In addition to the La Prairie companies mentioned in the Data Controllers & Contact section below, we may share your personal data: (where permitted in accordance with applicable privacy laws) with the following third parties for the purposes outlined above:

• companies in our group. A full list of our group companies can be found here;
• banks and our payment services provider for the purpose of transaction processing;
• third parties, where we have your permission to do so (e.g. social networks providers, concierge service or our authorized retail partners). Your personal data will become subject to the privacy policies of those third parties when your personal data is shared with them;
• prospective or eventual buyers of our business (if we or substantially all of our assets are acquired by or merged with a third party including through bankruptcy);
• any law enforcement agency, court, regulatory, government authority or other third party where in our reasonable opinion this is necessary to comply with a legal or regulatory obligations or otherwise to enforce or apply our Terms of Use or any other agreements and our selective distribution system; or to protect the rights, brand, property, or safety of La Prairie, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction; or
• our third-party service providers (as well as group companies and authorized retail partners) who perform services on our behalf based on our instructions. We do not authorize these parties to use or disclose the information except as necessary to perform services on our behalf or to comply with legal requirements. Examples of these parties include employees of our authorized retailers and partners that serve you in the stores, IT support service providers, companies that fulfil orders and manage refunds, and provide data hosting and support, content personalization, advertising and marketing services (including digital and personalized advertising) and data cleansing, management, segmentation and analysis.

Please note that the third parties listed above may be located in a country outside of your country of residence, including outside the European Economic Area, United Kingdom or Switzerland. Please click here for a list of our affiliate locations. When these third parties process your data on our behalf, we implement appropriate contractual arrangements with them that include strong data protection obligations. More details about international data transfers can be found below under "Data Transfers."

We also share information with third parties including social media and search engine partners:

We aggregate your personal data with the information of other customers, creating a dataset of information about the usage of our platforms, purchase of our products, and other general, grouped information about our customers. Although this dataset is aggregated and anonymised, meaning it cannot directly or indirectly identify you as an individual, it provides a valuable insight into the use of our Digital Platforms and Points of Sale and we will share it with select third parties. These parties include our group companies.

We also transfer information about you to ad technology providers and our social media and search engine partners (including Meta, Google and Twitter) so that they may recognize your devices and deliver interest based content and advertisements. The information can include your name, postal address, email, device ID, or other identifier in encrypted form. The providers often process the information in hashed or de-identified form. These providers can collect additional information from you, such as your IP address and information about your browser or operating system; combine information about you with information from other companies in data sharing cooperatives in which we participate; and may place or recognize their own unique cookie on your browser. The third parties that generate these cookies have their own privacy policies that will apply.

In this regard, we have concluded a corresponding agreement with Meta for joint controllership, which can be accessed here: https://www.facebook.com/legal/controller_addendum. This agreement defines the respective responsibilities for fulfilling the obligation under the applicable laws with regard to joint controllership. The contact details of the controller and the data protection officer of Meta can be found here: https://www.facebook.com/about/privacy. Without prejudice to this, the jurisdiction of the Rights of Data Subjects is not limited. We have agreed with Meta that Meta can be used as a contact point for the exercise of data subject rights (see Section 8).

Further information on how Meta processes personal data, including its legal basis and further information on the rights of data subjects can be found here: https://www.facebook.com/about/privacy. We transfer the data within the scope of joint controllership based on the legitimate interest.

Information on the data security conditions can be found here. https://www.facebook.com/legal/terms/data_security_terms and on processing on the basis of standard contractual clauses can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum.

Data Transfers

Your personal data is stored mainly on servers in the European Union. However, we operate globally and may transfer your personal information to other companies within the La Prairie group, (a full list of which can be found here), third party service providers or to authorized retail partners in locations around the world, including countries that do not provide an adequate level of data protection. We want you to have the best service and client experience no matter how and where you interact with us, whether in our Digital Platforms or our Points of Sale all over the world. For this purpose, we may have to share your personal information outside the country where you have first shared it with us, always for the purposes described in this Policy and where we are satisfied with the levels of protection and security implemented by the third party in compliance with applicable laws. This sharing of your personal information is necessary to enable us to offer you a global and personalized client experience and services.

Where your personal data is transferred to jurisdictions outside the place from which you are accessing the website, the European Union or Switzerland and to jurisdictions that do not offer an adequate level of data protection in accordance with the European Commission, Swiss authorities, or the relevant applicable laws, we will take steps to ensure your information is adequately protected by entering into the EU Commission and Swiss approved standard contractual clauses pursuant to Art. 46 (2) of the GDPR or put in place other measures under applicable laws to ensure that such transfer provides adequate safeguards. More information about this topic for users from the European Union and Switzerland is published here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en

A copy of the relevant mechanism can be obtained for your review on request by using the contact details provided in Section 10.

Your personal data will be retained for a certain period of time based on the following criteria: (i) as long as necessary to fulfil the purposes outlined in this Policy; (ii) any applicable legal requirements; or (iii) any request for deletion from you in applicable situations.

To the extent permitted by applicable laws:

• In relation to our clients, your data is stored for the duration of the contractual relationship and for 7 years afterwards.
• In relation to our prospects: your data is stored for 3 years from your last interaction with us.

Please note that we may be required by law (e.g. tax, accounting or legal obligations) to store certain data for a longer period of time. For more information, please contact us using the details in Section 10.

What are cookies?

Cookies are small text files that websites send to your computer, mobile device or other Internet-connected device to uniquely identify your browser or to store information or settings in your browser.

We use and allow third party service providers to use cookies, web beacons and other similar technologies on our platforms, social media pages and communications. We do this to understand your use of our services, improve your user experience and enable personalized features and content; optimize our advertising and marketing and to enable third party advertising companies to assist us in serving ads specific to your interests across the Internet. View a full list of cookies and update your preferences in the Cookie Settings.

The cookies that we use can be categorised as follows:

• Strictly necessary cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the website will not then work. These cookies do not store any personally identifiable information.

• Analytical / Performance cookies

These cookies allow us to count visits and traffic sources, so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. Whenever technically possible, all information these cookies collect is aggregated and therefore anonymous.
[If you do not allow these cookies, we will not know when you have visited our site. Upon your consent, we use Google Analytics, run by Google Inc for this purpose. To opt out of being tracked by Google Analytics, you can visit the Cookie Settings or visit https://tools.google.com/dlpage/gaoptout.

• Functional cookies

These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these services may not function properly.

• Targeting/advertising cookies

These cookies may be set through our website by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly identifying personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Web server logs and web beacons

In conjunction with obtaining information through cookies, our web servers may log details such as your operating system type, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone in which your device is located. The web server logs also may record information such as the address of the web page that linked you to our website and the IP address of the device you use to connect to the Internet. This information helps us to troubleshoot errors, improve performance and maintain the security of our Digital Platforms. To control which web servers collect this information, we may place tags on our web pages called “web beacons”. These are computer instructions that link web pages to particular web servers and their cookies. We may also use cookies and similar technologies (such as web beacons) to allow us to tell if an email we have sent to you has been opened and acted upon and whether our mailing tools are working correctly or, to measure performance and to provide content and ads that are more relevant to you.

Can I opt out of cookies and similar technologies?

You have the option to accept or reject our cookies at any time in the Cookie Settings.

By rejecting or disabling cookies, certain website content or functionality may not be available to you.

Because web beacons are the same as any other content request included in the recipe for a web page, you cannot opt out or refuse them. However, you may be able to disable web beacons in email messages by not downloading images contained in messages you receive (this feature varies depending on the email software used on your personal computer). However, doing this may not always disable a web beacon or other similar technologies in the email message due to specific email software capabilities. For more information about this, please refer to the information provided by your email software or service provider. Web beacons may also be rendered ineffective in some circumstances by opting out of cookies or amending your cookie settings in your browser.

Your rights

In accordance with applicable law, you may have the following rights:

• Right of access and information: you have the right to be informed in a concise, transparent, intelligible and easily accessible form of the personal data we process about you and how we process it. You also have the right to obtain a confirmation from us on whether or not we process your personal data and if that is the case, access to such personal data and obtain a copy.
• Right to rectification: you have the right to rectify your personal data and to have it complete in case it is incomplete or inaccurate.
• Right to erasure: you have the right to ask us to delete your personal data. We will delete or anonymize your personal information, unless otherwise required by applicable data protection laws or if La Prairie has a legitimate interest to keep it.
• Right to restriction of processing: in some cases, you have the right to obtain restriction of the processing of your personal data.
• Right to discontinue collection, use, and/or processing: if you are a resident of Taiwan, you have the right under the PDPA to request that we discontinue the collection, use, and/or processing of your personal data.
• Right to data portability: you have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit such personal data to another controller.
• Right to withdraw your consent: if you have given your consent to a data processing activity, you can withdraw this consent at any time as indicated under "Your preferences." Please note that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement or contractual obligation to process your personal data. In some instances, this may mean that we are able to retain your personal data even if you withdraw your consent. In such a case, we will apply appropriate measures and safeguards to protect your personal data.

Right to object

You have the right to object to the processing of your personal data when such processing is based on legitimate interests. Nevertheless, we may have legitimate reasons to continue processing your personal data.

If you wish to exercise any of these rights, please contact us by using the details in Section 10.

Your preferences

We strive to provide you with choices regarding the personal data that you provide to us. The following mechanisms give you control over your personal data:

Advertising, marketing and personalization (offline and online): If you wish to be notified about our products and services, events, loyalty and other client programmes as well as other promotional activities, you can indicate your communication preferences through the relevant checkbox(es) on our Digital Platforms and Points of Sale or by answering the question(s) presented by our beauty advisors or store representatives. Some of our activities and communications may be personalized to your specific interests and preferences (which will be done with your permission, if required by law).

If you wish to stop receiving our marketing communications (and/or you wish opt out of only some type of personalized marketing communications), simply let us know at any time by following the opt-out instructions in the relevant communication or using the details in Section 10. Please note that we send different types of personalized marketing communications (e.g. newsletters, beauty advisors’ emails, surveys, etc.) and you can decide to opt out of all of them or only some of them. Opting out of personalized marketing communications will not stop you from receiving service messages (i.e. non-marketing communications, such as e-mail updates on your order status or notifications about your account activities) from us.

Please note you may be asked about your preferred channel/s to receive our communications and you can change or update this at any time by contacting one of our beauty advisors or using the contact details in Section 10.

We only undertake direct marketing with your consent, where required by applicable law. If you have a La Prairie account on our Digital Platforms, you can withdraw your consent and/or update your communication preferences under your account profile while logged in.

Cookies/Similar Technologies and Interest Based Advertising: You can set your cookie preferences at any time in the Cookie Settings.

If you are a California resident, you may take advantage of the following privacy rights:

• Right to Know: You have the right to know what personal data we have collected about you, including the categories of personal data, the categories of sources from which the personal data is collected, the business or commercial purpose for collecting, selling, or sharing personal data, the categories of third parties to whom we disclose personal data, and the specific pieces of personal data we have collected about you.
• Right to Delete: You have the right to delete personal data that we have collected from you, subject to certain exceptions. Note that there are some reasons we will not be able to fully address your request, such as if we need to complete a transaction for you, to detect and protect against fraudulent and illegal activity, to exercise our rights, for our internal purposes, or to comply with a legal obligation.
• Right to Correct: You have the right to correct inaccurate personal data that we may maintain about you, subject to appropriate verification.
• Right to Opt-Out of the Sale or Sharing of Personal Data: You have the right to opt-out of the "sale" or "sharing" of your personal data, as such terms are defined in California privacy laws, to third parties and to affiliated companies that do not share the same brand name. This means that, if you opt out, going forward, we will not sell or share your personal data with such third parties to use for their purposes, including cross-context behavioral advertising, unless you later direct us to do so.

If you are a Virginia resident, you may take advantage of certain privacy rights pursuant to Virginia Code 59.1-577. For example, you may request to access, correct, or delete your personal data. Because we "sell" personal data and engage in "targeted advertising" as these terms are defined in Virginia law, you may also exercise your right to opt-out of such sales or targeted advertising. You have the right to appeal a denial of your privacy rights.

How to submit a request

To take advantage of your right to know, delete, or correct under California or Virginia law, or to submit an appeal of a denial of your privacy rights, please use the Client Services page of our website to send us a note or contact us by phone at 1 800 821 5718, or by using the Data Controllers and Contact section below. We may request certain information to verify your identity before we can respond to your access and deletion requests. We will confirm receipt of your request within 10 business days and will respond to your request within 45 calendar days, after proper verification, unless we need additional time, in which case we will let you know.

To take advantage of your right to opt out of the sale or sharing of personal data, please click on the "Do Not Sell or Share My Personal Information" link which also is on our website footer or contact us using the Data Controllers and Contact section, below.

We will not discriminate against you because you exercised your rights under this section of the Privacy Policy.

Agent requests

You may authorize someone to make a privacy rights request on your behalf (an authorized agent). Authorized agents will need to demonstrate that you’ve authorized them to act on your behalf or must demonstrate they have power of attorney pursuant to applicable probate law. La Prairie retains the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent’s identity. An authorized agent is prohibited from using a consumer’s personal data, or any information collected from or about the consumer, for any purpose other than to fulfill the consumer’s requests, for verification, or for fraud prevention.

Text messages

You can text SIGNUP to 48442 to receive exclusive news about La Prairie, or by signing up through our website, you are subscribing to receive promotional text messages from La Prairie at the mobile number you provided. Consent to receive marketing text messages is not required as a condition of purchasing any goods or services. Standard message, data, voice, or other rates may apply from your mobile service or wireless device carrier for SMS messages you receive. Message frequency will vary.

You can opt out of texts at any time by replying STOP to any text message or text 48442. You may receive one final confirmation SMS message of your opt-out request. For help related texts, reply HELP to any text message or text 48442. You can also contact us using the details in Section 10.

Supported carriers in the US are: AT&T, Sprint, T-Mobile®, Verizon Wireless, Boost, Cricket, MetroPCS, U.S. Cellular, Virgin Mobile, ACS Wireless, Appalachian Wireless, Bluegrass Cellular, Carolina West Wireless, Cellcom, C-Spire Wireless (formerly Cellsouth), Cellular One of East Central Illinois, Cincinnati Bell Wireless, Cross (dba Sprocket), Duet IP, Element Mobile, EpicTouch, GCI Communications, Golden State, Hawkeye (Chat Mobility), Hawkeye (NW Missouri Cellular), Illinois Valley Cellular, Immix (Keystone Wireless / PC Management), Inland Cellular, iWireless, Mobi PCS (Coral Wireless LLC), Mosaic, MTPCS / Cellular One (Cellone Nation), Nex-Tech Wireless, nTelos, Panhandle Telecommunications, Peoples Wireless, Pioneer, Plateau, Revol Wireless, Rina - Custer, Rina - All West, Rina - Cambridge Telecom Coop, Rina - Eagle Valley Comm, Rina - Farmers Mutual Telephone Co, Rina - Nucla Nutria Telephone Co, Rina - Silver Star, Rina - South Central Comm, Rina - Syringa, Rina - UBET, Rina - Manti, South Canaan / CellularOne of NEPA, Thumb Cellular, Union Wireless, United, Viaero Wireless, West Central Wireless, Leaco, Nemont/Sagebrush. T-Mobile is not liable for delayed or undelivered messages.

Data Protection Disclosures

Categories of Personal Data Disclosed for Business Purposes

In the last 12 months, La Prairie has disclosed the following categories of personal data for a business purpose (such as with our service providers or processors, whose use of personal data we disclose is limited to providing certain service to us pursuant to a written contract):

• Identifiers, billing information and commercial information, disclosed to our affiliates, our third-party service providers, payment processors, email/SMS service providers, customer service and intelligence platforms, cloud data storage providers, and anti-fraud and anti-counterfeiting service providers.
• Website registration credentials, disclosed to our cloud data storage providers.
• Preferences, disclosed to our affiliates, our third-party service providers, email/SMS service providers, customer service and intelligence platforms, and cloud data storage providers.
• Personal life information, disclosed to our affiliates, our third-party service providers, customer service and intelligence platforms and cloud data storage providers.
• Communications with you, disclosed to our affiliates, our third-party service providers and our cloud data storage providers.
• Content you provide, disclosed to our affiliates, our third-party service providers and our cloud data storage providers.
• Internet or electronic activity information, disclosed to our affiliates, our third-party service providers, payment processors, email/SMS service providers, customer service and intelligence platforms, cloud data storage providers, and anti-fraud and anti-counterfeiting service providers.
• Demographic information, disclosed to our affiliates, our third-party service providers, payment processors, email/SMS service providers, customer service and intelligence platforms, cloud data storage providers, and anti-fraud and anti-counterfeiting service providers.
• Sensitive personal data disclosed to our affiliates, our third-party service providers, email/SMS service providers, customer service and intelligence platforms, and cloud data storage providers.
• Audio or visual Information disclosed to our security providers.
• Inferences drawn from the above categories, disclosed to our affiliates, our third-party service providers, payment processors, email/SMS service providers, customer service and intelligence platforms, cloud data storage providers, and anti-fraud and anti-counterfeiting service providers.

Additional detail on the business purposes for which we disclose personal data is provided above under "How we Disclose and Transfer Your Personal Data?"

Categories of Personal Data Sold or Shared

In the last 12 months, La Prairie has sold or shared the following categories of personal data with advertising networks, advertising platforms, and social media companies for the purposes described in this Privacy Policy, including for targeted advertising:

• Identifiers
• Commercial information
• Preferences
• Personal life information
• Internet or electronic activity information
• Social media information
• Demographic information
• Inferences drawn from the above categories

We do not knowingly sell or share personal data about persons under the age of 16.

If you have any questions about this Policy or privacy matters generally or to make a complaint about our compliance with applicable privacy laws, please contact us using the Contact us page of our website and our customer services team will be happy to assist you.

You can also use this Contact us if you wish to exercise your preferences and rights as detailed above.
We will acknowledge and investigate any complaint you make (including a complaint that we have breached your rights under applicable privacy laws). We hope that we can satisfy queries. The Data Protection Officer (DPO) designated by La Prairie Group AG (and its affiliates) is available at the following address: Data.Privacy@LaPrairieGroup.ch

However, you have the right to lodge a complaint with the relevant data protection authority, in particular in the Member State of your habitual residence or place of the alleged infringement.

If you are in Australia, your data protection authority is the Office of the Australian Information Commissioner (www.oaic.gov.au).

If you are in Hong Kong, your data protection authority is the Office of the Privacy Commissioner for Personal Data (https://www.pcpd.org.hk/)

If you are in Japan, your data protection authority is the Personal Information Protection Commission. (https://www.ppc.go.jp/)