This Privacy Notice is designed to give you clear and accessible information about how ELEMIS uses your personal data. You can read the short summary below for a quick overview.

Who we are
ELEMIS, USA, INC., 111 West 33rd Street, Suite 1910, New York NY 10120.
Contact: [email protected]

What we collect
Contact details, account and order data, payment information (via secure processors), browsing and device data, location data, marketing preferences, customer support communications, and inferred interest data.

How we use it
Processing orders; managing your account; sending marketing communications (with your consent); personalising your experience; fraud prevention; improving our website; legal compliance.

Who we share with
L'Occitane Group companies; service providers (fulfilment, payment, IT, analytics, marketing); advertising partners (Google, Meta, TikTok, Pinterest, Snap) where you have consented or as permitted by law; authorities where required.

Selling / sharing data
We do not sell your data for money. We do share data with advertising platforms in ways that may qualify as a ‘sale’ or ‘sharing’ under CCPA/CPRA. You can opt out via the “Do Not Sell or Share My Info” link on our website.

Your rights
Access, correction, deletion, restriction, portability, objection, opt-out of sale/sharing, and non-discrimination. California residents have additional CCPA/CPRA rights. See Section 9.

Retention
Kept only as long as needed for the stated purpose, or as required by law. See Section 8.

Cookies
We use strictly necessary, functional, analytics, and marketing cookies. Manage preferences via Cookie Settings in our website footer.

Contact / complaints
[email protected]
ELEMIS, USA, INC., 111 West 33rd Street, Suite 1910, New York NY 10120

Note: This Policy applies to us.elemis.com and the ELEMIS mobile application. It serves as notice to residents of USA. California-specific rights are set out in Section 11.

ELEMIS, USA, INC. (“ELEMIS”, “we”, “us”, “our”) is the controller responsible for your personal data collected through this website and associated mobile application.

If you have any questions about this Privacy Policy or our privacy practices, please get in touch with our Data Protection team:

Full name of legal entity:ELEMIS, USA, INC.

Email address: [email protected]

Post address:111 West 33rd Street, Suite 1910, New York NY 10120

Data subject requests: [email protected] — subject line: “Privacy Request”

We collect personal data through the following routes: account creation, purchases, marketing sign-ups, customer support interactions, website and app browsing, contests and surveys, and third-party platforms. We can also link and combine information we collect about you across the devices you use.

The types of personal information we may collect are:

• Identification data: name, mailing address, email address, mobile telephone number, date of birth;
• Account and authentication data: username, password, one-time codes, login history, checkout attempts and outcomes;
• Order and payment data: products purchased, delivery details, and payment information processed securely by our payment providers;
• Customer support data: enquiries, complaints, and communications with our Customer Care team;
• Marketing and preference data: communication preferences, survey responses, and interactions with our marketing;
• Technical and usage data: device type, operating system, browser type, unique device identifier, IP address, advertising ID, and how you use our website and application;
• Location data: general location data (such as zip code, city, or state) and, where you consent, precise geolocation;
• Advertising and tracking data: hashed identifiers (such as email address and postcode) shared with advertising platforms for conversion tracking; cross-device identifiers; and demographic and interest data inferred from platforms such as Google Signals;
• User-generated content: reviews, comments, photographs, or videos you choose to share;
• Inferred and modelled data: profiles derived from your purchase history, browsing behaviour, and email or advertisement interactions, used to improve product recommendations and marketing relevance;
• Customer Data Platform data: unified customer profiles created within our Customer Data Platform to deliver personalised experiences across email, website, and advertising; and
• Biometric data: face scan data collected only during virtual try-on experiences, retained for the duration of the session only, and not sold or shared.

Note regarding sensitive personal information: We do not intentionally collect or process sensitive personal information (such as health, biometric, or precise geolocation data) beyond the virtual try-on use case described above, unless you choose to provide it for a specific purpose and we have obtained your explicit consent where required by law.

We have set out below, in a table format, a description of all the ways we plan to use your personal data and the legal basis we rely on to do so:

To process your orders and deliver products
We use your contact, payment, and delivery data to fulfil and manage orders and to process transactions via our payment providers.

To create, register, and manage your account
We use your email address and contact details to create and manage your account, verify your identity during login and checkout (including passwordless authentication), and ensure you can access our services.

To provide customer support
We use your personal data, including identification data and communications, to respond to your enquiries, handle returns, and manage adverse reaction reports.

To send you marketing communications
We use your contact information and purchase history to send newsletters, offers, and updates by email and SMS where you have opted in, and to manage your communication preferences.

To personalise your experience
We use your browsing and purchase history to tailor product recommendations, content, and advertising to your interests.

To analyse and improve our website and services
We use cookies and usage data to measure site performance, understand user journeys, conduct A/B testing, and improve functionality and user experience.

To deliver targeted advertising and conversion tracking
We share hashed identifiers with Google and Meta for Enhanced Conversions; use Google Signals for cross-device audience modelling; and serve targeted advertisements via social media pixels (Meta, TikTok, Pinterest, Snap).

To manage our website and prevent fraud
We use identification data, transaction data, login and checkout activity logs, and cookie data to maintain site security, detect suspicious behaviour, and prevent unauthorised access and fraud.

To manage promotions and special events
We use your personal data, including purchase and transaction information, to manage your participation in contests, prize draws, surveys, and promotional offers.

To conduct marketing research and analysis
We combine personal data to assess and improve our products and services and to measure the effectiveness of our marketing and advertising campaigns.

To deliver AI-assisted features
We use personal data to power AI-assisted features that personalise your shopping experience, support customer service, and help protect your account from fraud. No automated decisions with legal or similarly significant effects are taken without human review.

To deter and prevent crime (CCTV)
We use CCTV recording equipment in and around our physical stores for monitoring and security purposes. We do not record audio. Our CCTV systems do not use facial recognition and are not connected to other systems containing personal data.

To comply with legal and regulatory obligations
We use personal data to comply with applicable laws and regulations and to establish, exercise, or defend legal claims.

Your personal data will be shared with and processed by certain recipients as necessary to fulfil the purposes set out in this Privacy Policy, including:

• other entities within the L’Occitane Group, where they assist us in providing products or services to you;
• service providers that help us with the maintenance and improvement of our website, and with the distribution, modification, and marketing of our products and services — including entities that process orders, provide web hosting, IT and data storage, email and SMS services (such as Bloomreach), analytics (such as Google Analytics), and tag management;
• advertising partners, including Google and Meta (including through Meta’s Conversions API and Lead Ads integrations), TikTok, Pinterest, and Snap, for conversion tracking, audience creation, and targeted advertising. Information shared with these partners may include hashed identifiers such as email address and postcode, and may constitute a Sale or Share under applicable state privacy laws — you may opt out via our “Do Not Sell or Share My Info” link;
• our product review partner, Bazaarvoice, which manages the collection, verification, and moderation of customer reviews;
• professional advisers and legal or regulatory authorities where required by law or necessary to establish, exercise, or defend legal claims; and
• third parties in connection with a merger, acquisition, sale of assets, or business reorganisation or restructuring. You will be notified of any material change in controller.

We require all third parties to respect the security of your personal data and to process it in accordance with the law. We ensure that all third parties we engage with enter into an agreement with us that meets our data security standards. Our third-party service providers may only process your personal data in accordance with our instructions and for specified purposes.

We may also share anonymous, aggregated information that does not identify you — such as aggregate website visitor numbers or advertisement click data — for our commercial purposes.

ELEMIS, USA, INC. is a US-based entity. Where personal data is transferred to other group companies or service providers located outside the US, we ensure that appropriate contractual or other safeguards are in place to protect your data in accordance with applicable law. Residents of states with enacted consumer privacy legislation retain all applicable rights regardless of where processing occurs.

If you require further information about the safeguards we use for international transfers, please contact our Data Protection team at [email protected].

We use cookies, pixels, tags, and similar technologies to operate our website, measure performance, personalise content, and deliver targeted advertising. Some cookies are set by third-party partners, such as Google and Meta, to support features including enhanced conversions and advertisement personalisation.

We use Google Consent Mode, which adjusts how Google tags behave based on your consent choices, ensuring analytics and advertising comply with your privacy preferences. You can manage or withdraw your consent at any time via the “Cookie Settings” link at the bottom of our website.

For more information about how we use cookies, including the full list of cookies in use and how to manage your preferences check our Cookies Settings link.

California residents: the use of marketing and advertising cookies may constitute a Sale or Share of personal information under the CCPA/CPRA. You may opt out via the “Do Not Sell or Share My Info” link on our website, or by adjusting your cookie preferences. We honour Global Privacy Control (GPC) signals as a valid opt-out instruction.

We have put in place security measures to protect the personal data you have trusted us with. The security measures are designed to prevent your personal data from being lost, used or accessed unauthorisedly, altered, or disclosed. We further secure your personal data by limiting its access to only employees, agents, contractors, and other third-party service providers who require it to fulfil their specified purpose in delivering our services. They only process your personal data in the manner prescribed by us, and they are all subject to a duty of confidentiality.

We only retain your personal data for the period necessary to fulfil the purposes for which we collected it and to meet our legal, accounting, and regulatory obligations.

The criteria we use to determine the appropriate retention periods include:

• Purpose of Collection: We retain your data for the duration necessary to achieve the purpose for which it was collected. For example, if your data is collected for a specific service, it will be retained for as long as you use that service.
• Legal Obligations: We may retain your data for a longer period if required by law, such as for tax, accounting, or other regulatory purposes.
• Business Needs: We may retain your data for backup, archival, audit, or legal purposes. This ensures that we can continue to provide our services and comply with our legal obligations.
• Consent: If you have given consent for a specific use of your data, we will retain it for the duration of that consent, unless you withdraw it.
• Anonymisation: When we no longer need your personal data, we will delete or anonymise it in accordance with our data retention policies and applicable laws.

Residents of certain states have rights under applicable privacy laws, subject to specific conditions.If you reside in one of those states, you may submit a request regarding your Personal Information by contacting our Data Protection team at [email protected]. We will review and respond to all requests in accordance with applicable law.

Based on your state of residency and to the extent required by applicable law, you may be able to exercise some or all of the following rights regarding your Personal Information that we have collected, including:

• Opt-out / Unsubscribe from receiving advertising & Do not sell or share my personal information: You may have the right to request to stop receiving marketing emails from us; You can also exercise this right by clicking on the “unsubscribe” button located near the bottom of each email. You may have the right to request to opt out from the sale or sharing of your personal information and the processing of your personal information for targeted advertising, as applicable. You will still receive advertisements, but they will be more general in nature. Please note that we may continue to collect and share Personal Information about you with other third parties, including to continue providing Services to you where the sharing of your Personal Information is for purposes other than targeted advertising and as permitted by law. You may exercise this right via the “Do Not Sell or Share My Info” link on our website, by adjusting your cookie preferences, or by emailing [email protected]. We honour Global Privacy Control (GPC) signals as a valid opt-out instruction.
• Know / Access: You may have the right to access the Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information was collected, the business or commercial purposes for collecting the Personal Information, the categories of third parties to whom we disclose the Personal Information, and the specific pieces of Personal Information we have collected about you.
• Delete: You may have the right to request that we delete Personal Information we collected from you, subject to legal exceptions.
• Correction: You may have the right to request that we correct inaccurate Personal Information we maintain about you, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information.
• Portability: You may have the right to obtain a copy of the Personal Information about you that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

We may from time to time disclose consumer Personal Information for a business purpose, such as operational purposes, or other notified purposes that are reasonably necessary and proportionate to achieve the operational purpose for which the Personal Information was collected or processed or otherwise is compatible with the context in which the Personal Information was collected.

We will not discriminate or retaliate against you for exercising your privacy rights.

You may exercise any of the Privacy Rights described in this section by sending a request to us by email at [email protected] or mail your inquiry to:

Elemis USA, Inc.
Attn: [email protected]
111 West 33rd Street, Suite 1910 New York NY 10120

We may ask you to verify your identity before processing certain requests. Where permitted by applicable law, you also may designate an authorised agent to submit a request on your behalf, subject to requirements to establish proof of identity and authorisation.

Depending on your state of residence, you may have the right to appeal our decision regarding your request for your personal information. You may submit an appeal of our decision by sending an email to [email protected] With “Appeal” in the subject line. Our data protection team will review your appeal request and provide a response within the time required by applicable law

This section supplements the rest of this Policy and applies to California consumers. To the extent required by the CCPA/CPRA, it prevails over any conflicting information above.

11.1 Categories of personal information collected, disclosed, and sold or shared

Identifiers (name, email address, IP address, account name)
Retention: As long as necessary for our legitimate business purposes.
Source: Directly from you; indirectly via your use of our website.
Sold or Shared? We may share certain identifiers (such as hashed email address and postcode) with advertising platforms for conversion tracking and audience creation.

Categories of personal information described in Cal. Civ. Code §1798.80(e) (name, address, financial information)
Retention: As above.
Source: Directly from you.
Sold or Shared? We may share name and zip code. We do not sell or share financial account numbers, credit or debit card numbers, or other payment data.

Commercial information (purchase history)
Retention: As above.
Source: Directly and indirectly from you.
Sold or Shared? We may share your purchase history.

Internet or other electronic network activity (browsing history, site interaction data)
Retention: As above.
Source: Indirectly from your actions on our website.
Sold or Shared? We may share this information.

Geolocation data
Retention: As above.
Source: From you, where provided.
Sold or Shared? We may share general location data (such as zip code or city).

Inferences drawn to create a consumer profile (preferences, characteristics, trends)
Retention: As above.
Source: Derived from the data above.
Sold or Shared? We may sell and/or share inferences.

Biometric information (face scan data collected during virtual try-on experiences)
Retention: Duration of the virtual try-on session only.
Source: Directly from you.
Sold or Shared? We do not sell or share biometric data.

11.2 Sale and sharing of personal information

ELEMIS does not sell personal information for monetary consideration. However, our use of advertising platforms — including Google (Enhanced Conversions, Google Signals), Meta (Conversions API, Facebook Pixel), TikTok, Pinterest, and Snap — to deliver targeted advertising may constitute a ‘share’ or ‘sale’ under the CCPA/CPRA where those platforms receive something of value in exchange.

You may opt out of the sale or sharing of your personal information at any time by:

• clicking “Do Not Sell or Share My Info” on us.elemis.com;
• adjusting your cookie preferences via our Cookie Settings; or
• emailing [email protected] (subject line: “CCPA Opt-Out”).

We honour Global Privacy Control (GPC) signals as a valid opt-out instruction.

11.3 Sensitive personal information

We do not use sensitive personal information for purposes beyond those permitted under CCPA/CPRA Regulations section 7027(m) without your explicit consent. In particular, we do not use sensitive personal information to infer characteristics about you or for advertising beyond providing the service you have requested.

11.4 Shine the Light (Cal. Civ. Code §1798.83)

California residents may submit a once-per-calendar-year written request for information about personal data we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year. Please email [email protected] with “Request for California Privacy Information” in the subject line and include your name and address. We will respond within 30 days. We reserve the right not to respond to requests submitted more than once in a calendar year.

ELEMIS complies with applicable consumer privacy legislation in all US states that have enacted such laws. Residents of those states have rights substantially similar to those set out in Section 9 — including rights to access, correct, delete, opt out of targeted advertising and profiling, and (where applicable) data portability — and may exercise them by contacting [email protected]. We do not sell personal information for monetary consideration in any state. Where state law requires us to honour a request not to sell or share personal information (including under Nevada NRS Chapter 603A), we will do so on receipt of a request to [email protected].

Our website and services are not intended for or directed to individuals under the age of 18. We do not knowingly collect personal information directly from children under 18 without verifiable parental consent. If you believe that a child under 18 has provided us with personal information, please contact us at [email protected] and we will take reasonable steps to delete it. If we become aware that a child under 18 has provided us with personal information without appropriate parental consent, we will delete that information from our records.

We may amend this Privacy Notice from time to time. If we decide to change this Privacy Policy, we will update those changes on https://us.elemis.com/privacy-policy so you are always aware of what information we collect, how we use it, and the circumstances under which, if any, we disclose it. If we decide to collect personal data or use any collected information in a manner different from that stated when it was collected, we will notify you. We will use personal data only in accordance with this Privacy Policy under which it was collected.

If you have any complaints concerning our processing of your personal data, please get in touch with our Data Protection team at [email protected]

You have the right to submit a complaint with the supervisory authority or regulatory body responsible for protecting personal data in the state or country where you live or work, or where you think a breach of data protection laws may have occurred. California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.