Notice at Collection: Categories of Personal Information We Sell or Share or Use for Targeted Advertising 

When we engage in digital advertising, we may sell the following categories of Personal Information (according to the broad definition of “sell” under select US state privacy laws), share them for purposes of cross-context behavioral advertising, or use them for targeted advertising: personal identifiers (including IP address, mobile advertising IDs) and internet or other electronic activity information. 

These categories of Personal Information are sold to, or shared for cross-context behavioral advertising or targeted advertising with advertising networks and other companies that facilitate or engage in digital advertising. We engage in such sales and sharing to facilitate personalized advertising.  We do so by allowing third parties to place cookies or other tracking technologies on our website that may collect information about your online activities over time and across different websites or applications.  For more information about the use of cookies and other tracking technologies, see the section “Our Use of Cookies and Analytics” below. 

To opt out of such sales and sharing of Personal Information, click here

We do not sell or share for cross-context behavioral advertising any of the other categories of Personal Information we collect.

Notice at Collection: Retention Periods

We may retain your Personal Information for as long as we need for a legitimate business purpose. The criteria used to determine the retention periods include: (i) how long the Personal Information is needed to provide our products and services; (ii) the type of Personal Information collected; and (iii) whether we are subject to a legal, contractual or similar obligation to retain the data (e.g., mandatory data retention laws, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation or disputes).

Sources From Which We Collect Personal Information

We collect Personal Information directly from our customers, website users, and representatives of entities with which we do business or may do business. 

Use or Disclosure of Sensitive Personal Information

We do not use or disclose sensitive Personal Information to create profiles about or infer characteristics about individuals, or for any purposes other than providing our Services. 

No Profiling to Facilitate Decisions with Legal or Other Significant Effects

We do not engage in the automated processing of Personal Information to create profiles about individuals that are used in furtherance of decisions with legal or other similarly significant effects, such as the provision or denial of financial or lending services, housing, insurance, or access to essential goods or services.

If you are located in the European Economic Area and the United Kingdom, you have a right to object to the processing of your Personal Information where that processing is carried out for our legitimate interests. Please note however that we may not be able to fulfil such requests in all instances. You are able to request a copy of the legitimate interest assessment carried out by us. Where we need to collect the abovementioned categories of Personal Information by virtue of a legal obligation or in light of a contract entered or to be entered into with you, and you do not provide this Personal Information when requested, we may not be able to comply with our legal obligations, provide you with the Services or perform the contract we have or are trying to enter into with you. In such case, we may have to terminate our relationship with you.

Disclosure of Personal Information for Business Purposes in the Past 12 Months

The following chart describes the categories of Personal Information that we disclosed to service providers or contractors (“service providers”) for a business purpose in the 12 months prior to the date of this Policy:  

Categories of Consumers’ Personal Information	Categories of Service Providers to Which We Disclosed Personal Information for a Business Purpose
Personal identifiers: Name, address, email address, postal address, billing address social media handle, mobile and other phone numbers, username and password, nickname/screen name, contact information of friends you provide to us or who are accessible when you visit our social media pages, and IP address	Service providers that assist us in fulfilling orders and delivering packages; sending postal mail, text messages and emails; operating, analyzing, and displaying content on our Site; provide analytics information; providing marketing and advertising services; conducting customer surveys; provide customer service; provide Site hosting; facilitate our contests and surveys; provide customer record management services; provide payment processing services
Protected class information: Gender, age, and date of birth	Service providers that assist us in fulfilling orders and delivering packages; sending postal mail, text messages and emails; operating, analyzing, and displaying content on our Site; provide analytics information; providing marketing and advertising services; conducting customer surveys; provide customer service; facilitate our contests and surveys; provide customer record management services
Commercial information:  Products purchased; products considered; product preference information such as product wish lists, order history, marketing preferences, and reminder and notification preferences; information that informs product selections such as physical characteristics and skincare information; survey responses and product review; comments made or articles written about our products; cred it or payment card information	Service providers that assist us in fulfilling orders and delivering packages; sending postal mail, text messages and emails; operating, analyzing, and displaying content on our Site; provide analytics information; providing marketing and advertising services; conducting customer surveys; provide customer service; provide Site hosting; facilitate our contests and surveys; provide customer record management services; provide payment processing services
Internet or other electronic activity information: Device and browser type and information regarding your interaction with our website, details about your browser, operating system, or device	Service providers that provide data security services and cloud-based data storage; host our Site and assist with other IT-related functions; provide website hosting; provide analytics information.

 

 

Business Purposes for Such Disclosures

We disclosed the aforementioned categories of Personal Information to the categories of third parties identified above for the following purposes: to manage customer, supplier and vendor accounts and relationships; process payments; verify customers’ identities; fulfill orders and transactions; engage in advertising and marketing; operate our IT systems and secure our systems; prevent fraud and other illegal activities; and to obtain professional advice about legal and accounting matters.    

Additional Information About How We May Disclose Personal Information and Purposes for Disclosures

We may also share Personal Information as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also share your Personal Information with third parties to help detect and protect against fraud or data security vulnerabilities.  And we may transfer your Personal Information to a third party in the event of an actual or contemplated sale, merger, reorganization of our entity or other restructuring.

We may also share with third parties for their marketing or analytics purposes aggregate, de-identified, or anonymous information .

Our Use of Cookies and Analytics

We may use cookies, pixel tags, web beacons and other similar tracking technologies (“tracking technologies”) to automatically collect information through our website. Tracking technologies are essentially small data files placed on your computer, tablet, mobile phone, or other devices that record certain pieces of information when you visit our website. We may use these tracking technologies to help identify irregular behavior, prevent fraudulent activity, and improve security, as well as making it possible for you to save your preferences and help us understand how you interact with our website.  For detailed information on tracking technologies we use and the purposes for which we use them, please see our Cookie Policy.

We also allow third parties (including Google and Meta) to use third party cookies, web beacons, and other storage technologies to collect or receive information about how you interact with our websites and apps and elsewhere on the Internet and use that information to provide analytics and other measurements services, and to deliver and target advertisements tailored to you. Third parties may also use some of these technologies to assist us in determining if you require assistance or are having problems navigating on our websites or apps, and this may include technologies that record your interactions with the website or app, including without limitation, your keystrokes, mouse clicks, screen touches, and information about when, how and from where you accessed our website or app. 

You may set your browser to notify you when you receive a cookie. Many web browsers also allow you to block cookies. You can disable cookies from your computer system by following the instructions on your browser or at www.youradchoices.com.

We use Google Analytics to evaluate the use of our website. Google Analytics uses cookies and other identifiers to collect information, such as how often users visit a website, what pages they visit when they do so, and what other websites they visited prior to visiting a website. To learn more about how Google Analytics collects Personal Information, review Google’s Privacy Policy.

Cross Border Transfer of Personal Information

We may transfer the Personal Information we collect about you to countries other than the country in which the information was originally collected and your Personal Information may be processed and stored outside of your country of residence. Those countries may not have the same data protection laws as your country of residence and your Personal Information will be subject to applicable foreign laws. When we transfer your information to other countries, we will protect that information in the manner described in this Policy.

Our Site is hosted in the US. Therefore, when you disclose Personal Information to us, this Personal Information will be transferred to the US.

If you are located in the EEA/UK, we may, for the purposes listed in Section II, transfer your Personal Information to other recipients as referred to above, that are also located in countries outside the EEA/UK, including the U.S., and which are not currently considered by the European Commission and/or UK Government to provide an adequate level of data protection. In these circumstances, we will take steps to ensure that the Personal Information is protected including by entering into Standard Contractual Clauses or similar (“SCCs”) with the recipient, seeking assurances from the recipient that they have Binding Corporate Rules in place or otherwise relying on a derogation for the transfer (e.g., where the transfer is necessary for the defense of legal claims).

You can request further information on the data transfer solutions relied upon including, a copy of the SCCs by using the contact details in the How To Contact Us section below.

Third Party Websites and Social Media Buttons

Our Site may contain links to third party websites or social media buttons. When you click on a link to any other website or social media button, you will leave our Site and go to another site or platform, and another entity may collect personal data or anonymous data from you. We have no control over, do not review, and cannot be responsible for, these outside websites or platforms, or their content. Please be aware that the terms of this Privacy Policy apply only to this Site; they do not apply to outside websites or content. We encourage you to read the privacy policies of every website you visit. The links to third party websites, social media platforms or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.

Notice of Financial Incentive – The Merit Loyalty Program

The Merit Loyalty Program (the “Program”) is our customer recognition program that rewards participating members on their birthday and for purchase volume

To participate in the Program, we collect your email, first name, last name, shipping address, and billing address.  Participants in the Program receive codes they can redeem to receive gifts or discounts on purchases over a certain amount.  We estimate the value of consumer data to be $3 per loyalty member based upon the average cost of goods redeemed through the loyalty program.   In determining the value of your information to us, we consider the profit generated from our product and service offerings that use Personal Information, which is reasonably related to the value provided to the consumer through personalized gifts or discounts.  The Program helps us establish brand loyalty and enhance the customer experience. 

We may sell or process for targeted advertising, the following categories of Personal Information in connection with your enrollment in the Program: personal identifiers, commercial information, and inferences.

The following categories of third parties may receive Personal Information in connection with our loyalty programs: ad tech partners or vendors, social networks, internet service providers, technology vendors, analytic providers, third party matching agents, and/or data brokers.

Participation in the Program is voluntary.  To sign up for the Program, you must provide us with your name and email address and create a loyalty program password.  You have the right to cancel your membership in the Program at any time. You can do so by emailing us at hi@meritbeauty.com.  We will not discriminate against you for exercising your rights under CCPA.

If a Program member chooses to delete the Personal Information associated with the Program and we can verify the eligibility to make the request, we will delete the information.  This will make it impossible to receive the Program benefits, such as codes participants redeem to receive gifts or discounts on purchases over a certain amount.

 Do Not Track and Similar Opt-Out Signals

We do not recognize the “DNT” (Do Not Track) signal.  We recognize the Global Privacy Control signal. 

Your Rights and Choices

We offer you certain choices in connection with the Personal Information we collect from you, such as how we use the information and how we communicate with you. To update your preferences, ask us to remove your information from our mailing lists or submit a request, please contact us in the manner specified below.

Children’s Privacy

This Site is not directed to children under the age of 13. We do not knowingly collect or sell Personal Information from minors under the age of 18.

How We Protect Personal Information

We maintain appropriate administrative, technical and physical safeguards designed to protect the Personal Information you provide against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. However, no security system is perfect and we cannot promise that information about you will remain secure in all circumstances, including the security of your Personal Information during transmission to us or the security of data on your mobile device.

Updates to Our Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in our Personal Information practices. We will post a notice on our website to notify you of any material changes to our Privacy Policy and indicate at the top of the Policy when it was most recently updated.

Accessibility

We are committed to ensuring that our communications are accessible to people with disabilities.  To make accessibility-related requests or report barriers, please contact us at hi@meritbeauty.com.

US STATE PRIVACY LAWS / EUROPEAN PRIVACY RIGHTS / AUSTRALIAN PRIVACY RIGHTS

U.S. STATE DATA PRIVACY RIGHTS

Consumer Rights Under Comprehensive U.S. State Data Privacy Laws

We may be subject to US state privacy laws in select states that provide their residents with various rights with respect to the personal information we collect about them, with some exceptions.  As of the date of this Policy, we may be subject to privacy laws in states including California, Colorado, Connecticut, Delaware, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia.  To the extent other state data privacy laws or amendments come into effect after the date of this Policy, once those laws are effective, we will provide rights to consumers under those laws to the extent they apply to us.  The rights provided under these laws are similar in many respects, with some differences from state to state.  We list below the rights that may be applicable to our business under these laws, noting that not all rights are available under each state’s law and they are subject to applicable limitations and exceptions under the law:

Right to Know: The right to confirm whether we are processing a resident’s personal information and to access such data.  Laws in some states provide the right to know more detailed information.

·      California’s privacy law gives residents the right to request the following additional information collected since January 1, 2022: Categories of personal information we have collected about them; categories of sources from which such personal information was collected; categories of personal information that the business sold or disclosed for a business purpose about the consumer; categories of third parties to whom the personal information was sold or disclosed for a business purpose; and the business or commercial purpose for collecting or selling your personal information.

·      Oregon’s privacy law gives residents the right to request a list of third party entities to which we have disclosed personal information.

Right to Access / Copy: The right to access or request a copy of the personal information we have collected from the resident, subject to certain exceptions.

Right to Delete: The right to request deletion of their personal information that we have collected from or about the resident and to have such information deleted, subject to certain exceptions.

Right to Correct: The right to request that we correct inaccuracies in the resident’s personal information, taking into account the nature of personal data and purposes of processing such information. 

Rights to Opt Out:  Various rights to request that we stop using the resident’s personal information for one or more of the following purposes:

·      Sale of Personal Information: The right to request that we stop selling f their personal information, consistent with the definition of “sale” in each law.

·      Targeted Advertising: The right to request that we stop processing their personal information for targeted advertising, subject to exceptions in some state laws. 

·      Sharing for Cross-Context Behavioral Advertising: California’s law provides the right to request that we stop sharing personal information for cross-context behavioral advertising. 

Please note, California’s law is the only law that applies to all state residents, irrespective of the context in which they interact with us (e.g., a customer, a business contact, a vendor).  Laws in other states apply only to people when acting in an individual or household context.

California Shine the Light

With reference to California Civil Code Section 1798.83, also known as the “Shine the Light” law, we allow California residents to opt out of the disclosure of personal information to third parties for those third parties’ direct marketing purposes.  To exercise that opt-out option, click here.

Exercising Your Rights

We will respond to requests from residents of states with data privacy laws that apply to us and will do so with respect to the rights that are provided under the requestor’s state law as of the effective date of that law.  The laws in some states listed above may not be in effect as of the date of this Privacy Policy.

To exercise rights to know, access/copy, delete, correct, or know third parties to whom personal information is disclosed, submit a request through our DSAR Form or by contacting us at hi@meritbeauty.com.  We will provide a substantive response to these requests within 45 days of the date on which we receive your request. If we require additional information or time to process your requests, we will contact you.

To exercise opt-out rights, submit your request here. 

Opt-out Preference Signals and Do Not Track

An opt-out preference signal is sent by a platform, technology, or mechanism on behalf of consumers and communicates a consumer’s choice to opt out of the sale and sharing of personal information for cross-context behavioral advertising with all businesses that recognize the signal, without having to make individualized requests.  The signal can be set on certain browsers or through opt-out plug-in tools. 

We recognize the Global Privacy Control signal and do so at the browser level and it does not apply to personal information we may collect offline or that we may associate only with your name or email address.  This means that if the signal is sent through a specific browser, we will recognize it for that browser only, and only with respect to the identifiers for that browser.  If you would like more information about opt-out preference signals, including how to use them, the Global Privacy Control website has such information (https://globalprivacycontrol.org/).

We will respond to opt-out requests as soon as feasibly possible, but no later than 15 business days after receipt of your request.  If we require additional information or time to process your requests, we will contact you.

We do not respond to the DNT or “Do Not Track” signal. 

Exercising Your Rights Using Authorized Agents

Agents may submit opt-out requests on behalf of individuals under several state data privacy laws; this is not an option that is available under laws in Iowa, Texas, Utah, or Virginia.   If the agent submits an opt-out request on your behalf, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.  Agents can submit opt-out requests here.  

California residents can designate an agent to submit all other types of requests. If you are a California resident and you use an agent to submit requests other than opt-out requests, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf.  You will also be required to verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request. Agents can submit requests on behalf of California residents (other than opt-out requests) here.

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney.  Any such requests will be processed in accordance with state law pertaining to powers of attorney.

Verification of Requests

When you exercise rights other than opt-out rights, we will take steps to verify your identity.  We will ask you for at least two pieces of personal information, depending on the nature of the request, and attempt to match those to information that we maintain or collect about you.

If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request.  We will notify you to explain the basis of the denial.

When We Do Not Act on a Request – Appeal Process

In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.   

Additionally, you have the right to appeal our decision by contacting us at hi@meritbeauty.com within 30 days after your receipt of our decision. 

Non-Discrimination

If you exercise any of the rights explained in this Privacy Policy, we will continue to treat you fairly.  If you exercise your rights under this Privacy Policy, you will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services than others.

EUROPEAN PRIVACY RIGHTS

Residents in the EEA and UK have the following privacy rights, subject to applicable limitations:

Right of Access: you have the right to confirm what data is being processed, obtain information about the processing activities and to receive a copy of your Personal Information;

Right to Rectification: you have the right to request rectification / correction of your Personal Information where it is inaccurate or incomplete

Right to Erasure: you have the right to request deletion of your Personal Information.

Right to Restriction: you have a right to ask that we restrict or suspend the processing of your Personal Information which means that whilst we are permitted to store the Personal Information, we cannot otherwise use it.

Right to Data Portability: you have right to request the transfer of certain Personal Information to a third party, in machine readable format.

Right to Object: you have the right to object to the processing of your Personal Information including for any direct marketing purposes.

Right to Withdraw Consent: you have the right to withdraw your consent, at any time, without hindrance or cost, to prevent further processing. Please note that withdrawing your consent does not affect the lawfulness of our processing of your Personal Information based on such consent before the withdrawal.

To exercise these rights, see our DSAR  Form and for rights not addressed there, please contact us at hi@meritbeauty.com. 

Right to Lodge a Complaint: you also have the right to file a complaint concerning our processing of your Personal Information with the competent data protection supervisory authority in the relevant jurisdiction.

AUSTRALIAN PRIVACY RIGHTS

Right of Access: you have the right to request access to any Personal Information held by us, subject to certain exceptions in the Privacy Act 1988 (Cth) (“Privacy Act”) by contacting us using the email provided in the section below. If we refuse to provide you with access to the information, we will provide you with reasons for the refusal and inform you of any exceptions relied upon (unless it would be unreasonable to do so).

Right to Seek Correction: you have the right to request correction of any Personal Information held by us where it is inaccurate or incomplete by contacting us using the email provided in the section below.

To exercise these rights see our DSAR Form.

Right to Lodge a Complaint: you have the right to lodge a complaint regarding our compliance with the Australian Privacy Principles contained in the Privacy Act with the Office of the Australian Information Commissioner.

*   *   *   *

How to Contact Us

If you have any questions or comments about this Privacy Policy, or if you would like us to update information, we have about you or your preferences, please contact us by email at hi@meritbeauty.com.

If we need, or are required, to contact you concerning any event that involves your Personal Information we may do so by telephone or email.

If you have inquiries regarding our privacy practices, or you would like to receive a copy of the Privacy Policy or address concerns regarding the handling of Personal Information, please contact us at:

For everyone:	For UK residents:
MERIT Customer Experience Team 750 N San Vicente Blvd West Hollywood, CA 90069  U.S.A. hi@meritbeauty.com	GDPR Representative: We have appointed the Osano UK Compliance LTD to act as our UK representative: Osano UK Compliance LTD ATTN: HNPI 42-46 Fountain Street Belfast Antrim BT1 - 5EF