Privacy Policy

Welcome to our website www.ninaricci.com (hereinafter, the “Website”). This Privacy Policy governs access to and use of this Website and our other digital services in which this Privacy Policy is posted or linked (“Services”). The Services are owned and operated by PUIG Group (as further described in Section 2 below).

Please read this Privacy Policy carefully before using the Services. Accessing and using the Services signifies consent to the data handling practices described in this Privacy Policy. If you do not consent, then please do not use the Services. Please also carefully review our Terms and Conditions, which include mandatory arbitration of disputes, jury trial waiver, and class action waiver.

Sections 1-12 describe our collection, use, and disclosure of personal information and personal data. Additional notices may be made at the point of collection, in which case those will supplement this Privacy Policy and govern that collection in the event of a conflict with this main Privacy Policy. Capitalized terms used but not defined herein will have the meanings given to them in applicable laws where we are subject to such laws, which may differ from one applicable jurisdiction to another.

Section 13 of this Privacy Policy describes Consumers’ privacy rights under State Privacy Laws that apply to us (“State Privacy Rights”) and how to exercise them and serves as our pre-collection notice. Our application of the rights in this section to residents of other jurisdictions is discretionary. 

We are committed to process personal data, which is defined as any information that relates to an identified or identifiable living individual (hereinafter “Personal Data”) in accordance with this Privacy Policy and upholding all rights afforded to data subjects under applicable law. We respect users' right to be informed regarding the collection of, and other operations involving their Personal Data. In using data that may directly or indirectly identify you personally, apply the principle of data minimization. This means that we have designed the Services to collect only the Personal Data we need for our processing purposes as disclosed in this Privacy Policy or at the time of collection. 

For the purposes of the State Privacy Laws (as defined below) PUIG FRANCE S.A.S - a French company with registered office at 65-67 Avenue des Champs Elysées 75008, Paris (France), holder of Tax Identification Number (SIRET) nº 682030507 and intra-European number VAT: FR14 682030507, recorded with the Commercial Registry of Paris (hereinafter “Company”, “us”, “we” or “our”) is the controller of your Personal Data.

This Privacy Policy relates to personal information identifying any user when accessing our Website, using its services and/or filling in forms on our Website with or without purchasing any product from the local Online-Shops. This Privacy Policy helps you understand how the Companies collect and use your Personal Data and for which purposes and lists your rights in relation to your Personal Data. 

For the accuracy of your provided Personal Data in our files, please communicate any changes to our Customer Service. Therefore, we can ensure that the information contained in our files is, always, up-to-date and accurate. We reserve the right to suspend or interrupt the provision of the requested services should you provide inaccurate Personal Data, without prejudice to any action allowed by law. 

If you give us your consent, your data may be shared with other companies within the Puig Group for the purpose of sending their own commercial communications. In that case, all the relevant information regarding the processing will be provided prior to obtaining your consent.

For the processing of your data related to offline sales, the data controller will vary depending on each territory. The details of such data controller will be made available prior to purchase at the respective establishments

For any issues or questions relating to this Privacy Policy you can contact our Customer Service at contact@ninaricci.com.

All Personal Data sent to the Companies through the Services and/or through in-person interactions with Company will be collected and/or processed by the Companies pursuant to the applicable laws of the location of our consumers, during the interaction, or place of residence if known, who interact with us in the individual or household context (“Consumers”) if through the Services, or pursuant to the laws of the place of the in-person interaction   This Privacy Policy does not apply to individuals acting in the business-to-business or employment contexts. 

For the purposes of this Privacy Policy, “State Privacy Laws” refers to the various applicable state-level privacy laws in force across various U.S. states, including but not limited to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, as well as all other applicable state consumer privacy laws that are currently effective. 

THIS PRIVACY POLICY SERVES AS OUR NOTICE AT COLLECTION (I.E., PRE-COLLECTION NOTICE). 

The purposes for which the Companies collect and process Personal Data and the respective legal basis are listed below. 

If our processing purposes or practices materially change between updates to this Privacy Policy, we will provide a supplemental notice when or before the changes apply.  

• Online Sales: Your Personal Data may be processed to provide the e-commerce services you subscribed to or reserved for registered users (as long as it is applicable and you provide the appropriate consent, if required separately), notably to fulfill placed orders for products, to contact you in case of any order issues or where we need to provide your Personal Data to our service providers to fulfill your order (herein the "Commercial Purposes"). This data processing is based on the fulfillment of our contractual obligations with the client in relation to the order. 

We may have access to third parties’ Personal Data which was directly disclosed by its Users, for example when a User bought a product to be sent to a friend, when the User paying for the product is different from the recipient of the product, or when User wishes to recommend to a friend a service of the Website or the sale of a particular product.

In this case, please make sure you receive the consent of such individuals before disclosing their Personal Data to us and make sure you inform them about this Privacy Policy; you will be the only person liable in connection with the disclosure of information and data regarding such third parties if they have not provided you with their prior explicit consent for it and for any improper and unlawful use of that information. In any event, we shall fulfil any obligation to inform third parties required by law and, when necessary, shall request their explicit consent upon registering in their archives the Personal Data of the User indicated.

• Marketing Purposes: Whenever you expressly give us your consent on the Website, our social media pages, computerized devices in stores or when permitted by applicable laws without your consent (for example, by having previously purchased on our Website a similar product) your Personal Data may also be processed:

o   To send you, through any communication channel, including but not limited to email, phone, SMS, postal mail, instant messaging services or any other current or future digital means, push notifications or other digital communications (including advertisements on social media platforms), containing commercial information and/or updates on our products or any other products or brands owned by Puig France SAS, offers, sending samples or gifts, exclusive sales, promotional campaigns, and/or information on events and similar initiatives organized by the Company and/or, if you consent to it, any other companies of PUIG Group. For this purpose, we, or, if applicable, any other companies of PUIG Group, occasionally may use your email address to customize ads for your interests or to generate a "lookalike audience" or similar audience through the Facebook, Instagram, Google, Snapchat, Pinterest or TikTok advertising platforms (“Third-Party Digital Businesses”) based on your consent. This allows us, or, if applicable, any other companies of PUIG Group, to target advertisements on those platforms to potential customers who appear to have shared interests or similar demographics to you, based on the platforms' own data. It is the policy of these Third-Party Digital Businesses to hash your email address prior to uploading it, match the hashed data against their own customers, generate the lookalike audience, then delete the uploaded email address and use it for no other purpose. We do not have access to the identity of anyone in the lookalike audience unless they choose to click on the ads, nor do, if applicable, the other companies of PUIG Group. We are not responsible for these Third-Party Digital Businesses, including without limitation their data security practices and/or failure to comply with your or our opt-out instructions, nor are, if applicable the other companies of PUIG Group.

If you wish to opt out, please contact us as per the “Contact” section below or, alternatively, by clicking the 'unsubscribe' link which is included in all of our marketing communications.

o   We also process your personal data with your consent when we publish the ratings and reviews that you have submitted. We might contact you about these ratings and reviews and request feedback on the products purchased.

o  We may also collaborate with third parties to provide us with browsing data (“Traffic Data”) resulting from the use of the Services and of our services to provide us analytics services and serve the Company's ads and banners when you are browsing on apps and other websites. We do this by way of various ad exchanges and digital marketing networks. We and our advertising partners use various advertising technologies, for instance, ad tag, cookies, pixels, identifiers and web beacons (“Tracking Technologies”). This information may be used by the Company to analyse and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites, and better understand your online activity. The ads and banners you see are based on information that we hold about you, or on your prior use of our Services, for example, products you have browsed previously, content you have read on our Services , or on the Company’s banners or ads that you have engaged with in the past. We may also work with and use services offered by Third-Party Digital Businesses to serve ads to you as part of a customized campaign on those third-party sites and platforms. As part of these ad campaigns, we or the Third-Party Digital Businesses may convert information about you, such as your email address and phone number, into a unique value that can be matched with a user account on these platforms to allow us to learn about your interests and to serve you advertising that is customized to your interests. 

If you wish to exercise your opt-out/in rights, as applicable, with respect to your cookie data, please visit our Cookies Policy, use our cookie management tool to manage your preferences, or follow the instructions outlined in the Do Not Sell/Share/Target Opt-out section below.  Please see Section 5 for additional information on your choices.

Legal basis is your consent to the respective Tracking Technologies which is obtained via our cookie management tool on our Website in which you can declare / withdraw your consent. Further information can be obtained in our Cookies Policy.

o   We may offer sweepstakes, contests, and other promotions (each, a “Promotion”), including Promotions jointly sponsored or offered by third parties, which may require submitting Personal Data. If you voluntarily choose to enter a Promotion, your information, including Personal Data, may be disclosed to us, co-sponsors, service providers, and other third parties, including for administrative purposes and as required by law (e.g., on a winners list). By entering, you are agreeing to the official rules that govern that Promotion, which may include consent to additional or differing data practices from those contained in this Privacy Policy. Please review those rules carefully.

o  If you give us your consent, your data may be shared with other companies within the Puig Group for their own marketing purposes detailed above.

•  Offline sales: Any data collected at a physical point of sale of PUIG may be processed by the Company to provide the services related with your purchase, notably to fulfill placed orders for products, to contact you in case of any order issues or where we need to provide your Personal Data to our service providers to fulfill your order (herein the "Commercial Purposes"). This data processing is based on the fulfillment of our contractual obligations with the client in relation to the order. 

•   Customer Service and Support:  We process your Personal Data for customer service purposes, such as shipping, delivery and return of products purchased on the Services and customer service to users of the Services. The Services also include access to a virtual assistant (also known as a chatbot or virtual agent) (“Virtual Assistant”). In general, a Virtual Assistant is an automated service powered by generative artificial intelligence (“GenAI”) that does not involve human interaction unless you request to engage with a live person. We make our Virtual Assistant available to you to offer a personalized and interactive tool to learn about our products and services and to offer options for real-time customer support.

•        Virtual Sizing Recommendation Tool (VSR): based on your consent, your Personal Data may be processed in the context of the use of VSR Tool. The VSR Tool process your image and information about your body shape locally, on the device you are using, and this information is not retained after you exit the VSR Tool. For more information on the implementation and use of VSR Tool, please review our Virtual Sizing Recommendation Data Processing Notice.

•        Security Purposes: In addition, and based on our legitimate interest to verify the coherence of the Personal Data you provide to us, your Personal Data may be processed for:

o   detect fraudulent activity and to keep the Website and online sales away from attackers who may try to access your account by impersonating you. In particular, we may use IP address, device, profile, usage, and other data to prevent and detect malicious or unsafe activities (e.g. payment fraud, identity fraud, account hacking, phishing, incentive abuses);and 

o   monitor all actions that could cause fraud or in the commission of a criminal offence related to the payment method employed by you; if any irregularities are detected, we reserve our right to retain the data provided and share it with the competent authorities in order to carry out the relevant investigation.

•        Commercial Purposes: We also process for the following Commercial Purposes: Computer services, for purposes related to hosting Companies servers; Payment platforms, for purposes related to the payment method and its execution; and Logistic services, for purposes related to shipping and delivery and return of the products purchased on the Services.

A. Tracking Technologies Generally 

Regular cookies may generally be disabled or removed by tools available as part of most commercial browsers, and in some instances blocked in the future by selecting certain settings. Browsers offer different functionalities and options, so you may need to set them separately. Please be aware that if you disable or remove these technologies, some parts of the Services may not work and that when you revisit the Services your ability to limit browser-based Tracking Technologies is subject to your browser settings and limitations. Accordingly, you may want to consider the more limited opt-out choices noted in the next section. 

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no consensus among industry participants as to what “Do Not Track” means in this context. Like many online services, Companies currently do not alter its practices when it receives a “Do Not Track” signal from a visitor’s browser. However, we do honor browser signals known as “Global Privacy Controls” and provide cookie preference tools on our Services as more fully explained in the Do Not Sell/Share/Target Opt-out subsection of the State Privacy Rights section. 

Some third parties, however, may offer you choices regarding their Tracking Technologies. For specific information on some of the choice options offered by third party analytics and advertising providers, see the next section. We do not represent that these third-party tools, programs or statements are complete or accurate.  

You will need to set preferences on each browser and devicethat you use to access our Services and clearing cookies / other trackers on your browser(s) / device(s) may disable some preference settings. 

B. Analytics and Advertising Technology 

Companies may engage and work with third parties, including Third-Party Digital Businesses, to serve advertisements on the Services. Some of these ads may be tailored to your interest based on your browsing of the Services and elsewhere on the Internet, which may include use of precise location and/or cross-device data, sometimes referred to as “interest-based advertising” and “online behavioral advertising” (“Interest-based Advertising”), which may include sending you an ad on another online service after you have left our Services (i.e., “retargeting”).  

You may choose whether to receive some Interest-based Advertising by submitting opt-outs through the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, including use of Cross-device Data for serving ads, visit http://www.aboutads.info/choices/. Please be aware that, even if you opt out of certain kinds of Interest-based Advertising, you may continue to receive other types of ads. Opting out only means that those selected DAA members should no longer deliver certain Interest-based Advertising to you but does not mean you will no longer receive any targeted content and/or ads (e.g., from other ad networks). Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different device or web browser or use a non-browser-based method of access (e.g., mobile app), your DAA browser-based opt-out may not, or may no longer, be effective. Companies support the ad industry’s Self-regulatory Principles for Online Behavioral Advertising and expects that ad networks Companies directly engage to serve you Interest-based Advertising will do so as well, though Companies cannot guaranty their compliance. Also note that the DAA program is national and not the same as Do Not Sale/Share/Target Opt-out rights under State Privacy Laws.  

We may also use Google Ad Services. To learn more about the data Google collects and how your data is used by it and to optout of certain Google browser Interest-Based Advertising, please visit: http://www.google.com/settings/ads.  

In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified on one of more of our data bases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our data bases and the data bases of the other online services. For instance, we may use such ad services offered by other Third-Party Digital Businesses, which may offer user controls that you can use to limit Matched List Ads. We are not responsible for these Third-Party Digital Businesses, including without limitation their security of the data or their failure to comply with your or our opt-out instructions, and they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.  

Companies may use Google Analytics or other Third-Party Digital Businesses for analytics services. These analytics services may use Tracking Technologies to help Companies analyze users and how they use the Services. Data generated by these Tracking Technologies (e.g., your IP address and other usage data) may be transmitted to and stored by these Third-Party Digital Businesses on servers in the U.S. (or elsewhere) and these Third-Party Digital Businesses may use the data for purposes such as evaluating your use of the Services, compiling statistic reports on the Services’ activity, and providing other services relating to Services activity and other Internet usage. Companies are not responsible for, and makes no representations regarding, the policies or business practices of any third parties, including, without limitation, Third-Party Digital Businesses associated with the Services, and encourages you to familiarize yourself with and consult their privacy policies and terms of use.  

You may exercise choices regarding the use of cookies from Google Analytics by going to https://tools.google.com/dlpage/gaoptout or downloading the Google Analytics Opt-out Browser Add-on. You may exercise choices regarding the use of cookies from Adobe Analytics by going to http://www.adobe.com/privacy/opt-out.html under the section labeled “Tell our customers not to measure your use of their web sites or tailor their online ads for you.” 

Companies are not responsible for effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. 

Residents of certain U.S. states have additional, more comprehensive, rights more fully explained in the Do Not Sell/Share/Target Opt-out subsection of the State Privacy Rights section.

Granting your Personal Data to us (in particular, your personal details, your e-mail address, your address, your Credit/Debit Card numbers and bank code and your telephone number) is necessary for processing your order for the purchase of products on the Services, supplying other services provided on the Services upon your request, or when your Personal Data is needed to fulfil obligations required by law or regulations. The refusal to provide us with some of your Personal Data necessary for performing the above purposes may consequently prevent us from processing your order for the purchase of products sold on the Services, sending you requested Newsletters or fulfilling obligations required by law and other regulations etc. Therefore, failing to provide Personal Data may constitute, in some cases, a legitimate and justified reason for not processing your order for the purchase of products sold on the Services or not providing the relevant Services. 

Disclosure of further Personal Data to us other than that required for fulfilling legal or contractual obligations and to be properly browse our services with necessary traffic data is, on the contrary, optional and does not have any effect on the use of the Services and of its services or on the purchase of products on the Services. We will inform you at every step whether disclosing your Personal Data to us is compulsory or optional by marking with an appropriate symbol (*) the information that is compulsory, or data needed for the purchase of products on the Services.

Personal Data will be disclosed to third – party companies that provide, on behalf of the Companies, specific information technology - , marketing and other services as data Processors or to other recipients (for example, for purchase transactions) of Personal Data collected by us that process your Personal Data only for the Commercial Purposes as independent data controller and, in any case, according to applicable laws and regulations.

Your Personal Data may also be shared between the Companies, the Companies distributors, and licensees with registered offices in EU countries or non-EU countries for their own Marketing Purposes.

Notwithstanding the foregoing, Personal Data will not be disclosed to any other third-parties or disseminated or transferred without informing our users of such disclosure / dissemination /transfer, and, in any case, in accordance with the applicable laws.

We have adopted reasonable security measures to protect Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, or access and against all other reasons for data processing that do not comply with our Privacy Policy. 

The Personal Data we collect from you is currently held within the European Union (“EU”), except personal data which is collected via Cookies on the Services of the Companies. However, it is possible that in the future such Personal Data may be transferred, stored and/or processed outside the EU. 

By submitting your Personal Data, you agree to this transfer, storing and/or processing. Please note that some cookie providers and data recipients may be in the United States or other countries which may have a lower level of data protection. However, we will take reasonable steps to ensure that your Personal Data is given equivalent protection in accordance with the State Privacy Laws, by implementing adequate contractual conditions in our agreements with business partners dealing with transfer of Personal Data to ensure that Personal Data are processed according to our instructions, and in such a way to maintain their integrity and security.

For more information on data transfers, you can contact us at: contact@ninaricci.com.

Each time your consent is required, the Companies will inform you in advance and will give you the option to either provide or refuse your consent for the use of your Personal Data, including your e-mail address, for the above purposes, by ticking the appropriate boxes. 

We wish to inform you that we may process your Personal Data also without your consent in certain circumstances, such as when such processing is necessary for performing a legal obligation to which we are subject or when such processing is necessary for performing obligations undertaken in contracts with the users.

You may contact the Companies at any time at the following email address contact@ninaricci.com for any concern or question regarding this Privacy Policy and your Personal Data provided to the Companies, or if you wish to receive further information on how we process your Personal Data. If you are a resident of a state with a State Privacy Law, please also see Section 13, below, regarding any additional privacy rights afforded to you by law.

You can also contact our Data Protection Officer at data.privacy@puig.com or by writing to us at: Puig Brands, S.A. - Data Protection Officer, Plaza Europa, 46/48, 08902, L'Hospitalet de Llobregat, Barcelona, Spain.

We may modify all or any part of this Privacy Policy from time to time to meet changes in law or business operations. We will notify you about any modification or update of this Privacy Policy by posting a notice on the homepage of our website and, for material edits that effect your legal rights, we will send a notice by email if we have your email address on file.

We will not make revisions that have a retroactive effect unless we are legally required to do so or to protect other users of the Services. Your continued use of the Services after the “Last Updated” date at the beginning of this Privacy Policy constitutes your acceptance of this Privacy Policy, as amended. As of the Last Updated date, the amended Privacy Policy supersede all previous versions of or agreements, notices or statements about the Services

EFFECTIVE DATE: JANUARY 2026

This U.S. State Privacy Notice (“Consumer Privacy Notice”) supplements the information contained in the Privacy Policy and applies only to Consumers, as defined under the applicable State Privacy Laws (defined below), who do not interact with us in the HR Context (defined below) (“Consumers”). In California, the term “Consumer” is not limited to data subjects acting as individuals in a household goods and services context and includes individuals acting in a business-to-business context. 

This Consumer Privacy Notice is designed to provide Consumers with notice of our Personal Information or Personal Data (as those terms are defined under the State Privacy Laws (collectively, “Personal Data”) practices over the prior 12 months, including our online and offline business activities (the “Business Activities”), and to meet the notice requirements of the State Privacy Laws. 

If our processing materially changes between updates to this Consumer Privacy Notice, we will provide a supplemental notice when or before the changes apply. Otherwise, this Consumer Privacy Notice serves as our notice at collection (i.e., pre-collection notice).

A.       Notice of Collection and Privacy Practices

If you interact with us in the “HR Context” (e.g., as a California employee, former employee, job applicant, independent contractor, etc.) this Consumer Privacy Notice does not apply to you. Please contact our HR Department to obtain a copy of the privacy notice that applies to Personal Data collected in the HR Context. 

Notably, this Consumer Privacy Notice does not apply to data that is not treated as Personal Data, or to the extent the data is subject to an exemption under applicable State Privacy Laws.

Generally, the processing purposes for which we collect, retain, use, disclose and otherwise process your Personal Data in connection with our Business Activities, include providing or promoting to you our products and services and as otherwise related to the operation of our business, which includes both Business Purposes, and Commercial Purposes such as sharing with Third-Party Digital Businesses, each as more fully explained below. This may include disclosing or otherwise making available Personal Data to our vendors that perform services for us in their role as “service providers” or “processors,” as the terms are defined under State Privacy Laws (collectively, “Processors”), as well as to third parties, each as more fully explained below. 

The categories of sources from which we collect your Personal Data include: you, other Consumers, your employer (in the business-to-business context), our Service Providers, and other third parties, including Third-Party Digital Businesses.

To learn about your privacy rights under State Privacy Laws and how to exercise them, please refer to the Your Rights and Choices section, which includes a notice of how to exercise Do Not Sell/Share/Target Opt-out rights.

B.       Processing of Personal Data

Generally, we collect, retain, use, and disclose your Personal Data to provide you our products and services, or information about them, and as otherwise related to the operation of our business, including for one or more of the following “Business Purposes”:

• Providing Products or Services: Operating or distributing products and services, processing or fulfilling transactions, administering accounts, providing customer service, verifying customer information, and processing payments.

• Managing Interactions and Transactions: Performing services on behalf of the business, including maintaining or servicing accounts and providing customer service, verifying customer information, processing payments, providing analytics services, and customizing your experience, offers and content.

• Security and Debugging: Helping to ensure the security and integrity of our systems and data to the extent the use of the Consumer’s Personal Data is reasonably necessary and proportionate for these purposes. Debugging to identify and repair errors that impair existing functionality.

• Advertising and Marketing: Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with State Privacy Laws. Short-term transient use including, without limitation, for providing advertising and marketing services, except for cross-context behavioral advertising (i.e., targeted advertising, which is a separate commercial purpose described below for which there is a right to opt-out), customizing your experience, offers, and content.

• Quality Assurance: Undertaking activities to verify or maintain the quality or safety of our products and services, and to improve, upgrade, or enhance our products or services.

• Research and Development: Undertaking internal research for technological development and demonstration.

• Operation of our Business: For our additional legitimate Business Purposes that are compatible with the purposes of collecting your Personal Data and that are not prohibited by law in the context that is not a “sale,” “share” or “targeted advertising” under State Privacy Laws, such as disclosing it to a person that processes Personal Data on our behalf, such as our Processors, to the Consumer, or to other parties at the Consumer’s direction or through the Consumer’s action (e.g., for payment processing, shipping, customs, and Fraud Detectors); for additional purposes explained at the time of collection (such as in the applicable privacy policy or notice); as required or permitted by applicable law; to the government or private parties, including litigants, to comply with law or legal process or to protect or enforce legal rights or obligations or prevent harm; and to assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business (“Corporate Transaction”), or otherwise with your consent, (“Additional Business Purposes”). Subject to restrictions and obligations under State Privacy Laws, our Service Providers may also use your Personal Data for Business Purposes and other purposes permitted by law and may engage their own vendors to enable them to perform services for us.

We may also use and disclose your Personal Data, regardless of the other purposes for which, we collect it, for Commercial Purposes, which may be considered a “sale” or “share” or “targeted advertising” under applicable State Privacy Laws or we otherwise make it available to them. Under State Privacy Laws some of these processing disclosure activities do not qualify as Business Purposes disclosures and are subject to a right to opt-out. The specific purpose for this selling or sharing is to help us and others provide you with more relevant content and marketing messages (e.g., targeted advertising), and related activities and when we and third parties process your Personal Data for certain advertising purposes (e.g., creating profiles and inferences, measurement, some types of analytics, conversion tracking, audience extension, etc.) and the parties we disclose it to are detailed, by type of Personal Data, in the Disclosures of Personal Data section below. For more information on the meaning of selling, sharing, and targeted advertising and how to adjust your preferences with respect to such processing, please refer to the Do Not Sell/Share/Target Opt-out subsection of the State Privacy Rights section below.

The Business Purposes and Commercial Purposes for processing described above may apply to all categories of your Personal Data, other than sensitive Personal Data, but we detail our disclosures (including selling and sharing), and detail our sensitive Personal Data processing purposes, by Personal Data category in the charts below for additional transparency.

C.       Collection, Disclosure and Retention of Personal Data 

We have collected the following categories of Personal Data from Consumers within the last twelve (12) months, however, we may also provide a separate supplemental notice when or before changes apply:

[TABLEAU 1]

We collect and process data that is Sensitive Personal Data under certain State Privacy Laws.  The table below describes the categories and examples of sensitive Personal Data we collect and the Business Purposes for and recipients of the same.

[TABLEAU 2]

Retention of Personal Data

Our retention periods are determined by the purpose of the collection, not strictly by the type of Personal Data collected. We retain your Personal Data for the duration of our relationship with you (e.g., as long as you have an account or subscribe to our services) and for a period thereafter as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. More specific retention periods for specific categories of Personal Data are including in specific notices (e.g., virtual try-on and skin analysis notices), which are linked herein where applicable.

Once the Personal Data is no longer needed for the specific business purpose for which it was obtained, we will securely delete, anonymize, or aggregate it so that it can no longer be associated with you.

Sources of Personal Data

We obtain the categories of Personal Data and Sensitive Personal Data listed above from the following categories of sources:

• Directly from our customers or their agents. For example, from information that our customers provide in order to facilitate the purchase of our products.

• Indirectly from our clients or their agents. For example, through information we collect from our customers in the course of providing products for them.

• From Third-Party Digital Businesses, when you submit content to us or post or interact with ads on those Third-Party Digital Businesses. We are not responsible for the policies or business practices of Third-Party Digital Businesses, including how they collect, use, or disclose your information, including through Tracking Technologies that collect information regarding your visit to the Service as well as after your visit is over. These Third-Party Digital Businesses may have their own terms of service, privacy policies or other policies and ask you to agree to the same. Be sure to review any available policies before submitting any  Personal Data to or otherwise interacting with any Third-Party Digital Businesses.

• Both directly and indirectly from activity on our Website

D. Disclosures of Personal Data 

As described in the Collection, Disclosure and Retention of Personal Data section and Use of Personal Data section above, we may disclose your Personal Data to a third party for a Business Purpose. 

Certain disclosures of Personal Data to the Services (e.g., transfers to provide marketing services, to facilitate Promotions, advertising purposes, etc.) may be considered a “sale” or “share” because of the way these terms are defined in the State Privacy Laws. However, the Company does not “sell” or “share” Personal Data in the ordinary sense of selling data for money. Where our activities fall within the definitions of “sale,” “share,” or “targeted advertising,” we honor the consumer’s right to opt-out, as detailed below.

E. Your Rights and Choices 

Subject to meeting the requirements for a Verifiable Consumer Request (defined below) and limitations permitted by State Privacy Laws, the Services provides Consumers residing in states with applicable State Privacy Laws to which we are subject the privacy rights described in this section. 

For residents of states without applicable State Privacy Laws, or where we are not subject to a state’s jurisdiction (e.g., we do not meet applicability thresholds) we will consider requests but will apply our discretion with respect to if and how we process such requests. We will consider applying state law rights prior to the effective date of such laws but will do so in our discretion.

To submit a request to exercise your Consumer privacy rights, or to submit a request as an authorized agent, follow the instructions in Section 13.F., below. We do not accept or process Consumer privacy rights requests through other means (e.g., via fax, chats, or social media, etc.). Please respond to any follow-up inquiries we make to help us complete your request.

i) Right to Limit Sensitive Personal Data Processing 

We only process Sensitive Personal Data for purposes that are exempt from consumer choice under State Privacy Laws. For example, we process your Personal Data to perform the services/provide the goods that you requested. In addition, we may process Consumers’ Personal Data with their consent where required by State Privacy Laws. If a Consumer provides us with their sensitive Personal Data for a particular purpose, they will have consented to processing for that purpose.

ii) Right to Access Categories / Confirm Processing 

California residents have a right to submit a request for any of the following for the period that is 12-months prior to the request date:

• The categories of Personal Data we have collected about you.

• The categories of sources from which we collected your Personal Data.

• The Business Purposes or Commercial Purposes for our collecting, selling, or sharing your Personal Data.

• The categories of third parties to whom we have disclosed your Personal Data.

• A list of the categories of Personal Data disclosed for a Business Purpose and, for each, the categories of recipients, or that no disclosure occurred.

• A list of the categories of Personal Data sold or shared about you and, for each, the categories of recipients, or that no sale or share occurred.

Residents of other applicable states are entitled to confirm our processing of their Personal Data. They can do so by making a Categories request.

Residents of Delaware, Oregon, Maryland, and Minnesota can request additional information regarding certain third party disclosures of your Personal Data (e.g., excluding disclosures to our service providers and processors). 

iii) Right to Access Specific Pieces of Data  

Consumers have a right to obtain a transportable copy, subject to applicable request limits, of your Personal Data that we have collected and are maintaining. California residents may also request a specific pieces their Personal Data. For a copy of your specific pieces of Personal Data, as required by applicable State Privacy Laws, we will apply the heightened verification standards (as defined in subsection F(ii), below). We have no obligation to re-identify data or to keep Personal Data longer than we need it or are required to by applicable law to comply with access requests.

iv) Do Not Sell/Share/Target Opt-out 

Consumers of certain states have a right to opt-out of Personal Data “sales”; provided, however, that Nevada residents are only entitled to the non-cookie opt-out explained below. California also has an opt-out for “sharing” for cross-context behavioral advertising (i.e., the use of Personal Data derived from different businesses or services to target advertisements). Non-California states have an opt-out of “targeted advertising” (defined differently per the applicable State Privacy Law but generally addressing tracking, profiling and targeting of advertisements). Consumers also have the right to confirm their opt-out.

We do not sell or share your cookie Personal Data or process it for targeted advertising, as those terms are defined under State Privacy Laws. Without limiting the foregoing, we do not knowingly sell or share the Personal Data of Consumers under 16 years of age. 

Opt-out for Non-Cookie Personal Data: If you would like to submit a Do Not Sell/Share/Target request for your non-cookie Personal Data (e.g., your email address), you must submit an opt-out request via Section13.F., below. 

Opt-out Preference Signals (also known as global privacy control or “GPC”): Some State Privacy Laws require businesses to process certain types of signals, referred to as opt-out preference signals in California or universal opt-out mechanism in other states, which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the sale or sharing of Personal Data, and of processing of Personal Data for targeted advertising, which we understand to include GPC signals. We currently look for and recognize GPC signals. To use a GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. Although we only enable non-essential (i.e., not strictly necessary) cookies if you opt-in to them, we have also configured the settings of our cookie consent management platform to receive and process GPC signals on our side, which is explained by our consent management platform, by clicking Cookie Configuration in the footer of the website. We do not process GPC for opt-outs of sales and sharing in other contexts (e.g., non-cookie Personal Data like email) because we lack the ability to match that data to your browser. We do not: (1) charge a fee for use of the Servicesif you have enabled GPC; (2) change your experience with any product or service if you use GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the GPC, except that we will display a message confirming that we recognize the signal.

We may disclose your Personal Data for the following purposes, which are not a sale or sharing: (i) if you direct us to disclose Personal Data; (ii) to comply with a privacy rights request you submit to us; (iii) disclosures amongst the entities that constitute the Companies as defined above, or as part of a Corporate Transaction; and (iv) as otherwise required or permitted by applicable law.

v) Child-Aged Consumers of Certain States 

We do not knowingly sell or share, or use for targeted advertising, the Personal Data of / from Child-Aged or other similar term (as defined by the applicable State Privacy Law) Consumers who are residents of certain states. 

vi) Deletion Request Rights 

You have the right to request that we delete any of your Personal Data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your Verifiable Consumer Request, we will delete your Personal Data from our records and direct our Service Providers, and third parties to delete from their records, unless an exception applies. If an exception applies, we will limit processing to such permitted purposes and to the duration of those purposes.

We may deny your deletion request if retaining the Personal Data is necessary for us or our Service Providers to:

1. Complete the transaction for which we collected the Personal Data, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

3. Debug products to identify and repair errors that impair existing intended functionality.

4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).

6. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

7. Comply with a legal obligation.

8. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

9. Other purposes permitted by State Privacy Laws.

Please be aware that making a deletion request does not ensure complete or comprehensive removal or deletion of your Personal Data or content that you may have posted. Note also that depending on where you reside (e.g., California), we may not be required to delete your Personal Data that we did not collect directly from you.

vii) Correction Request Rights 

You have a right to bring inaccuracies you find in your Personal Data that we maintain to our attention, and we will act upon such complaint as required by applicable law. Depending on the State Privacy Law and the category of Personal Data you are requesting to correct, you may have additional rights.

viii) Automated Decisionmaking / Profiling 

Some of the State Privacy Laws require us to state whether we carry out processing of Personal Data that implicates “profiling” (as defined by applicable State Privacy Laws) in furtherance of decisions that produce legal or similarly significant effects. One activity that we carry out that may constitute profiling is where we, like most businesses, utilize one or more Fraud Detectors. The categories of Personal Data processed as part of this activity are Identifiers, Personal Records, Commercial Information, Geolocation Data, Internet or Other Electronic Network Activity Information, and Inferences Drawn from other Personal Data. We are unable to offer an opt-out of this activity because doing so would restrict our ability to detect and prevent fraudulent and other illegal transactions and to comply with our legal obligations. If you are unable to make a purchase on the Services or in-store due to suspected fraud, please follow the instructions that are presented to you at the time of your attempted lawful transaction, such as utilizing a different payment method, including a different credit card, or cash (if you visit us in-person at one of our retail locations).

F. Exercising Your Consumer Privacy Rights 

To submit a request to exercise your consumer privacy rights, please submit a Verifiable Consumer Request to us at contact@ninaricci.com. Please respond to any follow-up inquiries we make to help us complete your request. We do not accept or process requests through other means (e.g., via fax, chats, or social media, etc.), except that notices of Child-Aged Personal Data issues and general privacy inquiries may be directed to us by contacting us.

i) Authorized Agent Requests 

Only you or a person that you authorize to act on your behalf, may make a Verifiable Consumer Request related to your Personal Data, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you, in accordance with the Verification of Your Request section below. You may also make a Verifiable Consumer Request on behalf of your minor child. We cannot respond to your request or provide you with Personal Data if we cannot verify your identity, or authority to make the request, and confirm the Personal Data relates to you. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable laws.

ii) Verification of Your Request 

We do not verify opt-outs of sale/sharing or requests to limit sensitive Personal Data processing unless we suspect fraud. As permitted or required by State Privacy Laws, any other request you submit to us must a “Verifiable Consumer Request,” meaning when you make a request, we may ask you to provide verifying information, such as your name, email, phone number, account and/or transaction information. We will review the information you provided and may request additional information (e.g., customer history) via email or other means to ensure we are interacting with the correct individual. We will not fulfill your Right to Access Categories / Confirm Processing, Right to Access Specific Pieces of Information, Deletion, or Correction request(s) unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected Personal Data. Only you, or someone legally authorized to act on your behalf (your authorized agent), may make a Verifiable Consumer Request related to your Personal Data or the Personal Data of your child. 

We verify each request as follows: 

Right to Access Categories / Confirm Processing (California residents only): We verify your request to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you. If we cannot do so, we will refer you to this Privacy Policy for a general description of our data practices.

• Right to Access Specific Pieces of Information: We verify your request to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you together with a signed declaration under penalty of perjury that you are the consumer whose Personal Data is the subject of the request. If you fail to provide requested information, we will be unable to verify you sufficiently to honor your request, but we will then treat your request as a Right to Access Categories / Confirm Processing request.

• Do Not Sell/Share/Target Opt-out: No specific verification required unless we suspect fraud.

• Deletion Request: We verify your request to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the Personal Data and the risk of harm posed by unauthorized deletion. If we cannot verify you sufficiently to honor a deletion request, you can still make a Do Not Sell/Share/Target Opt-out request.

• Correction Request: We verify your request to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the Personal Data and the risk of harm posed by unauthorized correction.

To protect Consumers, if we are unable to verify you sufficiently, we will be unable to honor your request. We will use Personal Data provided in a Verifiable Consumer Request only to verify your identity and authority to make the request and to track and document request responses unless you also gave it to us for another purpose.  

iii) Response Timing and Format 

We endeavor to respond to a Verifiable Consumer Request within the time permitted under State Privacy Laws. To the extent permitted by State Privacy Laws, if we require more time, we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Data that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We endeavor to respond to requests to opt-out of sale/sharing with 15 days of receipt. 

We do not charge a fee to process or respond to your Verifiable Consumer Request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Consistent with applicable State Privacy Laws and our interest in the security of your Personal Data, we will not deliver you information regarding your Social Security number, driver’s license number, or other government-issued ID number, financial account number, an account password, or answers to security questions in response to a consumer privacy rights request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

iv) Appeals  

You may appeal the Companies’ decision regarding a consumer privacy rights request you submitted (or that was submitted on your behalf by your authorized agent) by following the instructions provided in our response to your request. California and Utah residents are not entitled to request an appeal. 

G. Non-Discrimination 

We will not discriminate against you for exercising any of your rights under applicable State Privacy Laws. Unless permitted by State Privacy Laws, we will not:

• Deny you goods or services.

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Provide you a different level or quality of goods or services.

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

H. Notice of Financial Incentive 

We may offer discounts or other rewards (“Incentive(s)”) from time-to-time to Consumers who provide us with Personal Data, such as name, phone number, email address, IP address, or location. You may opt-in to Incentives by entering a competition, promotion, or survey or other loyalty Incentive programs we may offer from time-to-time (“Program(s)”). Each Program may have additional terms, available on the Program page or at Program sign-up. The Incentives will be described in the Program page or at Program sign-up.

We measure the value of your Personal Data collected from Programs by the cost of operating the applicable Program (excluding Incentive costs) and/or the cost of providing the Incentive. We deem the value of the Personal Data to be reasonably related to the value of the Incentive, and by subscribing to these Programs, you indicate you agree. If you do not agree, please do not subscribe to the Programs. If you subsequently wish to withdraw from the Programs, the method for doing so will be explained in the applicable Program terms. We do not limit participation in our financial incentive programs to Consumers who do not exercise their Consumer privacy rights. However, a deletion request will not delete Program Personal Data because the information is necessary to maintain your participation in the Program. If you desire to delete Program Personal Data, terminate your participation in the Program before making a deletion request pursuant to State Privacy Laws.

I. Our Rights and the Rights of Others 

Notwithstanding anything to the contrary, we may collect. use, and disclose your Personal Data as required or permitted by applicable law and this may override your rights under State Privacy Laws. In addition, we are not required to honor your requests to the extent that doing so would infringe upon our or another person’s or party’s rights or conflict with applicable law.

J. Additional Notice for California Residents 

This Consumer Privacy Notice provides information about our online practices and your California rights specific to our Services. Without limitation, Californians who visit our Services and seek to acquire goods, services, money, or credit for personal, family, or household purposes are entitled to the following notices of their rights:

California’s “Shine the Light” law (Civil Code section 1798.83) permits users of our Services who are California residents to request certain information regarding our disclosure of Personal Information to third parties (including our affiliates) for those third parties’ own direct marketing purposes. We do not currently disclose Personal Information to third parties other than our affiliates for those third parties’ direct marketing purposes. To make such a request, please contact us at contact@ninaricci.com. You must put the statement “Shine the Light Request” in the body of your correspondence. In your request, please attest to the fact that you are a California resident and provide a current California address for your response. This right is different than, and in addition to, Consumer privacy rights, and must be requested separately. We will not accept Shine the Light requests by telephone or by fax and are not responsible for requests not labeled or submitted properly, or that are incomplete.

Last update: January 2026 

© PUIG FRANCE S.A.S. All rights reserved.