Maelys Cosmetics USA Inc. and its affiliated companies ("Maelys", "Company", "us", "we", or "our") are dedicated to providing clients and site visitors (collectively, "users") with the highest level of transparency and control over the use of their information. This Privacy Policy (the "Policy") describes our practices regarding the collection, use, sharing, storage and processing of Personal Data (as defined below). This Policy applies to our website https://www.maelyscosmetics.com/, any other domains or subdomains owned and operated by us (collectively, the "Websites"), as well as any other services, features, or platforms we operate (the "Services"). This Policy is incorporated into and forms part of our Terms of Use (the "Terms").

This Policy applies whenever you visit or interact with our Services. Please note that parts of this Policy may not be applicable to you, depending on the jurisdiction in which you reside and the applicable laws.

By accessing and using our Services, you consent to the collection, storage, use, transfer, disclosure and other uses of your Personal Data as described in this Policy.

We urge you to read this Policy carefully and make sure that you fully understand and agree to it. If you do not agree to this Policy, please discontinue and avoid using our Services. You have the right to cease using our Services at any time, pursuant to this Policy and our Terms. You are not legally required to provide us with any Personal Data, but without it we will not be able to provide you with the best experience of using our Services.

Table of Contents

1. What is Personal Data?

We collect two types of data from you: Personal Data (also referred to as "Personal Information" under applicable laws) and non-Personal Data.

Personal Data means any data which may potentially allow your identification with reasonable means (for example, email address or name).

Non-Personal Data, by contrast, can be defined as any data that does not relate to an identified or identifiable natural person. This may include, for example, your aggregated usage data and technical data transmitted by your device (e.g. the device you use, the type of browser and operating system your device uses, language preference, access time, etc.). Our use of non-Personal Data is outside the scope of this Policy.

If we associate Non-Personal Data with Personal Data, we will treat such data as Personal Data as long as such association exists.

2. What types of Personal Data we collect?

We may collect and process the following types of Personal Data:

• Registration and order information. If you choose to open an account and register to our Services to become a Maelys member, or when you make a purchase on our Website, we collect your full name, username, password, shipping address, email address, and telephone number. We collect this data to create, maintain and secure your account. If you choose to register an account, you are responsible for keeping your account credentials safe. In addition, if you choose to register to our Services using your Gmail account, in addition to the above, we will also receive access to Personal Data included in such account, such as your profile picture and any other information you make available subject to your privacy settings in the applicable social media platform.
• Communication information. When you communicate with us, for example through the "Contact Us" option on our Website, through e-mail or any other channel (including any support services), or when you provide us with your e-mail address when you sign-up to receive our newsletter or other communications, we collect your full name, email address, phone number, the contents of those communications, and/or attachments you may send us, and/or answers to surveys or questionnaires that you may submit, and any other information you choose to provide us.
• Payment, transactions and billing information. Our Services include the option to purchase products from us, as a standard sale, as part of our "Subscribe & Save" service, and as part of our "Try Before You Buy" service. If you choose to make any kind of purchase, we will require sufficient information from you to complete the transaction. Such information may include details of your payment method, account, billing details, invoice related information, and other data required to process the order. Additional information may include details about your purchases, order history, and information relating to refunds, returns, or customer transactions. We collect and use this type of data for the purpose of processing required payments, but we do not collect or save your payment method details. Your payment method details might be encrypted and saved by our 3rd party payment processing provider(s), compliant with PSI DSS regulation, for future offers, the Subscribe & Save service, or Try Before You Buy payment collection.
• Device and technical information. We may collect technical information about your interaction with our Services, including by email or text messages. This information includes data such as IP address, unique identifiers and other device identifiers that are automatically assigned to your device browser type and language, hardware type, device type, operating system, internet service provider, geo-location information (such as city and country) and other information about actions taken through the use of our Services such as items viewed, added to cart or purchased, search queries, clickstream data, and your preferences or saved settings. In addition, we may also collect technical data about the use of our Service and the characteristics and activities of users, in order to operate it and improve it, such as website visits, display settings, session start/stop time, referral URL, time zone, network connection type (e.g., Wi-Fi, cellular), and Tracking Technologies data, as defined below. We collect or generate such data either independently or with the help of third-party services, including through the use of Tracking Technologies. We do not use such data to learn a person's true identity or contact details, but mostly to have a better understanding on how our users typically use and engage with our Services.
• Information from other sources. We may also obtain information about you from other sources, including information we receive from our business partners and service providers, and may include Personal Data such as your contact details (name, phone, email).

3. Why do we process your Personal Data?

This section explains for what purposes we use your Personal Data and, where applicable, outlines the legal bases that underlie our usage.

Where applicable, the following describes the specific purposes for which you have voluntarily provided your Personal Data and in respect of which you have not indicated an objection to, or withdrawal of consent for, our use of such Personal Data, as recognized under applicable law. Where you wish to indicate such objection or otherwise withdraw your consent to such use, please refer to Section 8 ("Your rights") for information on how you may exercise this right at any time.

4. With whom do we share your Personal Data?

We may disclose your Personal Data as described below:

5. Tracking technologies

When you visit or access our Services we use (and authorize 3rd parties to use) pixels, cookies, web beacons and other similar technologies ("Tracking Technologies"). Those allow us to automatically collect information about you, your device and your online behavior, in order to enhance your navigation in our Services, improve our Services' performance, perform analytics and customize your experience.

We and our advertising partners also use Tracking Technologies to improve our advertising practices and make ads and related marketing content we deliver more effective, relevant and enjoyable, including by deploying retargeting and ad measurement and attribution systems. Such data is pseudonymized and only includes advertising identifiers (Advertising IDs), IP addresses, and other interest-based data.

For more information about the Tracking Technologies we use please read our Cookie Policy.

6. International transfers

Please note that we, as well as our service providers, may be located around the world. Any data that we collect, disclose or share, including (but not limited to) your Personal Data, may be stored and processed in various jurisdictions around the world for the purposes detailed in this Policy, including in countries that may not provide the same level of data protection as the country where you reside. In such cases we will ensure that applicable safeguards and where required, legal mechanisms are used to ensure that the transfer is aligned with the applicable data protection laws.

Australian users. We may disclose your Personal Data to entities located outside of Australia, including to third parties established in the EU, US, Israel or other locations, as necessary to provide you with our services and manage our business. If you are an Australian resident and wish to learn more about our data transfers outside of Australia, please contact us using the contact details provide below.

7. How do we protect your Personal Data

We have implemented administrative, technical, and physical safeguards designed to protect your Personal Data against unauthorized access, use, or disclosure. Your Personal Data is stored on secure infrastructure protected by multiple layers of access controls, network security measures, and monitoring systems. Data transmissions are encrypted using industry-standard protocols, and access is restricted to authorized personnel on a need-to-know basis. All individuals with access to Personal Data are bound by strict confidentiality obligations and undergo regular security training. We maintain backup and disaster recovery procedures to ensure business continuity while protecting data integrity and availability.

However, while we seek to protect your data to ensure that it is kept confidential, please note that we cannot guarantee that the data will not be compromised. You need to help us prevent unauthorized access to your account by protecting your password appropriately and limiting access to your account. You will be solely responsible for keeping your password confidential and for all use of your password and your account, including any unauthorized use. You should also be aware that there is always some risk involved in transmitting information over the internet. While we strive to protect your Personal Data, we cannot ensure or warrant the security and privacy of your Personal Data or other content you transmit using the service, and you do so at your own risk.

8. Your rights

Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your Personal Information. To the extent these rights apply and concern you, you can contact us via the contact details available below and ask us to exercise the following rights:

1. Rights of access: The right to receive confirmation as to whether or not Personal Information concerning you is being processed, and access your stored Personal Information, together with supplementary information.
2. Right of rectification: The right to request rectification of your Personal Information that is in our control, in the event that you believe the Personal Information held by us is inaccurate, incomplete or outdated.
3. Right of deletion/erasure: The right to request that we erase or delete Personal Information held about you.
4. Right to restrict processing: The right to request to restrict the processing of your Personal Information by us.
5. Right of portability: The right to receive the Personal Information you provided us with in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller.
6. Right to object to processing: The right to request that we cease to conduct certain Personal Information processes at any time.
7. Right to withdraw your consent: Where we rely on consent to process Personal Information about you, you have the right to withdraw your consent to the collection, use or processing of your Personal Information at any time. Exercising this right will not affect the lawfulness of processing your Personal Information based on your consent before its withdrawal.
8. Right to limit use and disclosure of your sensitive Personal Information: The right to request to limit the use and disclosure of your sensitive Personal Information, to that use which is necessary to perform our Services.
9. Right not to be subject to automated decision making: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects.
10. Right to opt-out of the sale or share of Personal Information: The right to opt-out of the "Sale" or "Share" of Personal Information (as these terms are defined under applicable laws) for behavioral advertising purposes.
11. Right to non-discrimination: You have the right to be free from any discrimination for exercising your rights, such as offering you different pricing or products, or by providing you with a different level or quality of services, based solely upon your request.

Exercising your rights:

1. You may request to exercise these rights by contacting us at: [email protected]. We will handle these requests, complaints or queries in accordance with applicable laws, and provide you with a reply in a timely manner. Please note that we may require additional information and documents when processing your request, including certain Personal Data, in order to authenticate and validate your or any applicable authorized agent's identity and to process your request. Such additional information may also be retained for legal purposes in accordance with this Policy.
2. In some jurisdictions, you have the right to appeal a rejection of your request. Please submit your appeal to [email protected]. If your appeal is denied, certain jurisdictions allow you to submit a complaint via the local attorney general or another competent authority responsible for handling such matters.
3. If you believe we have breached your privacy, please contact us using the details below and provide information about the incident so we can investigate it. We will handle your complaint confidentially, review it carefully, and aim to contact you and resolve the matter within a reasonable timeframe (and, where applicable, within the period required under the applicable data protection law).
4. If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in your jurisdiction of residency, as applicable to you.

Please be aware that we cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Data provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

Please note that these rights are not absolute and may be subject to our own legitimate interests and regulatory requirements.

9. Additional information for US residents

This section addresses specific disclosure requirements under the applicable laws pertaining to data privacy, data security, and the protection of Personal Information in the United States (collectively, "US Privacy Laws").

9.1. Collection of Personal Information

In the preceding twelve (12) months, we have collected the following categories of Personal Information:

9.2. Sources of Personal Information

In the preceding twelve (12) months, we have collected the above-mentioned categories of Personal Information from the following categories of sources:

1. Directly, through your activity on our Services: For example, from your interaction with the Website, our Services and when you provide information via our Services.
2. Indirectly from you: We track some activities across the internet, for example, when you view or interact with certain content, web pages or ads.
3. From third parties: For example, from service providers who assist us in performing the Services.

9.3. Disclosure of Personal Information

We do not "Sell" your Personal Information, as this term is defined under US Privacy Laws. However, we may disclose Personal Information about you.

In the preceding twelve (12) months, we may have disclosed or shared your Personal Information as follows:

When we disclose Personal Information, we ensure that the recipient only have access to such information that is strictly necessary for us to provide the Services. These parties are required to secure the Personal Information they receive, and to use it for pre-agreed purposes only, while ensuring compliance with all applicable data protection regulations.

9.4. Selling and sharing Personal Information

We do not "sell" or "share" Personal Information about our users as most people would typically understand this term. However, we do allow certain third-party advertising partners to collect pseudonymized information about consumers through our Services for purposes of serving ads and related marketing materials that are relevant (including related activities such as campaign measurement and analytics, fraud detection and reporting). In this context, we may be regarded as "selling" or "sharing" advertising identifiers and IP addresses with our advertising partners. These mobile advertising IDs allow developers and marketers to track activity for advertising purposes and are used to enhance the personalization of ads. If you choose to opt-in for an SMS marketing campaign, we will not disclose your opt-in or consent status with any third-party for purposes unrelated to providing you with the services of the campaign. We may disclose your Personal Information, including your SMS opt-in or consent status, as detailed in the "Why do we process your Personal Data?" section above.

You may opt out from the "sale" or "share" of your Personal Information by: (a) using our Your Privacy Choices; (b) resetting these identifiers from within your device or limit ad tracking for your device as mentioned in the Cookie Policy; (c) you may also contact us, by using the contact details provided below.

9.5. Purposes for collection, processing and sharing

In addition to the practices detailed in this Policy, we also use and disclose the Personal Information we collect for the following commercial and business purposes:

1. Auditing related to our interactions with you;
2. Legal compliance;
3. Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and necessary prosecution;
4. Debugging;
5. Performing services (for us or our partners);
6. Internal research for technological improvement;
7. Internal operations;
8. Activities to maintain and improve our services; and
9. Other one-time or short-term uses.

9.6. Authorized agent

If you are a California resident, you may only designate an authorized agent to make a request on your behalf if: (i) The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and (ii) you sign a written declaration that you authorize the authorized agent to act on your behalf. The request must: (i) provide sufficient information to allow us to reasonably verify you are the person about whom we collected Personal Information or an authorized agent. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you, and (ii) describe your request with sufficient details to allow us to properly understand, evaluate, and respond to it. We will only use Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

9.7. Direct marketing requests

California Privacy Rights. California Civil Code Section 1798.83 permits our customers who are California residents to request certain information regarding disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to [email protected]. Please note that we are only required to respond to one request per customer each year.

10. Minors

We do not knowingly collect any Personal Data from Minors (as determined under the applicable laws where the individual resides; "Minor(s)"). We understand the importance of protecting Minors's privacy, especially in an online environment. The Website and Services are not designed for or directed at Minors. By accessing or using our Services, you certify to us that you are not a Minor. In the event that we become aware that we have collected Personal Data from a Minor without verification of parental consent, we will delete that information upon discovery. If you believe that we might have any information from or about a Minor, please contact us at [email protected].

11. Marketing

We may use your Personal Data, such as your full name, email address, phone number etc., collected by us or through our trusted third-party service providers for the purpose of providing users with promotional materials such as: (i) notifying you about offers and services that may be of interest to you that we and/or other companies within our group, as applicable, offer, or our business partners and affiliates, which we believe could interest you, subject to obtaining your explicit consent, when required by applicable law (including but not limited to, by building an automated profile based on your Personal Data, for marketing purposes); (ii) tailoring content, advertisements, and offers for you, including, targeting and re-targeting practices; (iii) conducting market research; (iv) developing and marketing new products and services, and to measure interest in our Services; (v) other purposes disclosed at the time you provide Personal Data; and (vi) as you otherwise consent.

The materials may be sent via different marketing techniques, such as direct emails, text messages, as well as products, services, websites and applications. For example, by subscribing to our newsletter you will receive tips and announcements straight to your email account. Users may choose not to receive our promotional or marketing communications by either: clicking on the "unsubscribe" link in each such communication that you receive from us or by contacting our customer support. Please note that even if you unsubscribe from our promotional or marketing communications, we may continue to send you service-related updates and notifications, or respond to your queries and feedback.

In addition, even if you opt-out of promotional or marketing communications, we may still use and share your Personal Data with third parties for non-marketing purposes (such as providing our Services, fulfilling your requests, communicating with you and responding to your inquiries). In such cases, the third-parties with whom we share your Personal Data are permitted to use it only as necessary to perform these non-marketing services.

We will not share your opt-in for an SMS campaign with any third-party for purposes unrelated to providing you with services related to the campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third-parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages, as further described under the "With whom do we share your Personal Data?" section above.

12. Social Features

Certain features of the Services allow you to initiate interactions between the Services and third-party services or platforms, such as social networks ("Social Features"). Social Features include features that allow you to access our pages on third-party platforms, and from there "like" or "share" our content. Use of Social Features may allow a third party to collect and/or use your information. If you use Social Features, information you post or make accessible may be publicly displayed by the third-party service. Both we and the third-party may have access to information about you and your use of both the Services and the third-party service. For more information, see the section below, "Third-Party Products and Services".

13. Third-Party Products and Services

We enable you to engage with third-party websites, mobile applications and products or services that are not under our ownership or control (referred to as "Third-Party Service"). However, we are not responsible for the privacy practices, security measures, or content of these Third-Party Services. Please note that these Third-Party Services may collect Personal Data from you. Therefore, we strongly encourage you to read the terms and conditions and privacy policies of any Third-Party Service you engage with.

14. Data retention

We will retain your Personal Data for as long as necessary to provide our services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.

15. Updates to this Policy

We reserve the right to change this Policy at any time. The most current version will always be posted on our Website (as reflected in the "Last Updated" heading). You are advised to check for updates regularly. By continuing to access or use our Services after any revisions become effective, you agree to be bound by the updated Policy. However, if this Policy is changed in a significant way, a notice will be posted on the home page of the Website 7 days before changes take effect, unless the changes originate from any legal or regulatory requirement, in which case, the change shall enter into force in accordance with such requirement.

16. Controlling version

This Policy has been drafted in the English language, which is the original and controlling version of this Policy. To the extent permitted by law, all translations of this Policy into other languages shall be solely for convenience and shall not control the meaning or application of this Policy. In the event of any discrepancy between the meanings of any translated versions of the Policy and the English language version, the meaning of the English language version shall prevail.

17. Dispute Resolution

Any dispute, claim, or controversy arising out of or relating to this Privacy Policy, including any alleged violation of your privacy rights, the collection, use, sharing, or security of your Personal Data, or any other matter related to our data practices, shall be resolved in accordance with the Dispute Resolution and Arbitration Agreement set forth in our Terms of Use, which is incorporated herein by reference. This includes any claims based on federal or state privacy statutes.

By using our Services or submitting your Personal Data to us, you acknowledge that you have read and agree to the arbitration and class action waiver provisions in our Terms of Use.

18. Contact us

If you wish to exercise any of the aforementioned rights, or receive more information, please contact us at: [email protected].

Maelys USA representative information:
Maelys Cosmetics USA Inc.
251 Little Falls Drive,
Wilmington, DE 19808
USA

Updates to This Policy

This Privacy Policy is subject to change from time to time, in our sole discretion. The most current version will be posted on our website (as reflected in the "Last Updated" heading). You are advised to check for updates regularly.

By continuing to access or use our Services after revisions become effective, you agree to be bound by the updated Privacy Policy.

Cookie policy

Last updated: February 2025

Introduction

When you visit or access our website, or when you interact or engage with our content ("Services"), we use (and authorize third parties to use) web beacons, cookies, pixel tags, scripts, tags, API and other technologies ("Tracking Technologies").

The Tracking Technologies allow us to automatically collect information about you and your online behavior, as well as your device (for example your computer or mobile device), in order to enhance your navigation on our Services, improve our Services performance and customize your experience on our Services.

We also use this information to collect statistics about the usage of our Services, perform analytics, deliver content tailored to your interests and administer services to our users, advertisers, publishers, customers and partners.

We also allow third parties to collect information about you through Tracking Technologies.

What Are Cookies?

Cookies are small text files (composed only of letters and numbers) that a web server places on your computer or mobile device when you visit a webpage.

When used, a cookie can help make our Services more user-friendly, for example by remembering your language preferences and settings.

Cookies are widely used to make websites work efficiently. They allow navigation between pages, remember preferences, improve interaction with the Services and help ensure that advertisements shown online are relevant to you and your interests.

Storing Tracking Technologies

We store Tracking Technologies when you visit or access our Services (for example when visiting our websites). These are called "First Party Tracking Technologies".

In addition, Tracking Technologies are stored by third parties (for example analytics providers, business partners and advertisers) that run content on our Services. These are called "Third Party Tracking Technologies".

Both types may be stored either for the duration of your visit or for repeat visits.

What Types of Tracking Technologies Do We Use?

There are five main types of Tracking Technologies:

• Strictly necessary Tracking Technologies.
• Functionality Tracking Technologies: remember choices you make (such as language), support authentication and provide personalized features.
• Performance Tracking Technologies: collect information about online activity (for example visit duration, behavioral data and engagement metrics) for analytics, research and statistics.
• Marketing or Advertising Tracking Technologies: deliver tailored offers/ads, support marketing campaigns, cap ad frequency and measure campaign effectiveness.
• Social media Tracking Technologies: support social features (for example Facebook "Like" or "Share") and are governed by third-party platform privacy statements.

How to Manage Your Cookie Settings

Please note that we do not recognize or respond to automated browser signals regarding Tracking Technologies, including "Do Not Track" requests.

There are various ways to manage and control your cookie settings. By deleting or blocking cookies, some features of the Services may not work properly or as effectively.

• Chrome
• Chrome for mobile
• Internet Explorer and Microsoft Edge
• Mozilla Firefox
• Safari

Turning Off Third-Party Cookies

You can turn off certain third-party targeting/advertising cookies by visiting the Network Advertising Initiative.