Last Updated: August 7, 2026

Tatcha Privacy Principles:

Tatcha takes your privacy seriously. The following principles guide our treatment of your Personal Information:

• We value the trust you place in Dermalogica when sharing your Personal Information with us.

• We strive to be transparent with you about what Personal Information we collect, what we do with it, and to whom we disclose it.

• We endeavor to work with you to address your concerns about how we use your Personal Information.

• We strive to take steps designed to secure your Personal Information and reduce the risk it will be misused.

Scope:

This Privacy Notice (“Notice”) describes how Tatcha LLC (“Tatcha,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes Personal Information in connection with our websites, mobile applications, and other online services which link to or display this Privacy Notice (collectively, the “Platform”); our in-person interactions with you (e.g., at an in-person event, etc.); and our other interactions with you (collectively, the “Services”). 

When we use the term “Personal Information” in this Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your household. It does not include aggregated or de-identified information that is not reasonably capable of being associated with or linked to you.

Contents:

• Notice at Collection
• Personal Information We Collect
• How We Disclose Personal Information
• Your Privacy Choices and Rights
• Artificial Intelligence and Machine Learning
• Information Security
• Cross-Border Transfer
• Minors’ Data
• External Links
• Changes To This Privacy Notice
• Contact Us

I. Notice at Collection

We collect the categories of Personal Information listed in the table below. We generally disclose each category of Personal Information we collect with our service providers that act on our behalf and help us provide the Services and Platform. As indicated in the chart, some of these categories we “sell” or “share,” including for “targeted advertising” (as such terms are defined in applicable U.S. law), to or with businesses and third parties, such as data analytics providers, advertising technology vendors, third party advertising networks, and social media platforms.

We do not knowingly sell or share Personal Information about persons under the age of 18. Please click the Do Not Sell or Share My Personal Information link in the footer of our Platform to opt out of the sale or sharing of your Personal Information, including for targeted advertising. You may also choose to enable online, where available, a universal tool that automatically communicates your opt-out preferences, such as the Global Privacy Control (“GPC”).  Where available, we will process the GPC signal as a request to opt out. 

a. Business and commercial purposes for which we collect and use your Personal Information 

We generally collect and use the above-listed categories of Personal Information to:

• Provide, manage, and improve the Platform and the Services, including through the use of artificial intelligence and machine learning technologies; 

• Process and fulfill your orders and returns; 

• Communicate with you, such as through bots, including to respond to your inquiries/requests and request feedback from you, and to send you important updates and messages about changes to our Services, this Notice, and/or other applicable terms and conditions;

• Review the usage and maintain the operation of our Services;

• Monitor, protect, and maintain the security and integrity of our Services and our business, such as protecting against and preventing fraud, unauthorized transactions, claims and other liabilities, and to protect our rights, privacy, safety, property or those of others;

• Provide you and others with customized content and experiences or targeted offers;

• Engage in targeted advertising;

• Train and improve our machine learning and artificial intelligence models; 

• Send you information, newsletters, and marketing/promotional material from us and, or on behalf of, our marketing partners and affiliates;

• Conduct research, perform analytics, and identify trends; 

• Comply with applicable laws and regulations and respond to lawful requests and communications from law enforcement and other government officials; 

• Carry out sales and business transactions, such as in connection with a merger, divestiture, restructuring, reorganization, dissolution, bankruptcy, or other sale or transfer of some or all of our assets; and

• At your direction or with your consent, or as otherwise described to you at the point of collection.

b. Retention

We will retain your Personal Information for as long as reasonably necessary to provide the Platform and our Services, for marketing purposes unless we receive an opt out as described in this Privacy Notice, or otherwise where permitted or required in accordance with applicable law. 

Additionally, we will retain and use your Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. What this means in practice will vary between different types of information, and when we consider our approach, we take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

II. Personal Information We Collect

There are several ways we may obtain Personal Information about you, including through (a) information you provide to us; (b) information we automatically collect; (c) information we receive from third parties; and (d) combining information from different sources. 

a. Information you provide 

When you visit and use the Platform or otherwise interact with our Services, we collect the Personal Information that you share with us. In particular, we collect Personal Information directly from you:   

• When you use or interact with our Services. We collect Personal Information from you when you register for an account or otherwise engage with us on the Platform or through our Services, sign up to receive marketing and promotional communications from us using any of the features available on the Platform, participate in quizzes or sweepstakes or surveys, use an analysis or assessment tool, provide us with feedback or make requests with our customer service team, or interact with us at an in-person event. 

• When you make a purchase. We collect your Personal Information when you purchase products or services through the Platform or in-person, or request a sample from us.

• When you provide information about a third party. If you send someone else a communication from our Services, such as sending a gift subscription, present, or promotion to a friend, the Personal Information you provide (e.g., name, contact information) may be used to facilitate communication with such person.

• When you interact with our social media pages. We collect certain types of Personal Information when you interact with our social media pages. 

b. Information we automatically collect 

We and our third-party partners and service providers may use a variety of technologies to automatically collect certain information when engaging with our Platform and Services.  We may collect your Personal Information using different data collection technologies, such as cookies, pixels, and tags, on our Platform or through our Services, and in email messages and in certain online advertisements.  For information on choices you may have with respect to these data collection technologies, see the “Your Privacy Choices and Rights” section below.

We use these data collection technologies to gather information for the purposes described in this policy, which may include distinguishing you from other consumers, making our Platform and Services more efficient and a better experience, including use and functionality, and helping to remember your preferences. They can also enable the delivery and measurement of relevant and personalized advertisements across the Internet.

These data collection technologies may also be placed on our Platform by third parties. The providers of these technologies may create one or more identifiers associated with you or your device(s) both on and off our Platform and Services, and combine this information with other sources and use the combined information for analytics and/or advertising purposes.

The specific types of information that we, our partners, and service providers may automatically collect when you visit and interact with us include:

• Device and browser information. This includes your device’s IP address and/or other unique identifiers, browser type, device type, internet service provider, and operating system.

• Location information. This includes your device’s approximate location (derived from your device’s IP address or other signals).

• Usage information. This includes the date and time of your visit, the pages you view immediately before and after you access our Platform, the areas or pages of our Platform that you visit, the amount of time you spend viewing or using our Platform, items placed or left in your online shopping cart with us, keystrokes, mouse movements, form field entries, recordings of chat sessions or your use of and inputs to other AI-supported tools, and other use and overall engagement with our Platform. 

• Marketing information. For example, if you receive an email from us, information may be collected about your interactions with the message (e.g., whether you opened, forwarded, or clicked through to our website) or, if you receive an ad served in connection with our Services, we may receive analytic data regarding your engagement with that ad.

• Third party analytics technology. This includes how our Platform and Services are used, and how to improve their effectiveness as well as the effectiveness of any related content.

c. Information we receive from third parties 

We may receive your Personal Information from other sources. Our third-party sources may include:

• Our business partners, including companies that co-sponsor our promotions.

• Our analytics and advertising partners, including online advertising networks and analytics providers.

• Social media platforms, including Facebook, X, YouTube, Pinterest, Snapchat, and Instagram. The information we receive from any social media platform is dependent upon its policies and your settings on that platform. 

• Third-party sites, including those that allow you to integrate your third-party account with your account with us.

• Other individuals (e.g., your family, friends, or other personal contacts) who provide your Personal Information to us because they think you may be interested in our Services or they want to share a product with you.

• Other companies that provide Personal Information to supplement what we already know about you, including data aggregators that assist us in building mailing lists. Certain third parties might link your name or email address to other information they have collected, such as your past online/offline purchases and your online usage information. 

d. Combining information

We may combine Personal Information that we receive from various sources. For example, we may combine Personal Information that we collect from you offline with Personal Information we collect from you through our Services. Similarly, we may combine Personal Information that we receive from third parties with Personal Information we already have about you. We use, disclose, and protect combined Personal Information as described in this Privacy Notice.

III. How We Disclose Personal Information

In connection with one or more of the purposes outlined above, we may disclose Personal Information from each of the categories of information described in the “Personal Information We Collect” section above to our partners and third parties. 

We disclose Personal Information for business purposes to the following categories of entities: 

• Our affiliates. We may disclose your Personal Information within the Unilever Group of companies and brands for purposes consistent with this Notice and other business and operational purposes.

• Our service providers. We disclose your Personal Information to service providers who perform services on our behalf. For example, this may include merchandise vendors and payment processors. It may also include companies that send emails on our behalf or help us operate the Platform or provide the Services. Our service providers are restricted in their use of Personal Information that we disclose to them. 

• Our business partners. We disclose your Personal Information to other companies with whom we partner to offer products and services and carry out other related activities. For example, we may disclose your Personal Information to a third party that co-sponsors a contest or promotion. We may also disclose your Personal Information to third parties whose products or services may be of interest to you. 

• Our research partners. We disclose your Personal Information to our research partners, including those that perform surveys or research projects in partnership with us or on our behalf. 

We may also disclose certain categories of Personal Information to the following third parties: 

• Our analytics partners. We disclose your Personal Information to our partners that assist us in performing analytics and help us measure the effectiveness of the Platform’s content and our online and offline marketing and advertising efforts. 

• Our advertising partners. We disclose your Personal Information to third parties for targeted advertising purposes, including social media platforms, third-party advertising networks, and other parties that assist us in serving and optimizing our advertisements. 

• Third-party data providers. We disclose your Personal Information to third-party data providers, including data aggregators, who collect Personal Information about consumers from various sources to create consumer databases that help companies and brands understand consumer behavior, grow their customer relationships, and meet their marketing and advertising objectives. 

• Relevant third parties in connection with business transactions or reorganizations. We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, financing, or sale of all or a portion of our company assets. If another entity acquires us or any of our assets, Personal Information that we have collected may be transferred to such entity and its advisors leading up to and/or following the transaction. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, Personal Information that we hold may be considered an asset of ours and may be sold or transferred to third parties.  

• Competent governmental and public authorities. We disclose your Personal Information as necessary pursuant to a court order or subpoena or to cooperate with a government agency or investigatory body request. 

• Other parties. We disclose your Personal Information to other parties at your direction or with your consent. If you are the winner of a sweepstakes or other contest, we may also disclose your Personal Information to anyone who requests a winner’s list. Finally, we disclose your Personal Information to other parties as we believe necessary or appropriate either to: (i) comply with applicable law; (ii) protect our operations and those of any of our affiliates; (iii) investigate and prevent against fraud; (iv) protect our rights, privacy, safety, or property and/or those of others; or (v) allow us to pursue available remedies or limit damages that we may sustain. 

If you have consented for us to call or text you, we do not sell or share your phone number or your consent to receive calls or texts with other parties to use for their own telemarketing purposes.  We may disclose your Personal Information for other reasons that we will describe at the time of information collection or prior to disclosing your information. 

We also may de-identify or aggregate Personal Information so that it will no longer be considered “Personal Information” for purposes of this Notice and applicable law, and disclose such information to other parties for purposes consistent with those described in this Notice. Where we de-identify information, we will never attempt to re-identify the information or re-link the information to an identified or identifiable individual, and require the third parties we share this de-identified information with to do the same. 

IV. Your Privacy Choices and Rights 

You have the ability to make certain choices about how your Personal Information is processed. 

a. State privacy rights and requests 

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas, Tennessee, Utah, Virginia, or any other state with an applicable privacy law have the following rights relating to the collection, use, disclosure, and other processing of their Personal Information (unless otherwise indicated). The exact scope of these rights may vary by state and are subject to certain limitations:  

• Right to know. You may have the right to know what Personal Information we have collected about you, including the categories of sources from which the Personal Information is collected, inferences derived from your Personal Information, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information disclosed to third parties, and the specific pieces of Personal Information we have collected about you. 

• Right to request categories of third parties. You may have the right to request a list of the categories of third parties with which we disclose your Personal Information. 

• Right to request specific list of third parties (CT, MN and OR residents only). You may have the right to request a list of the specific third parties with which we disclose your Personal Information. 

• Right to access a list of specific third parties (RI residents only). RI residents can access a list of all third parties with which we have sold or may sell Personal Information.  

• Right to data portability. You may have the right to access your Personal Information in a portable format. 

• Right to delete. You may have the right to request that we delete Personal Information that we have collected from or about you, subject to certain exceptions.

• Right to correct (not available for IA residents). You may have the right to correct inaccurate Personal Information that we may maintain about you, subject to appropriate verification.

• Right to opt out of certain Personal Information uses and disclosures. We use and disclose to third parties Personal Information for analytics and advertising purposes. Accordingly, you may have the right to opt out of the "sale" or "sharing" of your Personal Information, or the use and disclosure of your Personal Information for "targeted advertising" (as these terms are defined in applicable law).

To exercise any of the above listed privacy rights, please click here. You may also exercise these rights by calling us at 1-877-322-8633. 

To exercise your right to opt out of sale, sharing, and/or targeted advertising, please click here, or the “Do Not Sell or Share My Personal Information” link in the footer of our Platform. Alternatively, where available, you may choose to enable a tool that automatically communicates your opt-out preferences to all businesses that you interact with online. If you enable a browser-based opt-out preference signal, such as the Global Privacy Control (“GPC”), upon receipt or detection, and where technically feasible, we will treat the signal as a valid request to opt out of the sale, sharing, or targeted advertising of Personal Information linked to that browser and, where we can do so, consumer profiles that we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.  

Verification. Consistent with applicable law, please understand that in order to protect the confidentiality of yours and others' Personal Information, we will only complete your request when your identity has been verified (other than for requests to opt out). We will seek to match the information in your request to the Personal Information we maintain about you. As part of our verification process, we may ask you to: submit additional information, use identity verification services to assist, or, if you have set up an account through our Services, to sign into your account as part of our identity verification process. Please note that, where permitted under applicable law, we may decline a request (other than for opt outs) if we are unable to verify your identity (or an agent’s authority to make the request) and confirm the Personal Information we maintain relates to you. We will never ask you to verify your identity to facilitate a request to opt-out. 

Right to an authorized agent. In certain states, consumers may designate an authorized agent to exercise their privacy rights using the mechanisms described in this section. You may designate an authorized agent to submit requests on your behalf using the methods described in this section. However, we may require written proof of the agent's permission to do so and seek to verify your identity with you directly.

Right to non-discrimination. You have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise your rights. However, the exercising of the rights described below may result in a different price, rate, or quality/level of product or service where that difference is reasonably related to the impact the right has on our relationship with you or is otherwise permitted by law.

Right to appeal. Depending on your U.S. state residency, you may have the right to appeal a decision we have made in connection with your privacy rights request. To appeal a refusal to take action on your request, please see the instructions in our response to your request or submit your appeal in writing by contacting privacy@tatcha.com with the subject “Appeal of Consumer Privacy Rights Request.” If you are unsatisfied with the way that we have handled your appeal, you may have the right to complain to your state’s Attorney General.

You are not required to create an account to exercise your state privacy rights. 

Third-party opt outs. Self-regulatory industry organizations such as the Digital Advertising Alliance (DAA) offer browser-based opt-out tools for the companies that participate in them. Please visit the DAA’s AdChoices site for more information: https://youradchoices.com/control. 

You may need to opt out separately on all of your browsers and devices, as each opt-out may apply only to the specific browser or device from which you opt out. If you delete or reset your cookies or mobile identifiers, change browsers, or use a different device, any opt-out cookie or tool may no longer work and you will have to opt out again. Even if you choose to opt out of receiving interest-based advertising, you may still receive advertising, but the advertisements may be less relevant. 

Some of our partners may provide you with additional choices with respect to interest-based advertising. For example, certain social media platforms allow you to control your advertising preferences directly through their services. Please review the privacy notices of the third-party services you use for more information.

Google Analytics and Advertising. We use Google Analytics to better understand how users interact with the Platform. For information on Google Analytics’ information handling practices and how you can control the use of information sent to Google, please visit: www.google.com/policies/privacy/partners/. To disable Google Analytics, please download and install the Google Analytics Opt-out Browser Add-On, which is available here: https://tools.google.com/dlpage/gaoptout/.

We may also utilize certain forms of display advertising and other advanced features through Google Analytics, such as Remarketing with Google Analytics, Google Display Network Impression Reporting, the DoubleClick Campaign Manager Integration, and Google Analytics Demographics and Interest Reporting. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick or Google Dynamic Remarketing advertising cookie) together to inform, optimize, and display advertisements based on your past visits to the Platform. You may control your advertising preferences or opt out of certain Google advertising products by visiting the Google Ads Preferences Manager. 

Rakuten Advertising. We partner with Rakuten Advertising, who may collect Personal Information when you interact with the Platform. Rakuten Advertising’s collection, use, and disclosure of your Personal Information is subject to the Rakuten Advertising Privacy Policy located here: https://rakutenmarketing.com/legal-notices/services-privacy-policy/ 

To exercise your choices with respect to Rakuten Advertising’s use and disclosure of your Personal Information, you can submit a request here: https://rakutenmarketing.com/legal-notices/subject-requests/. 

b. Notice of financial incentive 

We may provide discounts or promotions when you agree to receive marketing and promotional communications from us or claim a specific offer when you interact with us and/or the Platform (each, an “Offer”). The terms of each Offer will be provided to you when it is made available. You may opt out of marketing and promotional communications from us at any time as described in our messages to you and as described above.

We collect and retain Personal Information to support and fulfill certain Offers, which may include information in the following categories:

• Identifiers

• Names, addresses, telephone numbers, and credit and debit card information 

• Commercial information

• Internet or other electronic network activity information

• Geolocation data 

• Inferences

Because we collect and retain Personal Information in connection with our administration of certain Offers, they may be considered “financial incentives,” “price or service differences,” or  “bona fide loyalty programs” under applicable law. The Personal Information we collect and retain in connection with the Offers may also be used to make your account, to supplement your account information (where applicable), and for targeted advertising. Additional details regarding our use of Personal Information can be found in the “Business and commercial purposes for which we collect and use your Personal Information” section above. We may sell or share your Personal Information with third parties as described in this Notice, including to analytics and advertising partners (including social media platforms). If you ask us to delete the Personal Information associated with the Offers, we will not be able to provide you with access to these Offers.

The value of the Personal Information we collect will vary based on the Offer and is calculated based on expenses related to offering the Offer, which may include the costs associated with providing discounts or promotions, IP or marketing-related costs, and other related expenses.

Participation in any financial incentive is optional. To enroll, please follow the instructions provided when the offer is made available. You have the right to opt out of any Offer at any time in accordance with the terms of the Offer or by contacting us at privacy@tatcha.com.

c. Unsubscribing from our marketing and promotional communications 

You can opt out of receiving marketing and promotional communications from us at any time. Note that even if you opt out of receiving marketing and promotional communications from us, you may still receive non-marketing or transactional messages from us, including messages about your account and responses to your inquiries. To opt out of receiving our marketing and promotional communications, you can:

• Send us an email at privacy@tatcha.com

• Call us at 1-877-322-8633 (Monday through Friday, 9:00 AM – 5:00 PM Pacific

• Write to us at:
  
  Tatcha, LLC
  Attention: Consumer Engagement Center/Privacy Notice
  201 Post St.
  2nd Floor
  San Francisco CA 94109

• Follow the instructions included in any promotional emails or text messages that you receive from us. 

V. Artificial Intelligence and Machine Learning 

We may use artificial intelligence (AI) and machine learning (ML) technologies to improve our Platform, Services, and customer support (including through chat bots), and to analyze consumer preferences with our products and services. The outputs of these technologies may be considered Personal Information. When you interact with us, we use the Personal Information you provide, including text prompts, uploaded documents, account profile indicators, and system metadata, to respond to your requests and to train our AI models. We may transmit this information to our vendors who are contractually required to maintain the security and confidentiality of this information, but we do not sell your Personal Information for these purposes. We do not use these technologies to make fully automated decisions that result in legal or material impacts on our users without human review. 

VI. Information Security 

We employ and maintain reasonable administrative, physical, and technical measures designed to safeguard and protect the Personal Information under our control from loss, misuse, unauthorized access, disclosure, alteration, and destruction. 

However, the Internet is not 100% secure. As a result, like all businesses, we cannot guarantee the security of the Personal Information you provide to us via the Platform. We encourage you to use caution when using the Internet. A username and a password are needed to access certain areas of the Platform. It is your responsibility to protect your username and password.

VII. Cross-Border Transfers 

The Platform is directed only to U.S. consumers, and not to consumers outside of the U.S.  We will transfer and/or store Personal Information under our control in the U.S. and/or other countries where we have facilities or in which we engage service providers. As a result, your Personal Information may be transferred to other countries or regions. 

If you live outside of the U.S., you understand and agree that we may transfer your Personal Information to the U.S. When we transfer your Personal Information outside of your country of residence, we do so in accordance with applicable law and take appropriate steps to ensure your information is protected. However, please note that while outside of the jurisdiction in which you reside, your Personal Information will be subject to applicable local laws (including those of the U.S.), which may not provide the same level of protections for Personal Information as those in your own country.

VIII. Minors’ Data 

We do not direct our Services to minors under 18, nor do we knowingly collect or sell Personal Information from minors under the age of 18 through the Platform or our Services. We encourage parents and legal guardians to monitor their minors’ internet usage and to instruct their minors never to provide Personal Information through the Platform or any other website without parental consent. If you believe a minor has provided Personal Information to us, please contact us and we will use reasonable efforts to locate and delete the information.

IX. External Links 

The Platform may contain links to third-party sites, plug-ins, applications, or other online services. If you click on a link to a third-party service, you will be taken to a service we do not control and that is not governed by this Notice. We are not responsible for third parties’ privacy practices. We suggest that you read the privacy notices of every service with which you interact carefully.

X. Changes to This Privacy Notice 

We reserve the right, in our sole discretion, to change, modify, add, remove, or otherwise revise portions of this Notice at any time. When we do, we will post the change(s) to our Services. Your continued use of our Services following the posting of changes to this Notice means you accept these changes. If we change the Notice in a material way, we will provide appropriate notice to you. Notice may be provided via a temporary banner on our Platform, an email sent to users for whom we have an email address, or by temporarily noting “UPDATED” next to the Privacy Policy link on the footer of our Site. Where required by applicable law, we will obtain your opt-in consent if we use Personal Information that we previously collected about you for a purpose that is materially different from the purposes we described in the version of our Notice applicable to you at the time we collected that Personal Information.

XI. Contact Us 

If you have any questions, comments, or concerns with respect to our information handling or privacy practices or this Notice, or wish to update your information, please feel free to contact us at by email at privacy@tatcha.com or by telephone at 1-877-322-8633 (Monday through Friday, 9:00 AM–5:00 PM Pacific).

You may also write to us at the following address:

Tatcha, LLC
Attention: Consumer Engagement Center/Privacy Notice
201 Post St.
2nd Floor
San Francisco CA 94108

CONSUMER HEALTH DATA PRIVACY POLICY

Last Updated: August 7, 2026

This policy governs the websites (each a “Site”), apps (each an “App”), offline locations or services (collectively, the “Services”) owned and operated by Tatcha LLC,(referred to herein as “Tatcha,” “we,” “us,” or “our” as applicable) that display, reference, or link to this Health Data Notice. This policy supplements the Tatcha Privacy Notice and applies to “consumer health data” under US state privacy laws, including Washington's My Heath My Data Act and Nevada's consumer health privacy law.

CONSUMER HEALTH DATA WE COLLECT

We collect the following categories of consumer health data, as defined by applicable law.

• Information about your health-related conditions, symptoms, status, diagnoses, testing, procedures, or treatments, including information related to your skincare routine.

• Information that could identify your attempt to seek health related services.

• Other information that may be used to infer or derive data related to the above or other health information.

SOURCES OF CONSUMER HEALTH DATA

As described further in the “Sources of Personal Information” section of the Privacy Notice we collect consumer health data directly from you, from your interactions with our Services, and from third parties.

WHY WE COLLECT AND USE CONSUMER HEALTH DATA

We may use the categories of consumer health data described above for the following purposes. Where required by applicable law, we will obtain your consent to process your consumer health data for certain of these purposes. 

• To Provide and Manage the Platform and the Services. We use your consumer health data to provide, administer, and manage the Platform (and its features) and as otherwise necessary to provide the Services and to operate our business.

• To Process and Fulfill Your Order(s). Where applicable, we use your consumer health data to process and fulfill your orders and requests for our products or services. We may also use your consumer health data to process your returns or inform you of any product recall.

• To Identify Usage Trends and Make Improvements. We use your consumer health data to understand how you use the Platform and identify usage trends. We also use your consumer health data to identify issues, test new features or changes in our features, and improve the Platform, the Services, and our products.

• To Understand Your Interests and Personalize Your Experience. We use your consumer health data to help us understand which parts of the Platform and/or which of our products are of interest to you. We also use your customer health data to customize or personalize your experience with us.

• To Communicate with You. We use your consumer health data to communicate with you about your account or our relationship; to respond to your submissions, requests, and inquiries; and to request information or feedback from you.

• To Determine Your Eligibility. We may use your consumer health data to verify your identity or determine your eligibility for some of our products, services, and promotions.

• To Send You Marketing and Promotional Communications. We use your personal information to send you communications (including via email, text message, and push notification) and other materials with information about new products and features and special offers. Details on how to exercise your choices with respect to marketing and promotional materials and communications from us can be found in the “Your Choices and Legal Rights” section below.

• To Conduct Research and Analytics. We use your consumer health data to help us conduct research and analytics and to otherwise measure the effectiveness of the Platform’s content and our online and offline marketing and advertising efforts.

• To Maintain Security and Prevent Fraud. We use your consumer health data to help monitor and maintain the security and integrity of the Platform as well as our systems and networks. Additionally, we use your consumer health data to detect; prevent; investigate; and protect you, our business, and others from fraud, unauthorized transactions, and other unlawful or unsafe activity.

• To Satisfy Our Legal Obligations. We use your consumer health data to comply with applicable law and respond to lawful requests and communications from law enforcement authorities and other government officials.

• To Carry Out Sales and Business Transactions. We may use your consumer health data in connection with the evaluation, negotiation, and/or completion of a business transaction (e.g., a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets), whether as a going concern or as part of any bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation, or completion of the transaction.

• As Otherwise Permitted, Necessary, or Appropriate. We use your consumer health data as otherwise described in this policy or as explained to you at the point of information collection. We will also use your consumer health data at your direction or with your consent. Finally, we will use your personal information as we believe necessary or appropriate to protect our rights, privacy, safety, property, and/or those of others.

WITH WHOM DO WE SHARE CONSUMER HEALTH DATA

We share consumer health data with the categories of third parties listed below. We will obtain your consent before sharing your consumer health data as required by applicable law.

• Our Affiliates. We may disclose your consumer health data within the Unilever Group of companies and brands for purposes consistent with this policy and other business and operational purposes.

• Our Business Partners. We disclose your consumer health data to other companies with whom we partner to offer products and services and carry out other related activities. For example, we may disclose your consumer health data to a third party that co-sponsors a contest or promotion.

• Our Research Partners. We disclose your consumer health data to our research partners, including those that perform surveys or research projects in partnership with us or on our behalf.

• Competent Governmental and Public Authorities. We disclose your consumer health data as necessary pursuant to a court order or subpoena or to cooperate with a government agency or investigatory body request.

• Other Parties. We disclose your consumer health data to other parties at your direction or with your consent. Finally, we disclose your consumer health data to other parties as we believe necessary or appropriate either to: (i) comply with applicable law; (ii) protect our operations and those of any of our affiliates; (iii) investigate and prevent against fraud; (iv) protect our rights, privacy, safety, or property and/or those of others; or (v) allow us to pursue available remedies or limit damages that we may sustain.

We may disclose your consumer health data for other reasons that we will describe at the time of collection or prior to disclosing your consumer health data.

HOW TO EXERCISE YOUR RIGHTS

Applicable law provides covered individuals with certain rights to access, delete, or withdraw consent relating to their consumer health data, subject to certain exceptions. 

If you would like to exercise the rights outlined above, please follow the prompts. If you send a request by email, please write “Washington Consumer Health Data Request” in the subject line and state which rights you seek to exercise in the body of your message. We may take steps to verify your identity before responding to your request by asking you a series of questions about your previous interactions with us.

REVISIONS TO THIS PRIVACY POLICY

We reserve the right, at our sole discretion, to change, modify, add, remove, or otherwise revise portions of this policy at any time. When we do, we will post the change(s) on our Services. Your continued use of our products and Services following the posting of changes to these terms means you accept these changes. If we change this policy in a material or substantive way, we will provide appropriate notice to you.

HOW TO CONTACT US

If you have any questions or concerns about this policy or the practices described herein, you may contact us at privacy@tatcha.com or by telephone at 1-877-322-8633 (Monday through Friday, 9:00 AM–5:00 PM Pacific).

You may also write to us at the following address:

Tatcha, LLC
Attention: Consumer Engagement Center/Privacy Notice
201 Post St.
2nd Floor
San Francisco CA 94108