Privacy Policy

Thank you for visiting a website or other online service (“Service”) that belongs to or is operated by eSalon.com LLC or one of its subsidiary or affiliated companies including eSalon.com Ltd UK ("eSalon", “Us”, “We”, “Our”). This Privacy Policy outlines Our practices with respect to Personal Information and how we collect, use, and transfer personal information about any user or visitor to our Service including when you create an account, are using any of our hair color and hair care products and services (collectively, "Products"), apply for a job, and any other personal information that we may process (collect, use, or store) about an individual (collectively "you or your"), and what rights you have regarding your personal information. When We refer to "Personal Data" or "Personal Information" in this and other Privacy Policies, which we use interchangeably, we mean information that identifies, or which could reasonably be used to identify, an individual.

Click here to view Our Terms of Use (“ToU”). For all residents outside of the United States, please see our section EU/UK Addendum. Your California-specific rights are explained in our California Privacy Notice. Residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia Residents, please see the respective sections below for information about your additional privacy rights.

Our Consumer Health Data Privacy Notice (the "Notice") supplements this policy and applies to Personal Information of residents of Washington and Nevada that is defined as "consumer health data" under applicable Washington and Nevada law.

For UK and EU customers, eSalon.com, LLC is the controller and eSalon.com, LTD UK is the processor. eSalon.com is a U.S. company and operates globally including through its affiliate in the United Kingdom. Some countries do not have the same level of protection as your country. We comply with legal requirements for cross-border data protection, for example, through the use of standard contractual clauses and in some cases, other transfer mechanisms as permitted by law.

This Privacy Policy complies with the Australian Privacy Act 1988 and the Australian Privacy Principles set out therein and equivalent state legislation in each relevant state.

This Privacy Policy complies with the New Zealand Privacy Act 1993 and the Principles set out therein.

Effective as of: December 3, 2025

1. Scope

This Privacy Policy applies to your use of any Service (e.g., website, mobile app, email, or internet-connected product) that posts a link to, or otherwise provides notice of the applicability of, this Privacy Policy, regardless of how you access or use it. This Privacy Policy also applies to Our collection, use, and disclosure of Personal Information about you through any other Services or means, including – for example – through sweepstakes and prize drawings we may offer. This Privacy Policy does not apply to third-party websites accessible via hyperlinks found on an eSalon Service.

For certain aspects of the Service, there may be additional notices about information practices and choices. Please read those additional privacy disclosures to understand how they apply to you.

Terms of Use can be found here. If you do not consent to Our practices as described in this Privacy Policy, you may not and should not use Our Service.

2. Revisions

eSalon may update its Privacy Policy from time to time to reflect changes to our information management practices. If we make material changes to this Policy, we will notify you here, by email, or by means of a notice on our homepage. In addition, please check the "Last Updated" date at the top of this Policy, which will indicate when the last changes have been made to this Policy.

We encourage you to periodically review this page for the latest information on our privacy practices.

3. What Personal Information Do We Process; for What Purpose; How Do We Share; and What is Our Legal Basis?

We collect Personal Information from you via our website through the use of cookies or tracking technologies, from you directly (e.g. when you contact us to ask a question, create an account, or make a purchase), or from third parties, including subsidiaries or other affiliated companies so that we can provide you with Our Service. Depending on the purpose for which the Personal Information is used, the legal basis for the processing of your data can be your consent, through a contract with you, or our legitimate interest.

If you choose to participate in activities made available by our Services such as website registrations, contests, sweepstakes, questionnaires, surveys, consumer service contacts, product purchases, mobile applications, social media platforms, or through Our online Careers portal or employment inquiries, eSalon will collect Personal Information that you provide.

We may collect Personal Information directly from you, such as when you make a purchase, or conduct another transaction, contact Us with a question or complaint, create an account on Our website, review Our products, respond to a survey, upload content to any of Our websites, provide your social media content, participate in a contest or other promotion, make an online appointment, sign-up to attend an event, apply for employment, sign-up to receive marketing communications, or use other services, features or resources We make available on Our Service.

We may enhance or merge the information that you provide to Us directly with information from other sources, including from Our business partners and service providers, such as demographic companies, analytics providers, advertising companies and networks, third-party retailers, and other third parties, for the purposes described below.

* Please note that all information listed in this table may be shared:

• To or between other eSalon-owned business entities or websites for the purposes of coordinating our global enterprise's provision and development of Products and services, and to coordinate recordkeeping and efficiency with respect to our employees and service providers.
• As required by applicable law or lawful requests by public authorities, including, without limitation, in response to any government or regulatory agency request, to cooperate with law enforcement requirements and/or investigations, to meet national security requirements or upon receipt of any court order.
• To a prospective or actual purchaser or seller with respect to eSalon's business in the context of a merger, acquisition or other reorganization or sale of eSalon's business or assets or a line of business. eSalon's would seek appropriate protection for information in these types of transactions. eSalon will attempt to notify you by email and/or a prominent notice on the Site of any change in ownership and the choices you may have regarding your Personal Information, once it is legally permissible to do so.
• To courts and public authorities to protect you, eSalon or third parties from harm, including fraud or instances where somebody's physical safety is at risk.

4. Data Privacy Notice for Job Applicants

This notice does not form part of any offer of employment, and we may amend it at any time to reflect any changes in the way in which we process your Personal Information. If you are in the application process when any changes are made to the way we process your Personal Information we will bring this to your attention. For more general updates, please visit this notice periodically. We may also notify you in other ways from time to time about the processing of your Personal Information.

The Kind of Application and Employment Information We Hold About You

"Personal Information" is any information about an individual from which they can be identified such as name, ID number, location data, any online identifier (such as IP address). It does not include data where any potential identifiers have been removed (anonymous data) or data held in an unstructured file.

There are "special categories" of more sensitive Personal Information which are more private in nature and therefore require a higher level of protection, such as, biometric data, race or ethnic origin, political opinions, trade union membership and health. For the purposes of this notice, Personal Information relating to criminal convictions will also fall within the description of 'special categories of Personal Information.

When we refer to "processing", this means anything from collecting, using, storing, transferring, disclosing, altering or destroying Personal Information.

Information that you provide when applying for a job or an internship via Our online Careers portal is used to provide you with information about employment opportunities, to administer the application process and consider you for employment. Where applicable, in conjunction with laws and regulations enforced by the Equal Employment Opportunity Commission (“EEOC”), the Office of Federal Contract Compliance Programs (“OFCCP”) and similar state and local regulatory agencies, we may ask you to provide Us with self-identifying information (such as veteran status, gender and ethnicity). Providing such self-identifying information is voluntary, but if you do provide Us with such information, we may submit that information, to the EEOC, the OFCCP and similar state and local regulatory agencies or otherwise use or disclose it as permitted or required by law, including, without limitation, responding to information requests, fulfilling regulatory reporting requirements and defending against employment related complaints.

How We Use Your Application and Employment Personal Information

We process your Personal Information for various reasons, relying on a variety of different bases for lawful processing under the Data Protection Laws as set out below.

To comply with our legal obligations or exercise legal rights conferred upon us. This may include:

• checks for eligibility to work in the US, UK, or EU as appropriate and as required by immigration laws, such as passport and visa documentation;
• formal identification documentation relating to you, such as a passport or driving licence, to verify your identity (including your date of birth);
• Disclosure and Barring Service (DBS) or Disclosure Scotland checks where we have a legal right or reason for doing so (for further information see below).

To pursue our (or a third party's) legitimate interests as a business. This may include:

• your contact details such as your name, address, telephone number and personal email address which will be used to communicate with you in relation to the recruitment process;
• your CV, any education history, employment records, professional qualifications and certifications in order for us to consider your suitability for the job you are applying for;
• details of the job role you are applying for any interview notes made by us during or following an interview with you, in order to assess your suitability for that role;
• pay and benefit discussions with you to help determine whether a job offer may be made to you;
• voicemails, emails, correspondence, and other communications created, stored or transmitted by you on or to our computer or communications equipment in order to progress the application through the recruitment process;
• CCTV footage of you onsite in our building reception area for security reasons, for the protection of our property and for health and safety reasons; and
• network and information security data in order for us to take steps to protect your information against loss, theft or unauthorised access.

We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.

We also collect, store and use your special category Personal Information for a range of reasons, relying on a variety of different bases for lawful processing under the Data Protection Laws, as set out below.

To enable us to perform our legal obligations in respect of employment, social security, social protection law, or needed in the public interest. This may include:

• health information to assess and/or to comply with our obligations under the Equality Act 2010 (for example a requirement to make reasonable adjustments to your working conditions).

For occupational health reasons or where we are assessing your working capability, subject to appropriate confidentiality safeguards. This may include:

• information about your physical or mental health, or disability status, to assess whether any reasonable adjustments are required for you during the recruitment process, and, where you are successful in your role application, carrying out any medical assessment required for your role, pension and any insurance benefits.

To establish, defend or exercise legal claims in an employment tribunal or any other court of law.

For statistical purposes in the public interest such as equal opportunities monitoring (for example the collection of information about race, ethnic origin, sex or religion).

Criminal Convictions Information

For certain roles, we have a legal right / reason to undertake Disclosure and Barring Service (DBS) checks or in Scotland, a Disclosure Scotland check. Where we do so, we only do so in accordance with the Data Protection Laws and the prevailing legislation in the area of criminal backgrounds checks as updated from time to time. For details on how long we retain criminal convictions information and how it is disposed of, please refer to retention below.

Automated Decision Making

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

Application and Employment Data Sharing

Your personal and special categories Personal Information may be accessed by the relevant individuals internally to facilitate the recruitment or onboarding process. This includes Recruitment and HR team involved in the recruitment or onboarding process, employee relations and/or administration of your employment; line managers; consultants; advisers for any accessibility requirements and/or other appropriate persons who may be involved in the recruitment or onboarding process for the job(s) you are applying for.

We may share your Personal Information and special category Personal Information with other entities within our Company. They may use your Personal Information as part of our usual reporting requirements, in the context of a business reorganisation or restructuring exercise, for systems support and hosting of data.

We may share your Personal Information and special category Personal Information with third parties, agents, subcontractors and other organisations (as listed below) where it is necessary to administer the working relationship with you or where we have a lawful basis for doing so:

Category of Personal Information	Recipient/Relationship to Us	Purpose of Disclosure
All personal information collected	IT service providers	To support, maintain and host our information systems, including the software and hardware infrastructure required for it to operate/be accessible online and to keep a backup of your personal information. We also use online IT service providers to provide contract execution services
All personal information collected	Recruitment agencies	To assist with recruitment into our organisation
All personal information collected	Employee benefits providers	For employee benefits to be provided
All personal information collected	Our legal and other professional advisers (including accounting and audit services)	To provide us with advice in relation to our business, including our legal, financial and other obligations and claims
Job role and health data	Occupational health providers	For working capacity of worker to be assessed
All personal information collected	Background / Credit check providers	To ensure the safety and security of the workforce

When we disclose your Personal Information to third parties, we only disclose to them any Personal Information that is necessary for them to provide their service. We have contracts in place with third parties in receipt of your Personal Information requiring them to keep your Personal Information secure and not to use it other than in accordance with our specific instructions.

We may also share your Personal Information and special category Personal Information with other third parties for other reasons. For example: in the context of the possible sale or restructuring of the business; to provide information to a regulator; or to otherwise comply with the law. To comply with our legal obligations we may share your data with the following:

• HMRC for tax purposes;
• FCA for regulatory purposes;
• SRA for regulatory purposes;
• Home Office for immigration purposes; and
• DVLA to validate driving licence information if you drive company vehicles or if you are required to drive as part of your role.

We may obtain Personal Information and/or special category Personal Information about you from third party sources, such as recruitment agencies, job boards, recruitment assessment centres, occupational health professionals and background check providers. Where we receive such information from these third parties, we will only use it in accordance with this notice.

In some cases, the third parties will be acting as a controller of your Personal Information and therefore we advise you to read their privacy notice and/or data protection policy.

Application and Employment Data Retention

We keep your Personal Information and special category Personal Information for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Information about how long we retain such Personal Information is set out in the table below:

Data Category	Retention Period	Reason	Disposal
Job applications and interview records of candidates	3 years - unless following an unsuccessful application you specifically consent to us holding it for longer for the purpose of contacting you in the event that any similar jobs / roles become available. from time to time.	To defend against potential legal claims.	Securely destroyed by a third party.
Criminal Records Information (such as DBS check results)	3 years	To comply with the DBS code of practice issued under section 122(2) of the Police Act 1997.	Securely destroyed by a third party.

5. Information You Disclose Publicly or to Others

The Service may permit you to post or submit user-generated content (UGC) including, without limitation, written content, user profiles, audio or visual recordings, computer graphics, pictures, data, or other content, including Personal Information. All UGC is subject to our Terms of Use. In addition to and without prejudice to the Terms of Use, if you choose to submit UGC to any public area of the Service, your UGC will be considered “public” and will be accessible by anyone, including eSalon. Notwithstanding anything to the contrary, Personal Information included in UGC is or may be used and shared by eSalon and third parties to the fullest extent not prohibited by applicable law. eSalon encourages you to exercise caution when making decisions about what you disclose in such public areas. For more information on how UGC is treated under the Service’s Terms of Use click here.

Additionally, the Service may offer you the option to send a communication to a friend or other contact. If so, you may only send communications to people that have given you permission to do so and who have consented to the disclosure of their Personal Information by you to Us. The recipient’s Personal Information you provide (e.g., name, e-mail address) will be used to facilitate the communication and may be used as permitted by this Privacy Policy and applicable law. Your full name, contact information, and message may be included in the communication.

For residents of Canada, you may only provide us with the contact information of friends or other personal contacts with whom you have had direct voluntary two-way communications, and with whom it is reasonable to conclude you have a personal relationship considering shared interests, experiences, opinions and other relevant factors. You may only provide email addresses of family members to whom you are related by marriage, a common-law partnership, or parent-child relationship, and with whom you have had direct voluntary two-way communications.

6. Targeted Advertising, Technology Logging, Cookies, and Related Techniques

When you interact with Our Service, your browser or device may communicate with the technology that We use as part of Our Service. This can result in the automated collection of data about your browser and/or mobile app and device. For example, as you use Our Service, your browser communicates with Our technology, which in turn keeps records of your interactivity and requests for services and content. The types of such Usage Information may include your Internet Protocol (IP) address, browser type, URL, requests made, pages visited, content or ads you see or click on during your visit and when and for how long you do so, items you download, the next website you visit when you leave the website, search terms you have entered on the website or a referral site, other activities conducted on the page, day and time of visit and related technical usage information. We use this information in accordance with this Privacy Policy.

Cookies and other tracking technologies now and hereafter developed (“Tracking Technologies”) may be used to collect information about interactions with the Service or e-mails, including information about your browsing and purchasing behavior, for the purposes outlined in this Privacy Policy. We use these technical means and so may Our Affiliates, business partners, and Service Providers.

A cookie is a small text file that is stored on a user’s device, which may be session ID cookies or tracking cookies. Session cookies make it easier for you to navigate the Service and expire when you close your browser. Tracking cookies remain longer and help in understanding how you use the Service and enhance your user experience. Cookies may remain on your hard drive for an extended period of time. The Service may associate some or all of these types of cookies with your devices. You can manage whether your browser permits certain cookies and other Tracking Technologies in your browser settings, or you can review the types of cookies that are used on a site by selecting the “cookies” link on the applicable site and deactivate the types of cookies you do not want active. Other types of Tracking Technologies may include web beacons, scripts, and in-app technologies like software development kits. See Section 12 regarding certain choices regarding these activities.

Like many companies, eSalon processes Personal Information collected through cookies and tracking technologies for purposes of targeted advertising. We or Our third-party advertising and personalization partners may collect and use information from Tracking Technologies to develop personalized content and advertising (including for companies not affiliated with Us) based on your visits over time on eSalon and non-eSalon websites, apps and other online services. You may see these advertisements on other websites, apps and online services. This information may also be used to evaluate Our and third-party online advertising campaigns or to tailor promotions and other marketing messages to you on Our Service and other websites apps and online services. These ads may be tailored to your interest based on your browsing of the Service and elsewhere on the internet, sometimes referred to as “targeted advertising,” “interest-based advertising” and “online behavioral advertising” (“Targeted Advertising”). For information on your ability to opt-out of Targeted Advertising see Section 12 below.

You can, at any time, change or withdraw your consent from Our cookies in Cookie Settings.

7. Data Sharing and Storage

Your Personal Information and special category Personal Information is mostly stored in an electronic format on our secure servers. On rare occasions where we hold any hard copy documents these will be stored in access-restricted, locked filing cabinets.

We take appropriate technical and security measures and have rules and procedures in place to guard against unauthorized access, improper use, alteration, disclosure and destruction and accidental loss of your Personal Information.

eSalon may share your Personal Information described in Section 3 of this Privacy Policy with third parties to the extent not inconsistent with this Privacy Policy or other written statements made by Us at the time of collection, and not prohibited by applicable law, including without limitation as follows:

• eSalon's agents, vendors, consultants, and other service providers (collectively “Service Providers”) may receive, or be given access to your information, including in connection with their work on eSalon’s behalf. For more information on choices you may have see Section 12.
• We may share your information with Our co-sponsor(s) if We obtain your information in connection with a contest, sweepstakes, offering, or other promotional activity that is jointly offered by Us and any third parties.
• We may release Personal Information if permitted or required to do so by our policies, law, search warrant, subpoena, court order or upon request of government authorities.
• We may provide Personal Information, and other information, to third parties in connection with the reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of Our business, assets, or stock, including any such activities associated with a bankruptcy or similar proceeding.
• eSalon may share Personal Information with its affiliated companies and subsidiaries (“Affiliates”), and other third parties, some of which may be located outside of the United States and Canada.

The Service is based in the U.S. If you are accessing the Service from outside of the U.S., please be aware that information collected through the Service may be transferred to, processed, stored, and used in the U.S. and in other locations other than your location of residence. Data protection laws in the U.S. and in other jurisdictions may be different from those of your country of residence and provide a lower level of protection, and information transferred to the U.S. or elsewhere may be accessed by U.S. or other governments and law enforcement in accordance with U.S. laws or the laws of the applicable jurisdiction.

Retention of Personal Information

eSalon provides procedures for you to keep your Personal Information accurate, complete, and up-to-date. We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Policy and as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. The photos or biometric information collected are retained for six months after which they are deleted.

To support delivery of our Services, eSalon may engage and use data processors (each, a "Processor") with access to certain Customer Data. Terms used below but not defined have the meaning set forth in the Terms of Use.

Infrastructure Processors

Entity Name	Purpose of Processing	Data Shared	Hosting Location	Links
Amazon Web Services, Inc.	Hosting & Infrastructure	Web browsing data, customer data, order data, support data	USA	AWS Service Terms
IBM Cloud Services	Hosting & Infrastructure	Web browsing data, customer data, order data, support data	USA	IBM Cloud Terms of Use
Google Cloud Platform	Hosting & Infrastructure	Web browsing data, customer data, order data, support data	USA	Google Cloud Privacy Notice
Cloudflare, Inc.	Hosting & Infrastructure	Web browsing data	Global	Cloudflare Privacy Policy
Digital Ocean	Hosting & Infrastructure	Web browsing data	USA	Privacy Policy
Adobe Typekit	Hosting & Infrastructure	Web browsing data	USA	Adobe Privacy Policy
Userway	Hosting & Infrastructure	Web browsing data	USA	Privacy Policy for UserWay Services
Unbounce Germany GmbH	Hosting & Infrastructure	Web browsing data	Global	Privacy Policy
Shopify	Hosting & Infrastructure; Payment Processing	Web browsing data, customer data, order data, payment data	Global	Terms of Service Shopify Consumer Privacy Policy
PayPal, Inc.	Payment Processing	Web browsing data, customer data, order data, payment data	USA	PayPal Privacy Center
Adyen N.V.	Payment Processing	Web browsing data, customer data, order data, payment data	Netherlands	Privacy Statement
Klarna AB	Payment Processing	Web browsing data, customer data, order data	Sweden	Klarna US Privacy Policy Klarna International Privacy Policy
Taxjar	Tax Processing	Order data	USA	TaxJar Privacy Policy
eSalon.com, Ltd	Customer Support, Order Fulfillment	Customer data, order data	USA	Privacy Policy
Zendesk, Inc.	Customer Support	Customer data, order data, online chat, phone support	USA	Privacy Notice
Maestroqa	Customer Support QA	Customer data, order data, online chat, phone support	USA	Privacy Policy
Surveymonkey	Customer Surveys	Customer data, survey responses	USA	Privacy Notice
Twilio, Inc.	Email/Phone Infrastructure	Customer data, order data, phone data	USA	Twilio Privacy Notice
Sprout Social	Social media management	Social media interactions	USA	Sprout Social, Inc. Privacy Policy Sprout Social, Inc. Data Processing Addendum
Monday.com	Social media management	Social media interactions	USA	Privacy Policy

Shipping Processors

Entity Name	Purpose of Processing	Data Shared	Hosting Location	Links
Melissa Data	Address Verification	Shipping address	USA	Privacy Policy
Endicia	Address Verification	Shipping address	USA	Privacy Policy
United States Postal Service	Order Delivery	Shipping address, phone number, order data	USA	Privacy Policy
United Parcel Service	Order Delivery	Shipping address, phone number, order data	USA	Privacy Notice
DHL	Order Delivery	Shipping address, phone number, order data	Global	Privacy Notice
ePost	Order Delivery	Shipping address, phone number, order data	USA
Landmark	Order Delivery	Shipping address, phone number, order data	USA
FedEx	Order Delivery	Shipping address, phone number, order data	USA
Asendia	Order Delivery	Shipping address, phone number, order data	USA
Royal Mail Group	Order Delivery	Shipping address, phone number, order data	United Kingdom
Landmark UK	Order Delivery	Shipping address, phone number, order data	United Kingdom
Asendia UK	Order Delivery	Shipping address, phone number, order data	United Kingdom
Asendia EU	Order Delivery	Shipping address, phone number, order data	Germany

Analytics Processors

Entity Name	Purpose of Processing	Data Shared	Hosting Location	Links
Google, LLC	Analytics & Data Hosting	Web browsing data, customer data, order data	USA	Google Privacy Policy
DataDog, Inc.	Hosting & Infrastructure	Web browsing data	USA	Privacy Policy
Northbeam	Analytics	Web browsing data, customer data, order data	USA	Privacy Notice

Marketing Processors

Entity Name	Purpose of Processing	Data Shared	Hosting Location	Links
Sailthru, Inc.	Email marketing	Web browsing data, customer data, order data	USA	Privacy Notices
Attentive	SMS marketing	Web browsing data, customer data, order data, phone number	USA	Privacy Policy
Google Ads	Online marketing	Web browsing data, order data	USA	Google Privacy & Terms Technologies
Meta Platforms	Online marketing	Web browsing data, order data	USA	Privacy Policy
Microsoft Corporation	Online marketing	Web browsing data, order data	USA	Microsoft Privacy Statement
Pinterest, Inc.	Online marketing	Web browsing data, order data	USA	Privacy Policy
AWIN AG	Online marketing	Web browsing data, order data	Germany	Privacy Policy
BrandBassador As	Online marketing	Web browsing data, order data	Norway	Brandbassador Privacy Policy
Tapjoy	Online marketing	Web browsing data, order data	USA	Privacy Policy
adMixt	Online marketing	Web browsing data, order data	USA	Privacy Policy
Criteo	Online marketing	Web browsing data, order data	Global	Privacy Policy
Nift	Online marketing	Web browsing data, order data	USA	Nift Networks Privacy Policy
PayPal (Store Cash)	Online marketing	Web browsing data, customer data, order data	USA	PayPal Privacy Statement
Agital	TikTok Shop marketing	TikTok Shop customer data, TikTok Shop order data	USA
Agoura	TikTok Shop marketing	TikTok Shop customer data, TikTok Shop order data	UK
Boost Engine	TikTok Shop marketing	TikTok Shop customer data, TikTok Shop order data	China

Job Application Processors

Entity Name	Purpose of Processing	Data Shared	Hosting Location	Links
Indeed	Recruiting	Job applications, interview records of candidates	USA
LinkedIn	Recruiting	Job applications, interview records of candidates	USA
Workable	Recruiting	Job applications, interview records of candidates	USA
Reed	Recruiting	Job applications, interview records of candidates	UK
CV Library	Recruiting	Job applications, interview records of candidates	UK
The HRDept	Recruiting	Job applications, interview records of candidates	UK

Due to the nature of our global business and our ongoing efforts to support our Customers, our business needs and services providers may change from time to time. Please check back frequently for updates.

8. Third-Party Content, Third-Party Services, Social Features

The Service may include hyperlinks to, or include on or in connection with, the Service (e.g., apps and plug-ins), websites, locations, platforms, applications or services operated by third parties (“Third-Party Service(s)”). These Third-Party Services may use their own cookies, web beacons, and other Tracking Technologies to independently collect information about you and may solicit Personal Information from you. eSalon is not responsible for the privacy practices or the content of the Third-Party Services. Please note that the privacy statements applicable to such Third-Party Services may differ significantly from the eSalon Privacy Policy, so We advise you to read them carefully before using those services. You agree that eSalon shall not be held liable for any actions by or content of such Third-Party Services.

Certain functionalities on the Service permit interactions that you initiate between the Service and certain Third-Party Services, such as third-party social networks (“Social Features”). Examples of Social Features include: enabling you to send content such as contacts and photos between the Service and a Third-Party Service; “liking” or “sharing” eSalon’s content; logging in to the Service using your Third-Party Service account (e.g., using Facebook Connect to sign-in to the Service); and to otherwise connect the Service to a Third-Party Service (e.g., to pull or push information to or from the Service). If you use Social Features, and potentially other Third-Party Services, information you post or provide access to may be publicly displayed on the Service (see Section 5) or by the Third-Party Service that you use. Similarly, if you post information on a third-party service that references the Service (e.g., by using a hashtag associated with eSalon or other eSalon Affiliates in a post or status update), you agree that your post may be used on or in connection with the Service or otherwise by eSalon or other eSalon Affiliates. Also, both eSalon and the third party may have access to certain information about you and your use of the Service and any Third-Party Service. This Policy applies to Our use of information you submit to Us via Social Features, but it does not apply to what those third-party platforms do with your information. Those platforms have their own privacy policies, and We encourage you to read them.

In some cases the Service may frame, mask or include components of third-party websites or content within our interface so that it may appear that you have not left the Service. An example would be our payment processor sites. eSalon reviews the privacy practices of all third parties including such websites, and only uses their services after determining that such third parties maintain a comparable commitment to privacy as eSalon.

9. How We Secure Your Personal Information

eSalon takes reasonable and appropriate precautions — including administrative, technical, and physical measures — to safeguard your Personal Information against loss, theft, and misuse, as well as against unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• Access Controls: Personal Information is accessible only by authorized personnel who require access in order to perform their job functions and are bound by confidentiality obligations and trained in privacy best practices.
• Encryption and Secure Transmission: Where applicable, we use encryption technologies and secure socket layer (SSL) protocols to help protect data during transmission. Sensitive data (such as payment information) is handled by vetted payment processors that meet applicable security standards.
• Data Storage and Retention: Personal Information is stored in secure facilities and systems. Data is retained only as long as necessary for the purposes described in this Privacy Policy or as required by law.
• System Monitoring: eSalon may log and monitor network traffic, user activity, and transactions within our Services to help detect unusual behavior, prevent fraud, and ensure compliance with our Terms of Use. This monitoring may include automated technologies and manual review.
• Threat Detection and Incident Response: We maintain procedures to promptly investigate potential security incidents and, where required by applicable law, will notify affected individuals and regulatory authorities.
• Third-Party Service Providers: Service providers acting on eSalon's behalf shall be obliged to adhere to confidentiality requirements no less protective than those set forth herein and will only receive access to your Personal Information as necessary to perform their functions.

We will not display your Personal Information on the Site unless you choose to display it. If you post any content on the Site (such as comments or other text, testimonials, photos or videos), you can associate any "display name" you choose with your content or activity, as long as it is available. We recommend that you choose a user name that protects your own privacy online.

Important Limitations:
While we take steps to protect your Personal Information, no system or transmission over the internet can be guaranteed to be 100% secure. Please exercise caution when sending information electronically, and recognize that email, chat, or other online communications may be susceptible to unauthorized interception. You are responsible for maintaining the confidentiality of your account credentials and for all activity occurring under your account.

10. Notice of Analytics

eSalon, Our brands, and Our Service Providers and third party partners may use analytics of activity on our Service for our business purposes. This may include logging of actions you take while using our websites, apps, or other Services, logging of parts or all of your sessions with our Services, information you submit on our Services, or communications or information sent through or using our Services. Tracking Technologies used on Our Service (including cookies, pixels, and web beacons) may also collect information reflecting your use of and activity on Our Service. This information may be collected, retained, and/or monitored by Us or by Our Service Providers and third-party partners. For more information please see our Cookie Policy section.

Additionally, if you engage with chat functionalities on our Services, your conversations via our chat functionalities may be retained by Us and Our Service Providers for our business purposes. This can include any interaction between you and Our chat technologies, information you input into chats, and the conversations you have through Our chat functionalities.

If you do not consent to the monitoring described here, you should not use Our Service.

11. Service Not Directed to Minors

The Service is intended for a general audience and not directed to children less than 18 years of age. If you are not 18 or older, you are not permitted to use our Services. We do not knowingly collect Personal Information from minors under the age of 18. If we learn that we have collected the Personal Information of a minor under 18 years old, we will take steps to delete the information as soon as possible.

12. Choices Regarding Personal Information

A. Tracking Technologies Generally

Cookies may generally be disabled or removed by tools available as part of most commercial browsers, and in some instances blocked by selecting certain settings. Browsers offer different functionalities and options so you may need to set them separately. Please be aware that if you disable or remove these technologies, some parts of the Service may not work and that when you revisit the Service your ability to limit browser-based Tracking Technologies is subject to your browser settings and limitations.

B. Analytics and Advertising Tracking Technologies

Like many companies, eSalon processes information we collect about you for Targeted Advertising. You may choose whether to receive some Targeted Advertising by:

1. Submitting opt-outs to industry programs. Service Providers that perform advertising-related services for Us and third parties may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can opt-out from Targeted Advertising, visit https://www.aboutads.info/choices or Digital Advertising Alliance of Canada at https:/youradchoices.ca/en/tools. These companies may also be members of the Network Advertising Initiative (“NAI”). To learn more about the NAI and your opt-out options for their members, see https://www.networkadvertising.org/choices/.

2. You can also opt out of Targeted Advertising by clicking on “Cookie Settings” on the relevant website and deactivate cookies. Additionally, you can click on Do Not Sell or Share My Personal Information and submit a request to opt-out to us – see Section 13 below for more information.

C. Mobile Apps

With respect to eSalon’s mobile apps (“apps”), you can stop all collection of data generated by use of the app by uninstalling the app. Also, you may be able to exercise specific privacy choices, such as enabling or disabling certain features (e.g., location-based services, push notifications, accessing calendar/contacts/photos, etc.), by adjusting the permissions in your mobile device and/or the app’s settings. For information about opting out of Targeted Advertising relating to mobile apps, visit the DAA’s opt-out program for mobile apps at https://www.aboutads.info/appchoices.

D. Communications

You can opt out of receiving certain promotional communications (emails or text messaging) from eSalon at any time by (i) for promotional e-mails, following the instructions provided in emails to click on the unsubscribe link, or if available by changing your communication preferences by logging onto your account; and (ii) for text messages, following the instructions provided in text messages from eSalon to text the word, “STOP”; and (iii) for app push notifications turn off push notifications on the settings of your device and/or the app, as applicable. Please note that your opt-out is limited to the e-mail address or phone number used and will not affect subsequent subscriptions. If you opt-out of only certain communications, other subscription communications may continue. Even if you opt-out of receiving promotional communications, eSalon may, subject to applicable law, continue to send you non-promotional communications, such as those about your account, transactions, servicing, or Our ongoing business relations.

E. Careers Center

If you have created a resume using Our online Careers portal you may access, review, correct, update, change or delete your account profile information or resume at any time. Simply log into your account, go to your profile or resume, and make the necessary changes. You may delete your resume from Our online database at any time by accessing your account; provided, however, that We reserve the right to maintain a copy for as long as is required or permitted by applicable law.

13. Your Data Protection Rights

eSalon recognizes your data protection rights, regardless of your physical location.

You have a right to request from eSalon access to and rectification or erasure/deletion of your Personal Information.

You also have the right to request that processing concerning you be restricted, in which case such Personal Information would be marked and processed by us only for certain purposes. We will not charge a fee for this, provided the request is not excessive or unreasonable.

In addition, you have the right to data portability, which allows you to receive from us Personal Information about you which you have provided to us; we will provide your data in a structured, commonly used and machine-readable format, such as a JSON file, and the right to transmit such Personal Information to another entity without hindrance from us if it is technically feasible. We will respond to the request within 30 days, unless the request is complex or you send us multiple requests, in which case we can extend our response by another two (2) months upon notice to you.

You also have the right to object to various data processing activities, including processing activities that are based exclusively on your consent or processing for the purposes of direct marketing.

If you have provided consent for data processing or cookies that are not strictly necessary or that are primarily for promotional purposes, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You have the right to lodge a complaint with a supervisory authority.

We may choose not to fulfill any request that we determine is illegal or incorrect, where we need to maintain the Personal Information because of our contractual or legal obligations (e.g., Personal Information in case files), where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy, or where the rights of persons other than the individual would be violated, but our intention is to comply with opt-out requests, and other requests that seek to correct, update or delete your Personal Information, as fully as possible in accordance with applicable law.

You will also be given notice should we use your Personal Information for a purpose other than that for which it was originally collected or processed.

You can exercise such rights by accessing the information in your account, emailing us at [email protected], following the instructions at our Consumer Rights Request page here, and/or calling us at (866) 644-3315.

Complaints and Dispute Resolution

If you are an EU resident and have any complaint or concern regarding your personal data under this Privacy Policy, or arising under the Privacy Policy, please contact us at [email protected]. We suggest that you put in the subject line of any email or communication "Privacy Policy" or "Privacy Complaint." We will respond within 30 days. If this does not resolve your concern, you have several escalating options.

1. If you have an unresolved privacy or data use dispute or concern that we have not addressed satisfactorily, you can raise the issue with the local Data Protection Authority in the UK (Information Commissioner’s Office) or EU as applicable regarding customer data, and you must choose this route concerning your Human Resources personal data that is the subject of your complaint (that is, personal data transferred from the UK/EU to the United States relating to your employment status), which will then be taken up by the UK Information Commissioner’s Office or relevant EU Data Protection Authority with the US Department of Commerce to resolve the issue. The Information Commissioner's Office in the United Kingdom, which is the local Data Protection Authority, at https://ico.org.uk/concerns or call its helpline in the UK at 0303 123 1113.
2. If you still believe that your complaint or dispute has not been resolved, you can invoke binding arbitration as a last resort (if permitted with respect to your complaint), by providing notice to us in the manner indicated in Annex I to the EU – U.S. Privacy Shield Principles, available online if it or a successor framework is applicable either regarding transfers from the UK or from the European Union, and following the procedures set forth in such Annex. The location of the arbitration will be in the United States. You may choose video or telephone participation, which will be provided at no cost to you. In-person participation will not be required. eSalon commits to follow up in its verification that the attestations and assertions made in this Privacy Policy are true, and to remedy any problems that may arise if we fail to comply with the Privacy Shield Principles.

Independent Recourse Mechanism.

As a US-based company that self-certifies compliance under the EU-U.S. Privacy Shield Framework, eSalon is required to name an independent recourse mechanism available to investigate unresolved complaints, including a system of alternative dispute resolution (ADR) by such mechanism, which is available at no cost to you. We have designated JAMS as our ADR provider to assist in resolving disputes under the Privacy Shield Framework up to the point of any final arbitration. If you are a consumer based in the European Union and wish to open a case, you can do so at https://www.jamsadr.com/. However, if the claim relates to human resources data transferred from the EU or UK, we will cooperate and comply with the EU data protection authorities (DPAs) in connection therewith.

Mediation.

You also agree that, in the event any dispute or claim arising out of or relating to your use of the Site or eSalon Products/services or this Privacy Policy that does not relate to your personal data (personal data), or that is not covered by the previous paragraph, you and eSalon will attempt in good faith to negotiate a written resolution of the matter directly between the parties. You agree that if the matter remains unresolved for forty-five (45) days after notification (via certified mail or personal delivery) that a dispute exists, all parties shall join in mediation services in Los Angeles, California with a mutually agreed mediator in an attempt to resolve the dispute. Should you file any arbitration claims, or any administrative or legal actions without first having attempted to resolve the matter by mediation, then you agree that to the maximum extent permitted by applicable law, you will not be entitled to recover attorneys' fees, even if you would otherwise be entitled to them.

Additional Notices and Rights for Residents of Certain Regions

A. California Rights:

CALIFORNIA SHINE THE LIGHT:
California Shine the Light under California Civil Code §1798.83. California law permits customers in California to request certain details about how their personal information is shared with third parties, and in some cases affiliates, if personal information is shared for those third parties’ or affiliates’ own direct marketing purposes. We do not share personal information with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes.

Additional notice about our privacy practices and your California-specific rights are explained here:

B. Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia Residents:

This section applies to the "Applicable Privacy Laws" of Consumers in the above states as defined by the Connecticut Data Privacy Act (“CTDPA”), Colorado Privacy Act (“CPA”), Delaware Personal Data Privacy Act ("DPDPA"), Iowa Consumer Data Protection Act ("ICDPA"), Minnesota Consumer Data Privacy Act ("MCDPA"), Montana Consumer Data Privacy Act (“MTCDPA”), Nebraska Data Privacy Act ("NDPA"), New Hampshire Privacy Act ("NHPA"), New Jersey Data Privacy Act ("NJDPA"), Oregon Consumer Data Privacy Act (“OCPA”), Tennessee Information Protection Act ("TIPA"), Texas Data Privacy and Security Act (“TDPSA”), Utah Consumer Privacy Act (“UCPA") and Virginia Consumer Data Protection Act (“VCDPA”) that use our Services. Capitalized terms defined in the Applicable Privacy Laws that are used in this section shall have the same meaning as in the Applicable Privacy Laws.

Under applicable law, you may have the rights (in each case under the conditions and to the extent set out in applicable law):

• Right of Access: A right to confirm whether we are processing Personal Information about you, and to request access to such Personal Information (including, if applicable, in a portable and readily usable format).
• Right of Correction: A right to correct inaccuracies in certain Personal Information we may hold about you; and
• Right of Deletion: A right to request that we delete Personal Information concerning you. Please note that if you have requested a service that requires the use of your Personal Information, we may not be able to provide that service if you choose to delete your Personal Information.
• Right to Opt Out of Targeted Advertising (Opt Out of Sharing under certain Applicable Laws): eSalon does not sell Personal Information for monetary consideration, but like many companies, eSalon uses and discloses certain Personal Information for Targeted Advertising. You have the right to request to opt-out of eSalon’s use of Personal Information for Targeted Advertising.
• Right to Opt-Out of Targeted Advertising: You have the right to opt-out of Targeted Advertising. You can opt-out of Targeted Advertising by submitting a request to us as set forth below.
• Right to Opt-Out of Profiling: You have the right to opt-out of our processing of Personal Information for the purposes of profiling. Our profiling does not result in decisions that produce legal or similarly significant effects and therefore, we do not offer a way for you to submit such a request.
• Right to Appeal: If you are unsatisfied with our actions related to the exercise of one of your privacy rights above, you may appeal our decision.

You can submit a request to exercise the above rights by visiting our Consumer Rights Request page here. You may also submit a request by emailing us at [email protected].

To opt-out of Tracking Technologies that may facilitate Targeted Advertising, click “Cookie Settings” in the website footer and deactivate cookies. We will also process such opt-out requests that are submitted by a consumer’s opt-out preference signal, as required by applicable law. The technical specifications of a consumer’s opt-out preference signal determine how we process such signals. For example, if a consumer installs opt-out preference technology on a browser, and the opt-out preference signal it sends is associated solely with a user’s browser, the opt-out will be applied to the browser.

GLOBAL PRIVACY CONTROL
You may opt out of the sharing of your Personal Information through an opt-out preference signal setting in your browser. In order to process your request through an opt-out preference signal, you must use a browser supporting the preference signal. Please note that the GPC signal will only apply to the device and browser you are currently using, and any other devices or browsers where you have logged in. If you choose to use an opt-out preference signal, you will need to turn it on for each browser and each device you use.

Additionally, if you clear cookies from your browser after submitting an opt-out request, you will clear the cookie we used to honor your request. For this reason, you will have to submit a new opt-out request.

Residents of certain states may also exercise the above rights via an authorized agent who meets the agency requirements under the applicable law. Authorized agents should use the channels identified above to submit requests to eSalon.

Consistent with applicable law, any request you or any authorized agent submits to us may be subject to a verification process. To verify your request, you or your agent must provide your name, email, and state of residence, along with any other information we may require to verify your identity or your request. If your rights request is denied, applicable law may give you a right to lodge an appeal with use. The response to your rights request will inform you of any appeal rights you may have and tell you how you can exercise them.

Colorado residents, We do not process Personal Information for profiling in furtherance of “decisions that produce legal or similarly significant effects” concerning consumers, as such term is defined under applicable law.

C. Nevada Rights:

Nevada “consumers” have the right to instruct us not to “sell” “covered information” as those terms are defined by Chapter 603A of the Nevada Revised Statutes. Although we do not currently “sell” “covered information” of Nevada “consumers” as those terms are defined under that law, you may contact us at [email protected] and provide your name, Nevada resident address, and email address to be verified and exercise your opt-out rights in the event we do sell covered information under that law in the future. If you change your email address or other contact information, contact us in the same manner to update your contact information to help facilitate your opt-out. Changing your contact information elsewhere (e.g., informational requests, account information, etc.) will not update your Nevada opt-out information and we will only use the information provided to our opt-out program for managing opt-outs. It is your responsibility to keep your opt-out information current.

D. Canadian Rights:

If you are a resident of Canada, under applicable law, you may have certain rights regarding Personal Information we may hold about you. For instance, you have a right to request access to your Personal Information that we hold and to request a correction to it if you believe it is inaccurate. If you successfully demonstrate that your Personal Information in Our records is inaccurate or incomplete, we will amend the Personal Information as required. We may require you to verify your identity before We allow you to access your Personal Information. Also, you may withdraw your consent to our collection, use or disclosure of your Personal Information. In some cases, withdrawal of your consent may mean that we will no longer be able to provide certain Services or other products or services. You can submit a request to exercise your rights by visiting our Consumer Rights Request page here or by contacting Us using the contact information provided below. You can also contact Us using the contact information provided below if you have questions about this Privacy Policy, how We process Personal Information, or if you would like to submit a complaint.

14. Contacting Us

Please send Us your questions or comments regarding Our privacy practices by emailing Us at [email protected], or sending Us a letter addressed to:

eSalon.com, LLC
Attention: Privacy c/o Legal Dept.
1910 E. Maple Ave
El Segundo, CA 90245
USA
Or via e-mail at [email protected]

You can contact our Data Protection Officer (DPO) at [email protected]. Our registered office address is: 46-48 Long St. Middleton, United Kingdom, M24 6UQ.

eSalon has appointed DataRep as its Data Protection representative for the purposes of GDPR in the EU/EEA and The Data Protection Act 2018/UK GDPR (as amended) in the UK and FADP in Switzerland. Contact information for our representatives is listed below. When contacting, please post your requests addressed to "DataRep" as communication addressed to eSalon will likely not be received.

Country	Address
Austria	DataRep City Tower Brückenkopfgasse 1/6. Stock 8020 Graz Austria
Belgium	DataRep Rue des Colonies 11 1000 Brussels Belgium
Bulgaria	DataRep 132 Mimi Balkanska Str. 1540 Sofia Bulgaria
Croatia	DataRep Ground & 9th Floor, Hoto Tower Savska cesta 32 10000 Zagreb Croatia
Cyprus	DataRep Victory House 205 Archbishop Makarios Avenue 3030 Limassol Cyprus
Czech Republic	DataRep Platan Office 28. Října 205/45, Floor 3&4 70200 Ostrava Czech Republic
Denmark	DataRep Lautruphøj 1-3 2750 Ballerup Denmark
Estonia	DataRep 2nd Floor Tornimäe 5 10145 Tallinn Estonia
Finland	DataRep Luna House, 5.krs Mannerheimintie 12 B 00100 Helsinki Finland
France	DataRep 72 rue de Lessard 76100 Rouen France
Germany	DataRep 3rd and 4th Floor Altmarkt 10 B/D 01067 Dresden Germany
Greece	DataRep Ippodamias Sq. 8, 4th Floor 18531 Piraeus Greece
Hungary	DataRep President Centre Kálmán Imre utca 1 1054 Budapest Hungary
Iceland	DataRep Kalkofnsvegur 2, 3rd Floor 101 Reykjavík Iceland
Ireland	DataRep The Cube Monahan Road T12 H1XY Cork Ireland
Italy	DataRep Viale Giorgio Ribotta 11, Piano 1 00144 Rome RM Italy
Latvia	DataRep 4th & 5th Floors 14 Terbatas Street LV-1011 Riga Latvia
Liechtenstein	DataRep City Tower Brückenkopfgasse 1/6. Stock 8020 Graz Austria
Lithuania	DataRep 44A Gedimino Avenue 01110 Vilnius Lithuania
Luxembourg	DataRep BPM 335368 Banzelt 4 A L-6921 Roodt-sur-Syre Luxembourg
Malta	DataRep Tower Business Centre, 2nd Floor Tower Street BKR4013 Swatar Malta
Netherlands	DataRep Cuserstraat 93, Floor 2 and 3 1081 CN Amsterdam Netherlands
Norway	DataRep C.J. Hambros Plass 2C 0164 Oslo Norway
Poland	DataRep Budynek Fronton ul. Kamienna 21 31-403 Krakow Poland
Portugal	DataRep Torre de Monsanto, 7th Floor Rua Afonso Praça 30 1495-061 Algés Portugal
Romania	DataRep 15 Piaţa Charles de Gaulle, nr. 1-T Sector 1 011857 Bucureşti Romania
Slovakia	DataRep Apollo Business Centre II, Block E / 9th Floor Prievozská 4D 821 09 Bratislava Slovakia
Slovenia	DataRep Trg Republike 3, Floor 3 1000 Ljubljana Slovenia
Spain	DataRep Calle de Manzanares 4 28005 Madrid Spain
Sweden	DataRep S:t Johannesgatan 2, 4th Floor SE-211 46 Malmö Sweden
Switzerland	DataRep Leutschenbachstrasse 95 8050 Zürich Switzerland
United Kingdom	DataRep 107–111 Fleet Street London EC4A 2AB United Kingdom