California Privacy Notice

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) as a supplement to Profectus Beauty, LLC’s (“Company” “us” “we” our”) other privacy policies or notices. In the event of a conflict between any other Company policy, statement or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA.

This Notice covers the collection, use, disclosure, and sale of California Consumers’ “Personal Information” (“PI”) as defined by the CCPA, except to the extent such PI is exempt from the notice obligations of the CCPA. This Notice also covers rights California Consumers have under the CCPA as well other notices to Californians required by other laws. The description of our data practices in this Notice, as required by the CCPA, covers only calendar year 2021 and will be updated annually. Our practices in calendar year 2022 may change, however, if materially different such that we think a Consumer would reasonably expect notice we will provide notice in connection with the applicable collection, which may include reference to other applicable privacy policies and notices.

Consistent with the CCPA, job applicants, current and former employees and independent contractors (“Personnel”), and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business, are not considered “Consumers” for purposes of this California Privacy Notice or the rights described herein. However, our Personnel may obtain a separate privacy notice that is applicable to them by contacting our Human Resources department here.

To aid in readability, in some places we have abbreviated or summarized CCPA terms or language, but a full copy of the CCPA is available here for your review, and in some places in this Notice we cite and/or link to specific CCPA sections for your reference. Terms defined in the CCPA that are used in this Notice shall have the same meaning as in the CCPA.

You can click on the following blue links to navigate to the different sections in this Notice.

PI We Collect.

We collect PI about California Consumers including:

Category of PI	Examples of PI	Sources of PI	Business or Commercial Purposes for PI Collection
1. Identifiers (as defined in CCPA §1798.140(o)(1)(A))	This may include, but is not limited to: a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, or email address	Consumers directly	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance
2. Personal Records (as defined in CCPA §1798.140(o)(1)(B))	This may include, but is not limited to: telephone number, credit card number, or debit card number.	Consumers directly	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance
3. Customer Account Details / Commercial Information (as defined in CCPA §1798.140(o)(1)(D))	This may include, but is not limited to: products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Consumers directly	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance
4. Internet Usage Information (as defined in CCPA §1798.140(o)(1)(F))	This may include, but is not limited to: browsing history, search history, and information regarding your interaction with an Internet Web site, application, or advertisement.	Consumers directly	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance
5. Geolocation Data (as defined in CCPA §1798.140(o)(1)(G))	This may include, but is not limited to: precise physical location or movements and travel patterns.	Consumers directly	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance
6. Sensory Data (as defined in CCPA §1798.140(o)(1)(H))	This may include,but is not limited to: audio recordings of customer care calls.	Consumers directly	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance

As permitted by applicable law, we do not treat deidentified data or aggregate consumer information as PI and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information. We have no obligation to re-identify such information or keep it longer than we need it to respond to your requests. This helps us practice data minimization, which we consider to be a privacy best practice consistent with our mission to respect our customers.

Return to Table of Contents

Sources of PI.

We may collect your PI directly from you or from our affiliates. For more specifics tied to each category of PI, see the chart above.

Return to Table of Contents
Collection and Use of PI.

Generally, we collect, use and disclose your PI to provide you services and as otherwise related to the operation of our business. For more specific detail on our disclosures of PI, see the next section Sharing of PI. We may collect, use and disclose the PI we collect for one or more of the following business purposes:
- Processing Interactions and Transactions (§1798.140(d)(4));
- Managing Interactions and Transactions (§1798.140(d)(1));
- Performing Services (§1798.140(d)(5));
- Quality Assurance (§1798.140(d)(7));
- Security (§1798.140(d)(2));
- and Debugging (§1798.140(d)(3)).
Subject to restrictions and obligations of the CCPA, our vendors may also use your PI for some or all of the above listed business purposes.

We may collect, use and disclose your PI for commercial purposes such as for interest based advertising and sharing PI in a manner that is deemed a sale under the CCPA.

In addition, we may collect, use and disclose your PI as required or permitted by applicable law.

For more specifics tied to each category of PI, see the chart above.

Return to Table of Contents

Sharing of PI.

We may share PI with our service providers, other vendors (including those that facilitate interest-based and other advertising and marketing), affiliates, and/or third parties to which we sell your PI, including without limitation during calendar year 2020 as follows:

Category of PI	Shared with Third Parties?	Categories of Third Parties
1. Identifiers (as defined in CCPA §1798.140(o)(1)(A))	Yes	Advertisement networks, social networks
2. Consumer Characteristics (as defined in CCPA §1798.140(o)(1)(C))	No	Advertisement networks, social networks
3. Internet Usage Information (as defined in CCPA §1798.140(o)(1)(F))	Yes	Advertisement networks, social networks
4. Geolocation Data (as defined in CCPA §1798.140(o)(1)(G))	Yes	Advertisement networks, social networks

Disclosures for Business Purposes, at Your Direction and In Corporate Transactions and Intra-Company Transfers:

We may share your PI (as described above in PI We Collect) with our service providers and other qualified vendors for the same business purposes for which we collect such PI as described above in the Collection and Use of PI, including in the calendar year 2020 as follows:

Category of PI	Disclosed for a Business Purpose?	Business Purposes for Disclosures	Categories of Recipients of Business Purpose Disclosure
1. Identifiers (as defined in CCPA §1798.140(o)(1)(A))	Yes	Auditing, processing interactions and transactions, performing services, quality assurance	Service Providers
2. Personal Records (as defined in CCPA §1798.140(o)(1)(B))	Yes	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance	Service Providers
3. Customer Account Details / Commercial Information (as defined in CCPA §1798.140(o)(1)(D))	Yes	Auditing, security, debugging, processing interactions and transactions, performing services, quality assurance	Service Providers
4. Internet Usage Information (as defined in CCPA §1798.140(o)(1)(F))	Yes	Marketing, marketing analytics and diagnostics, fraud prevention	Service Providers
5. Geolocation Data (as defined in CCPA §1798.140(o)(1)(G))	Yes	Fraud prevention, processing interactions and transactions, quality assurance	Service Providers

Notwithstanding anything to the contrary in our other privacy notices, we typically restrict use of your PI that is governed by the CCPA’s Consumer rights provisions and is shared with our vendors to business purposes, or we treat such disclosures as sales of your PI subject to your Do Not Sell rights.

In addition, if you direct us to share PI we may, and that is not a sale. Also, disclosures amongst the entities that constitute Company as defined above are not a sale.

Sale

We may sell your PI (as the term “sell” is defined by the CCPA). The PI sold in the calendar year 2020 may include:

Category of PI	Sold?	Purposes for Selling	Categories of Recipients of PI Sold
1. Identifiers (as defined in CCPA §1798.140(o)(1)(A))	Yes	Marketing	Third Parties
2. Personal Records (as defined in CCPA §1798.140(o)(1)(B))	Yes	Marketing	Third Parties

For more information on how to exercise your do not sell rights, click here.

The CCPA defines “sale” in an unusual way, and with no guidance yet from the State of California as to how broadly the term should be interpreted, a number of differing reasonable interpretations are possible.

Some may argue that when certain third parties place cookies on the consumer’s device when the consumer engages with our Services, the PI collected by such cookies constitutes a “sale” under the CCPA. We do not agree with this interpretation. However, pending a consensus as to what “sale” actually means under the CCPA, you can access our Data Preference Form and choose whether to allow certain cookies when you engaged our Services. You can also exercise control over browser-based cookies by adjusting the settings on your browser. In addition, third party tools enable you to search for and opt-out of some of these devices, such as the Ghostery browser plug-in available at https://www.ghostery.com/. We also list cookies and provide access to their privacy information and, if available, opt-out programs here. Further, you can learn more about your choices regarding certain kinds of online interest-based advertising here. We do not represent that these third party tools, programs or statements are complete or accurate.

Before you exercise your do not sell rights, we hope that you will consider a few more things:

First, remember that the data contained in these cookies does not typically identify you by name or other directly identifiable means.
Second, opting-out of sales of your PI in the digital advertising context (i.e, by means of cookies) will not stop you from getting ads, but these ads will not be tailored to your interests. This may not be what you want.
Third, if you opt-out, your experience on our Services and when you otherwise engage with us will be much less personalized.
Fourth, even after you opt-out, we will still continue to share data with our service providers who use the data on our behalf.

Return to Table of Contents

California Privacy Rights

We provide California Consumers the privacy rights described in this section. You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and related regulations. As permitted by the CCPA, any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”). We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. Some PI we maintain about Consumers is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI when a Consumer request that requires verification pursuant to the CCPA’s verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA we do not include that PI in response to those requests. If we cannot comply with a request, we will explain the reasons in our response. You are not required to create an account with us to make a Verifiable Consumer Request. We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, process, store, disclose and otherwise use and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest that you receive the most recent or a summary of your PI and give you the opportunity to elect whether you want the rest or not. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your Social Security number, driver’s license number or other government-issued id number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a CCPA request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

Your California Consumer privacy rights are as follows:

The Right to Know:
- Information Rights:
  You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:
  - The categories of PI we have collected about you.
  - The categories of sources from which we collected your PI.
  - The business or commercial purposes for our collecting or selling your PI.
  - The categories of third parties to whom we have shared your PI.
  - The specific pieces of PI we have collected about you.
  - A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.
  - A list of the categories of PI sold about you in the prior 12 months, or that no sale occurred. If we sold your PI, we will explain:
    - The categories of your PI we have sold.
    - The categories of third parties to which we sold PI, by categories of PI sold for each third party.
  To make a request, please email us at privacy@keranique.com, call us toll-free at 1-800-552-0281 or click here to access our online data request form. Please include “California Privacy Rights Request” in the email subject line and your name, street address, city, state, and ZIP code in the body of the email to assist with identification. For your specific pieces of information, as required by the CCPA, we will apply the heightened verification standards set forth in subsection (ii) below.
  
  Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.
- Obtaining Copies of PI:
  
  You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining. To make a request, please email us at privacy@keranique.com, call us toll-free at 1-800-552-0281 or click here to access our online data request form. Please include “California Privacy Rights Request” in the email subject line and your name, street address, city, state, and ZIP code in the body of the email to assist with identification. Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.
Do Not Sell:

The CCPA defines “sale” in an unusual way, and with no guidance yet from the State of California as to how broadly the term should be interpreted, a number of differing reasonable interpretations are possible.

Some may argue that when certain third parties place cookies on the consumer’s device when the consumer engages with our Services, the PI collected by such cookies constitutes a “sale” under the CCPA. We do not agree with this interpretation. However, pending a consensus as to what “sale” actually means under the CCPA, you can access our Data Preference Form and choose whether to allow certain cookies when you engaged our Services. You can also exercise control over browser-based cookies by adjusting the settings on your browser. In addition, third party tools enable you to search for and opt-out of some of these devices, such as the Ghostery browser plug-in available at https://www.ghostery.com/. We also list cookies and provide access to their privacy information and, if available, opt-out programs here. Further, you can learn more about your choices regarding certain kinds of online interest-based advertising here. We do not represent that these third party tools, programs or statements are complete or accurate.

Otherwise, if what you want is to instruct us not to share your PI (such as your name, e-mail address, postal address, etc.) with third parties for their direct marketing or other commercial purposes, click here to access the "Do not sell my info" form, and submit that form.

If you are 16 years of age or older, you have the right to direct us to not sell your PI. To exercise this right. please complete and file the webform available at https://keranique.com/do-not-sell/.

We do not knowingly sell the PI of Consumers we know are under 16 unless we receive an opt-in from the Consumer who is at least 13 but under 16, or from the parent or guardian of a Consumer younger than 13. Consumers who opt-in to PI sales may opt-out at any time. If you think we may have unknowingly collected PI for sale of yourself or of your child under the age of 13, or if you are at least 13 but under 16, exercising the opt-out will stop our selling of the PI.
Delete:

Except to the extent we have a basis for retention under CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, to complete transactions and service you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement. Note also that we are not required to delete your PI that we did not collect directly from you. To make a request, please email us at privacy@keranique.com, call us toll-free at 1-800-552-0281 or click here to access our online data deletion request form. Please include “California Privacy Rights Request” in the email subject line and your name, street address, city, state, and ZIP code in the body of the email to assist with identification.
Non-Discrimination and Financial Incentive Programs:

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights. However, we may charge a different price or rate, or offer a different level or quality of good or service, to the extent that doing so is reasonably related to the value of the applicable data. In addition, we may offer you financial incentives for the collection, sale and retention and use of your PI as permitted by the CCPA that can, without limitation, result in reasonably different prices, rates, or quality levels. The material aspects of any financial incentive will be explained and described in its program terms. Please note that participating in incentive programs is entirely optional, you will have to affirmatively opt-in to the program and you can opt-out of each program (i.e., terminate participation and forgo the ongoing incentives) prospectively by following the instructions in the applicable program description and terms. We may add or change incentive programs and/or their terms by posting notice on the program descriptions and terms linked to above so check them regularly.
Authorized Agents:

Your California Consumer privacy rights are described below. To make a request, please email us at privacy@keranique.com or call us toll-free at 1-800-552-0281. We will take appropriate steps to confirm the identity of a Consumer making a request for purposes of verifying the authenticity of the request. You may be required to provide certain PI to allow us to verify that you are the Consumer about whom the request is being made. If you request that we provide you with specific pieces of information about you, we will apply heightened verification standards. An authorized agent may submit a request on behalf of a Consumer if the Consumer has provided the authorized agent with power of attorney in accordance with California law; alternatively, the agent must (1) present verifiable written authorization from the Consumer that the agent has the Consumer’s permission to submit the request; and (2) independently verify the agent’s own identity with us.
Our and Other’s Rights:

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your CCPA rights. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.

Return to Table of Contents

Additional California Notices

In addition to CCPA rights, certain Californians are entitled to certain other notices, including:

Third Party Marketing and Your California Privacy Rights:

California's "Shine the Light" law permits California residents to request certain information regarding our disclosure of PI to third parties for their own direct marketing purposes.

Separate from your CCPA “Do Not Sell” rights you have the following additional rights regarding disclosure of your information to third parties for their own direct marketing purposes:

We provide California residents with the option to opt-in or opt-out to sharing of “personal information” as defined by California’s “Shine the Light” law with third parties, other than with our affiliates, for such third parties’ own direct marketing purposes. California residents may exercise that opt-out, and/or request information about our compliance with the Shine the Light law, and obtain a disclosure of third parties we have shared information with in accordance with the law for their direct marketing purposes absent your choice (i.e., Company Affiliates) and the categories of information shared, by contacting our privacy administrator at privacy@keranique.com or by sending a letter to us at:

Profectus Beauty, LLC
111 Town Square Place, Suite 1130
Jersey City, NJ 07310

Attention: Legal Counsel

Please include the statement “California Privacy Rights Request” in the body of your letter or in the subject line of the email and include your name, street address, city, state, and ZIP code in the email or letter to assist with identification. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through the provided e-mail address or mail address.

As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.
Online Privacy Practices:

For more information on our online practices and your California rights specific to our online services see our online Privacy Policy
Tracking and Targeting:

When you visit our online services, we and third parties may use tracking technologies to collect usage information based on your device for a variety of purposes, including serving you advertising, based on your having visited our services or your activities across time and third-party locations. Some browsers may enable you to turn on or off a so-called “Do Not Track” signal. Because there is no industry consensus on what these signals should mean and how they should operate, we do not look for or respond to “Do Not Track” signals. For more information on tracking and targeting and your choices regarding these practices, see our online Privacy Policy.
California Minors:

Although our online service(s) are intended for an audience over the age of majority, any California residents under the age of eighteen (18) who have registered to use our online services, and who posted content or information on the service, can request removal by contacting us here, detailing where the content or information is posted and attesting that you posted it. We will then make reasonably good faith efforts to remove the post from prospective public view or anonymize it, so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.
eCommerce:

In accordance with California Business and Professions Code § 17538 et al., our online return and refund policy is available here. The legal name under which we conduct business online is Profectus Beauty, LLC, and our business address is 111 Town Square Place, Suite 1130, Jersey City, NJ 07310. Within five (5) days of our receipt of your request, California residents may receive verification of this information by email by contacting us here.

Residents of California are also entitled to the following specific Consumer rights information: you may contact the Complaint Assistance Unit of the Division of Consumer Services of the Department of Consumer Affairs by mail at: 1625 North Market Blvd., Suite N 112, Sacramento, California, 95834, or by telephone at (916) 445-1254. Hearing-impaired users can reach the Complaint Assistance Unit at TDD (800) 326-2297 or TDD (916) 322-1700. Their website is located at: http://www.dca.ca.gov.

Return to Table of Contents

For more information on your California privacy rights contact us at 1-800-552-0281 or email us here. Or, write to us at:

Profectus Beauty, LLC
111 Town Square Place, Suite 1130
Jersey City, NJ 07310

Attention: Legal Counsel

Return to Table of Contents

Keranique California Privacy Notice