.l.f. Beauty brand that you are giving us instructions so that we can efficiently process request.

If you need assistance or if you have questions about your right to give us postmortem instructions, please contact us using the contact information detailed in the “Contact Us” section of this EU/UK Privacy Addendum.

EXERCISING YOUR EU/UK GDPR RIGHTS

To make any of the requests or exercise any of your EU/UK GDPR privacy rights, including your right to access or deletion, please contact us using one of following methods. We respond to all data protection requests we receive in accordance with applicable data protection laws.

International Orders Through eShopWorld. Please note that if you purchased products from us through eShopWorld (as noted in the “International Orders Through eShopWorld” section of the Privacy Notice), eShopWorld may also be considered a controller of your personal information and as such you may also need to submit a data protection request directly to eShopWorld as detailed in eShopWorld’s Privacy Policy (which can be viewed at https://esw.com/privacy-policy).

Via the Internet

If you wish to exercise any of your EU/UK GDPR privacy rights via our websites, please click the “Privacy Rights Request Form” link in the footer of our website. Please follow the instructions on the form to make your request. For your convenience the links for the Privacy Request Form are below:

e.l.f. Cosmetics / e.l.f. SKIN	Keys Soulcare
Privacy Rights Request Form	Privacy Rights Request Form

By Mail

If you wish to exercise any of your EU/UK GDPR privacy rights, you can write to us at the address detailed in the “Contact Us” section of this EU/UK Privacy Addendum. Please include your full name, mailing address, and any email address associated with your activity with us (for example, the email you used to receive marketing emails or order confirmations, or the email you have used in connection with your account (if you are a member)) and let us know which EU/UK GDPR privacy right you are exercising and with respect to which e.l.f. Beauty brand that you are exercising your EU/UK GDPR privacy rights so that we can process your request or exercising of your rights in an efficient manner.

By Telephone

If you wish to exercise your right to access or your right to deletion via telephone, please call us at the following number: +1 (888) 315-9814. When you call us, please let us know that you are exercising your EU/UK GDPR) privacy rights, which privacy right you are exercising, and with respect to which e.l.f. Beauty brand that you are exercising your EU/UK GDPR privacy rights so that we can process your request or exercising of your rights in an efficient manner.

Other Methods

You may also contact us using the contact information detailed in the “Contact Us” section of this EU/UK Privacy Addendum. When you contact us, please let us know that you are exercising your EU/UK GDPR privacy rights, which privacy right you are exercising, and with respect to which e.l.f. Beauty brand that you are exercising your EU/UK GDPR privacy rights so that we can process your request or exercising of your rights in an efficient manner.

CONTACT US

If you have questions or concerns about this EU/UK Privacy Addendum, please contact us using the contact information detailed in the “Contact Us” section of the Privacy Notice.

Privacy Notice

Table of Contents

WHAT INFORMATION DO WE COLLECT, HOW DO WE COLLECT IT, AND HOW DO WE USE IT?

Influencer Data

COOKIES AND TRAFFIC DATA

Cookies

Google Analytics

eShopWorld

Turning off Cookies

HOW DO WE SHARE YOUR PERSONAL INFORMATION?

For Business Purposes

For Advertising

With Your Consent

For Legal Reasons

Affiliated Brands and Companies

In Connection with a Sale or Merger

Aggregated, Non-Personally Identifiable Information

YOUR RIGHTS AND CHOICES

Privacy Rights

o You may opt out of the processing of your personal information for purposes of targeted advertising using the relevant opt-out form linked below.

Updating Your Information

Withdrawing Your Consent for (Opting-Out of) Promotional Emails

Withdrawing Your Consent for (Opting-Out of) of SMS Text Messages (US Residents only)

Withdrawing Your Consent for (Opting-Out of) of Mobile Application Push Messages

Withdrawing Your Consent for (Opting-Out of) Cookie Tracking

Opting Out of Third-Party Tailored Advertising

SECURITY OF YOUR PERSONAL INFORMATION

COMPLAINTS

INTERNET BASED ADVERTISING

OUR POLICIES CONCERNING CHILDREN

THIRD PARTY WEBSITES

CHANGES TO THIS PRIVACY NOTICE

CONTACT US

CALIFORNIA RESIDENTS PRIVACY ADDENDUM

COLLECTION AND SHARING OF PERSONAL INFORMATION

Collection of Personal Information

Disclosure of Personal Information

Financial Incentive

Sale or Sharing of Personal Information

CALIFORNIA PRIVACY RIGHTS

You have certain choices regarding your personal information, as described below.

EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS

CONTACT US

COLORADO RESIDENTS PRIVACY ADDENDUM

COLLECTION, USE AND SHARING OF PERSONAL INFORMATION

EU/UK PRIVACY ADDENDUM

WHO WE ARE AND WHEN THIS EU/UK PRIVACY ADDENDUM APPLIES

INTERNATIONAL OPERATIONS AND DATA TRANSFERS OUT OF EUROPEAN COUNTRIES

HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

EU/UK GDPR PRIVACY RIGHTS

Accessing, Correcting, and Updating Your Personal Data

Requesting Copies of Your Personal Data

Requesting We Delete Your Personal Data

Objecting to Processing of Your Personal Data

Requesting that We Restrict Processing

WITHDRAWING CONSENT

Right to Give Us Postmortem Instructions (If Such Rights Exist in the Country Where You Reside)

EXERCISING YOUR EU/UK GDPR RIGHTS

CONTACT US