PRIVACY AND COOKIES POLICY

If you reside in United Arab Emirates or State of Qatar or Kingdom of Bahrain, or State of Kuwait or Sultanate of Oman, the controller of your personal data is Sephora Emirates LLC, a single owner limited liability company duly incorporated and existing under the federal laws of United Arab Emirates and the local laws of the Emirate of Dubai, having a Commercial Registration number 611595, and having its registered offices at Building 11, Dubai Design District, PO Box 116420, Dubai, United Arab Emirates.

We collect several types of personal data about you:

INFORMATION THAT YOU PROVIDE TO US DIRECTLY.

As a reminder, opening a Sephora account is reserved to persons 16 years of age and older.

We collect information that you provide to us directly when you use our Site and Services.

Data that is required to respond to your requests is identified by an asterisk or equivalent on the collection forms or specified as such verbally at the time of collection. If you do not fill in the mandatory fields or do not provide the information marked as mandatory, we will not be able to respond to your requests.

In our stores or during events that we organize (for example: make-up events, product launches or other activities), we may collect additional personal data under the conditions and for the purposes that are specifically notified to you on this occasion.

INFORMATION WE COLLECT AUTOMATICALLY

We automatically collect certain information about you when you access the Site and the content of our communications, when you use any of our Services, or when you conduct a business transaction with us.

INFORMATION WE COLLECT FROM OUR PARTNERS AND OTHER SOURCES

INFORMATION ABOUT THIRD PARTIES

In some cases, we may also collect information that you provide about other people. This is the case when you decide to buy and send products to someone.

We only use this information to respond to your requests and do not send marketing communications to your contacts unless they opt-in to receive communications from us.

We only collect personal data where we have a legal basis to do so.

You will find the purposes for which we process your personal data in connection with our Services and the reasons why we need to process it:

Moreover, according to the data already in our possession, some forms may be pre-filled. Thus, if you have an account on the Site and you wish to subscribe to the loyalty program, it will be enough for you to complete the missing data or to check certain information not coherent in your account to be able to validate your inscription with the loyalty program.

Where processing is based on our legitimate interests we will ensure that we take into account any potential impact that the use of your data may have on you. If we believe that your interests or fundamental rights and freedoms outweigh our legitimate interest, then we will not use your personal data on this basis and will seek your specific consent.

We do not use personal information for purposes incompatible with those for which it was originally collected, unless subsequently approved by you.

Generally speaking, your personal data is kept for a period that does not exceed the time required for the purposes for which it was collected.

In particular, when you create an online account, your personal data is kept as long as you use or order products or services offered by Sephora through your online account.

Your personal data and your Sephora account will be deleted if:
- You decide to delete your online account.

To do this, you must make a request to us by contacting us either:

• by email to: privacy@sephora.ae
• by phone 800 SEPHORA (800-737-4672) from UAE, 920011359 from Kuwait, 80063377 from Bahrain, 00800101239 from Qatar, +966 136637010 from Oman & International, every day from 10:00AM to 10:00PM.

- You no longer use your online account.

We consider that you are no longer using your online account if you meet the following two cumulative criteria:
1. You have not made any purchases on the Sephora Site for 5 consecutive years,
AND
2. You have stopped interacting with Sephora during this 5th year, in particular, you have not opened the emails that Sephora has sent you, you have not logged into your customer account on the Site.

In some cases, we may retain certain personal data about you for a longer period than that indicated above, including after your account has been closed, by legal obligation, or if there is a problem with the account, for example, a debit balance, or the presence of an unresolved claim or dispute. In this case, the data necessary to resolve the problem or dispute will be kept for as long as the dispute lasts, subject to the applicable rules on prescription.

Particular cases

We share data where necessary to operate the Site and provide you with the Services you have requested.

In the course of using the Services, some of your information is shared with our service providers and subcontractors who are involved in administering the Site and providing you with the associated Services to the extent necessary for their purposes.

For example, your payment data is transmitted to our payment service provider and to the banking institutions that hold your account in the context of carrying out transactions related to your purchases. Information is also transmitted to your bank for the purpose of securing payments made with a bank card on our Site (3DS).

To learn more about the use of your data by our payment service provider, we invite you to consult its privacy policy, which can be accessed by clicking here.

When you use Paypal as a payment method on the Site, your transaction data is processed by Paypal in accordance with its privacy policy, which can be accessed by clicking here.

Subject to your consent, certain data is shared with partners so that they can send you personalized offers.

Your contact information, your interests, your age or the socio-professional category to which you belong) are shared in accordance with your options with our business partners who are likely to send you information on their products and services. This information may consist in particular of offers concerning skin care or make-up samples, or other products marketed by our partners. For example, we may provide some of your information to cosmetic brands when you have expressed your desire to participate in a contest or a promotional operation around the launch of a new product. To learn more about how our partners process your data, please review their privacy policies.

Your data may be shared with our debt collection agencies, our advisors, or third parties authorized by law, to enable us to ensure the collection of our debts, the management of disputes, prevention of non-payment and litigation.

We may also share data about you with our external advisors in the event of litigation, with third parties, such as debt collection agencies, those responsible for collecting unpaid bills or in the context of the fight against Internet fraud, with third parties authorized by law or designated by Sephora for the sole purpose of verifying the identity of the purchaser, the validity of the order, the method of payment used and the intended delivery.

Data posted on The Beauty Board and product reviews you post are publicly available

The photographs and information you choose to post on The Beauty Board as well as product reviews are publicly available.

Data is also shared with social networks when you use their social buttons.

When you use the social buttons, your identifying information is automatically shared with those social networks. You also have the option of sharing certain information or content on our Site on social networks. This use is governed by the terms of use of the said social network that we invite you to consult directly on their site.

We may also share your data, in particular with LVMH, in the context of audits carried out to optimize our Services.

Data concerning you may also be shared in cases not described above with your consent or according to your instructions or when we are required to do so by law.

In the event that all or part of the activities of Sephora Emirates LLC are transferred, your personal data will be communicated to the acquirer in order to ensure the continuity of the Site, the Services and/or, unless you otherwise opt in, for commercial prospecting purposes.

Your personal data is protected by technical and organizational measures that comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection to ensure its security and confidentiality.

In particular, Sephora uses protection technologies such as encryption, authentication and fraud detection systems to protect your online account and your payment transactions.

Sephora ensures, under the terms of written commitments, that its service providers and subcontractors present guarantees and implement sufficient security measures to ensure the protection of personal data whose processing is entrusted to them in accordance with the requirements of the legislation on the protection of personal data.

We keep your personal data in the UAE. However, it is possible that the data we collect when you use our Site or Services may be transferred outside the UAE to countries whose applicable data protection laws differ from those of the UAE or of your country of residence.

This is particularly the case for data transferred to our service providers or subcontractors or Sephora affiliates or parent companies located outside the UAE. When the recipient is located in a country whose legislation has not been the subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection, we make sure that the transfer is framed by the standard contractual clauses of the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection which make it possible to guarantee a sufficient level of protection of the private life and the fundamental rights of the people, equivalent guarantees and/or if necessary adapted technical and organizational measures.

Upon request, we can provide you with a list of the countries where we process your data and a copy of the appropriate safeguards (see the Contact Us section).

WHAT ARE YOUR OPTIONS FOR PROMOTIONAL COMMUNICATIONS?

You have the option of joining our mailing lists and agreeing to receive personalized marketing and promotional information from us by email. You may opt-out of receiving promotional communications at any time as described below:

• If you have an account: Log in to your online account and change your settings by unchecking the corresponding box(es) in the "My Account Settings" section.
• In each of our communications (Newsletters, emails, SMS): click on the unsubscribe link in our emails or answer "STOP" to the SMS you receive.
• By contacting us: according to the methods described in the "Contact us" section.

Please be aware that even if you unsubscribe from promotional communications, we may continue to send you non-promotional mail, calls and/or emails regarding your account or pending transactions.

WHAT CAN YOU DO IF YOU DO NOT WANT TARGETED ADVERTISING?

We may use your personal data in combination with your browsing data through the use of cookies for targeted advertising purposes (for example, to display ads on third party sites that are tailored to your profile or that we believe may be of interest to you, or for bounce marketing when you receive an email containing a particular offer). This type of targeting is made possible by the use of technologies from our advertising partners that make it possible to link the same user's browsing data on these sites, social media platforms or third-party sites, regardless of the Terminal used.

• On social media platforms (e.g., Facebook, Instagram): you can object to this processing at any time by configuring the settings relating to advertising in your account.
• On third-party sites: you can refer to our section on Cookies to understand how to withdraw your consent.

You may opt-out of personalized advertising at any time from the link provided in our marketing communications.

Please note that opting out of targeted advertising only means that you will no longer receive advertisements for which you are specifically targeted. It will not affect or prevent the display or receipt of other, non-targeted advertising.

ACCESS AND COPYING

You have the right to access and disclose your personal data. Before responding to your request, we are required by law to verify your identity. We may ask you to provide additional information in order to respond to your request. We will endeavor to respond to your request as soon as possible.

If you have a Sephora account, you can directly access the data contained in your online account, the history of your transactions, as well as your choices regarding commercial prospecting.

This access also allows you to correct, modify or delete your identification and contact information. If you delete your data, however, you will no longer be able to benefit from the Services related to the online account or the loyalty program. You may, to the extent permitted by law, exercise your right to portability, which allows you to retrieve in an interoperable format the personal data you provided to us when creating and using your account and/or subscribing to our loyalty program.

If you are unable to access your account or to access other data, please contact us as described in the Contact Us section below.

If you are a member of the Loyalty Program, you can access and modify your information and change your opt-out options by clicking on the link in our email or SMS marketing communications.

OBTAIN CORRECTION OF INACCURATE PERSONAL DATA

You also have the right to request the correction of your personal data that are incorrect and the limitation of their processing for the time of their correction. You also have the right, depending on the nature of the processing, to request that the personal data in our possession be completed. In this case, we may ask you for proof.

If you are unable to access your account or if the data you wish to correct cannot be corrected through access to your account, please contact us as indicated in the contact us section below.

WITHDRAWING YOUR CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA

When the processing of your personal data is based on your consent (such as the registration to the newsletter, the sending of electronic commercial solicitations for services and products other than those you have already subscribed, the use of cookies and similar technologies on this Site), you have the right to withdraw your consent at any time.

This right can be exercised by modifying your options in terms of commercial prospecting and subscriptions to our newsletters, as well as by withdrawing your consent to the placement of cookies according to the methods mentioned in our section on Cookies.

OBTAIN THE DELETION OF YOUR PERSONAL DATA

You can also request the deletion of your personal data in the following cases:

• You consider that the processing of your data is no longer necessary with regard to the Services subscribed to or your use of the Site, or the achievement of the purposes referred to in this policy or that their retention is contrary to the law;
• You have withdrawn your consent to the processing of your data (see above);
• You object to the processing of your personal data for reasons related to your personal situation;
• You object to the use of your data for commercial prospecting purposes;
• Your data was collected online when you were a minor.

Alternatively, within the limits provided by law, you may request the limitation of the processing of your personal data.

Please note that notwithstanding the exercise of your right to erasure or restriction, we may retain certain personal data about you were required or permitted by law, where we have a legitimate reason to do so (for example, to enable us to demonstrate the performance of a contract), for the exercise or defense of legal claims or where the exercise of that right would infringe on your right to freedom of expression and information.

YOUR RIGHTS CONCERNING AUTOMATED DECISIONS BASED EXCLUSIVELY ON AUTOMATED PROCESSING

You have the right at any time to obtain human intervention, to make your observations and to contest the decision by contacting the Customer Service Department in the manner indicated in the Contact Us section below.

If you have any questions about this personal data and cookies policy or if you have any requests relating to your personal data, you can contact the Customer Service Department:

By email by writing to: privacy@sephora.ae

by phone 800 SEPHORA (800-737-4672) from UAE, 920011359 from Kuwait, 80063377 from Bahrain, 00800101239 from Qatar, +966 136637010 from Oman & International, every day from 10:00AM to 10:00PM.

you can also define directives relating to the fate of your personal data after your death by contacting us according to the methods described in the "Contact Us" section and mentioning "Post-Mortem Directives" in the subject line.

We may change this policy from time to time to reflect changes in our practices, to further clarify our practices, or to ensure compliance with regulations.

When we do, we will notify you by changing the date at the bottom of this policy and, in some cases, we will provide additional notice (for example, by posting a statement on our Site's home pages or sending you an e-mail). We encourage you to review the Privacy and Cookie Policy whenever you interact with us to stay informed about our privacy practices, and to learn about the methods you can use to control the use of your personal information and protect your privacy.

A "Cookie" is a generic term that designates a text file saved in a dedicated space on the hard disk of the Terminal (e.g. computer, tablet, smartphone, etc.) of a media user (internet, applications, etc.), when consulting content or online advertising. This Cookie file allows its issuer to identify the terminal in which it is saved and thus to follow the activity of the media user, and to remember information, such as the user's preferences or the information previously entered by the user in the forms present on the media, during the period of validity or saving of the Cookie. Some Cookies are essential to the use of the media, others allow to optimize and personalize the displayed contents, and others allow to display advertisements.

Cookies do not directly identify a user, but identify a browser or a terminal. Information about the content viewed on a medium is directly associated with an identifier contained in the cookie. When a user browses a media, this identifier is associated with the pages viewed, as well as more broadly with the path on the media and the interactions (number of clicks for example): it is thus possible to follow the browsing of a same user on the media.

The use of cookies makes it possible to associate browsing data with the user's profile, regardless of the terminal used, thanks to cookie exchange technologies implemented by the partners who publish these cookies, generally communication agencies or digital advertising service providers, so that a user's browsing path can be tracked regardless of the media or the terminal used.

When you visit our Site, we may install five types of cookies on your terminal:

When you visit our Site for the first time and Sephora plans to place Cookies other than "technical" Cookies, we inform you that we use Cookies by means of a Cookie Management Module including information and settings on the home page of the Site. By clicking "Accept All", you consent to our use of cookies as described in our cookie management module. That said, you can change your cookie settings at any time by clicking on the link to the cookie management module on our home page ("INCLUDE LINK").

Below you will find more information about cookies and how you can manage your cookie settings.

By using our site, you can consent to the use of the aforementioned Cookies. Your choices are kept for six (6) months. However, you can choose at any time to deactivate all or part of these Cookies.

You have different ways to manage your choices regarding cookies:

COOKIE MANAGEMENT TOOLS

SOME COOKIES ARE NOT MANAGED IN THE TOOL, THE WAYS TO DEACTIVATE THEM ARE PRESENTED BELOW:

THE CHOICES OFFERED TO YOU BY YOUR BROWSER SOFTWARE

Your browser can allow you to choose to deactivate all or part of the Cookies, either systematically or according to the issuer. You can also configure your browser software so that the acceptance or refusal of cookies is proposed to you (on a case-by-case basis or in full).

However, we remind you that deactivating all cookies will prevent you from using our Site under normal conditions, except for basic functions.

• If you are using the Explorer browser: click on the Tools button, then Internet Options. Under the general tab, Browsing History, click on Settings. Then click on View Files and select the Cookie(s) you wish to disable. Then close the window that contains this list of Cookies and double-click OK to return to the Internet.
• If you are using the Firefox browser: click on the Firefox Menu icon, then click on the Tools button, then Options; in the window that appears, choose Privacy and click on Remove Specific Cookies. Select the Cookies you wish to disable and delete them.
• If you are using the Safari browser: click the Settings button, then click Preferences. In the window that appears, choose Privacy/Security, and click Show Cookies. Select the Cookies you want to disable and click Clear or Clear All.
• If you're using the Chrome browser: click the Google Chrome menu icon, then click Settings. At the bottom of the page, click Show advanced settings. In the Privacy section, click Content Settings. To disable cookies: Select Prohibit all sites from storing data, click Cookies and site data, then hover over the site that created the Cookie, and click X in the right-hand corner, or click Delete all.

TRANSFERS OF PERSONAL DATA OUTSIDE THE UAE

Please note that some of our partners offering digital advertising services are located outside of the UAE, so data collected through cookies may be transferred to outside the UAE whose data protection laws differ from those applicable in the UAE. We strictly require our partners to use the information collected through cookies on our Site only to administer or provide the services requested and ask them to always act in accordance with applicable data protection laws and to pay particular attention to the confidentiality of the information transmitted.

“TECHNICAL" COOKIES

Technical cookies include those strictly necessary for browsing the Site (such as session identifiers), as well as functional cookies that allow you to access specific functions, in particular to recognize you, to indicate that you have visited a particular page and thus to improve your browsing comfort, in particular to

• memorize information relating to a form you have filled out on our Site (registration or access to your account) or to products, services or information you have chosen on our Site (subscribed service, contents of an order basket, etc.),
• allow you to access reserved and personal areas of our Site such as your account, thanks to identifiers or data that you may have previously entrusted to us
• implement security measures, for example when you are asked to log in again to a content or service after a certain period of time
• to adapt the presentation of the site to the display preferences of your terminal (language used, display resolution).