PRIVACY POLICY

LAST UPDATE: OCTOBER 28, 2025

The Estée Lauder Companies respects your privacy and values the relationship we have with you.

This Privacy Policy describes how our brand Le Labo collects, uses, discloses and safeguards your personal information.

References in this Privacy Policy to “we”, “us”, “our”, “ELC” are references to the entity or entities responsible for establishing the purposes for the processing of your personal information. See the Your Data Controller section below for details.

TABLE OF CONTENTS

• INFORMATION WE PROCESS
• HOW WE COLLECT INFORMATION
• HOW WE USE INFORMATION
• OUR LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION
• HOW WE SHARE INFORMATION
• HOW YOU CONTROL YOUR INFORMATION
• HOW WE USE COOKIES
• HOW WE USE INFORMATION TO ADVERTISE
• INTERNATIONAL TRANSFERS
• HOW WE PROTECT INFORMATION
• HOW LONG WE RETAIN INFORMATION
• HOW WE TREAT CHILDREN’S INFORMATION
• UPDATES TO OUR PRIVACY POLICY
• HOW TO CONTACT US
• YOUR DATA CONTROLLER

INFORMATION WE PROCESS

We may collect or process the following types of information about you. The specific information we collect about you will vary depending on how you interact with us.

• Personal identifiers and contact information, such as your name, address, email address, telephone number, and username or social media handle.
• Device identifiers, such as information about your device like your MAC address, IP address, or other online identifiers.
• Demographic information, such as your age or date of birth, sex, and gender.
• Physical characteristics, such as your hair type and color, skin type, eye color, and facial geometry if you use certain of our virtual try-on applications.
• Commercial and transactional information, such as the products or services you have purchased and the location of purchase, products returned or considered and your product preferences.
• Payment information, such as your method of payment and payment card information (including payment card number, delivery address and billing address).
• Identity verification information, such as photo identification for in-store pick-ups, loyalty member ID, and authentication information (like passwords).
• Online or network activity information, such as interactions with our websites, mobile apps, digital properties and advertisements; browsing/search history on our sites; and log file information like browser type and webpages visited.
• Geolocation information, such as GPS coordinates or approximate device location.
• Audio and visual information, such as call recordings to customer service and video surveillance in our retail stores.
• Professional or employment-related information, such as licenses or certifications in connection with our professional programs.
• Health and medical information, such as skincare concerns or condition, diagnoses, medical reports and history.
• User Content, such as communications you send us and content you provide (photos/images, videos, reviews, articles, survey responses, comments).
• Inferences drawn from or created based on any of the above.

HOW WE COLLECT INFORMATION

We may collect personal information about you from various sources. For example:

• Directly from you (e.g., purchases on our websites or in our stores, contacting us, using our mobile applications or virtual try-on experiences, creating an account, registering for loyalty programs or marketing lists, responding to surveys, participating in contests/promotions, making appointments or signing up for events). If you submit contact information of others, only provide details for people with whom you have a personal or family relationship and who have consented to such sharing.
• From your friends or family members (e.g., sending a gift or making a referral).
• When you interact with our websites or emails (we and third parties may automatically collect information via cookies, pixel tags and similar technologies).
• Through in-store and other offline technologies (e.g., video surveillance, traffic counting, Wi-Fi technologies, and call recording when you speak to customer service).
• From business partners and service providers (e.g., demographic companies, analytics providers, advertising companies and networks, third-party retailers or distributors, loss prevention services, and other collaborators).
• From social media platforms and networks (e.g., if you interact with us on social media or choose to log in to our sites using social credentials).
• From other ELC Brands that you have interacted with (see “Our Brands” on ELCompanies.com).

We may combine information we obtain from the above sources (for example, in-store information with online information).

HOW WE USE INFORMATION

• To provide products and services (e.g., fulfill orders, process payments; create, service and/or maintain your account or loyalty membership; identify concerns and assist with product recommendations; facilitate product reviews).
• To communicate with you (e.g., respond to inquiries or complaints; help you place an order).
• To administer participation in special events, contests, sweepstakes, surveys or promotions.
• For marketing and advertising (e.g., postal mail, SMS, email, push notifications; show ads tailored to your interests/profile on social media and other websites).
• To operate and understand your use of our websites and mobile apps (e.g., remember your info so you don’t re-enter it; understand preferred purchasing methods; determine browsers/devices used; evaluate and improve services, ads, sites and apps). For details on how Google collects/uses data when we use its services, see “Business Data Responsibility.”
• To operate and improve our business (e.g., analytics, quality assurance, adverse event/product-related claims processing, research and development, accounting, auditing and other internal functions).
• For legal and security purposes (e.g., detect/prevent/prosecute harmful, fraudulent or illegal activity or policy violations; loss prevention; identify and repair bugs; comply with laws, standards and policies).
• We may also use your information in other ways for which we provide specific notice at collection.

OUR LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION

Where required by law, we use information for the above purposes if:

• It is necessary to perform a contract to which you are party (e.g., process payment and fulfill an order).
• We have obtained your consent (e.g., marketing communications).
• We have a legitimate interest (including marketing activities, video surveillance, research, analytics, internal administration, fraud prevention, enforcement of our policies/terms, and compliant business operations).
• We need to comply with a legal obligation.

HOW WE SHARE INFORMATION

• Our Brands (for marketing/advertising and other purposes in this Privacy Policy).
• Our Subsidiaries and Affiliates (on a need-to-know basis for the purposes in this Policy).
• Service providers (e.g., payment processing, order fulfillment, policy/terms enforcement support, hosting, analytics, advertising and marketing).
• Parties to a corporate transaction (e.g., merger, acquisition, joint venture, reorganization, divestiture, dissolution, liquidation).
• Advertising companies (see “How We Use Information to Advertise”).
• Other third parties as required/permitted by law, to prevent harm/fraud, or with your consent (e.g., third-party salons/spas).

HOW YOU CONTROL YOUR INFORMATION

• Data Subject Rights: Depending on applicable laws, you may request access, correction, deletion or transmission to a third party; withdraw consent; restrict/object to processing; and provide guidelines for storage/deletion/sharing after death. Submit requests through our PRIVACY REQUEST PORTAL. We may take reasonable steps to verify your identity. You may also raise a complaint with your competent data protection authority.
• Marketing & Advertising Preferences: Manage preferences in your account or opt out via unsubscribe instructions or the PRIVACY REQUEST PORTAL. If you unsubscribe, we will stop using related personal information (e.g., email/phone) for targeted advertising.
• Mobile Device & Browser Preferences: Manage location and push notifications in your device settings.
• Cookie Preferences: Manage cookies via your browser and, where available, the “Manage Cookies” link in the site footer. See How We Use Cookies.

HOW WE USE COOKIES

We use strictly necessary, performance, functional and targeting cookies. You can manage preferences via the site tool (if available) or your browser. In countries with the tool, access “Manage Cookies” in the footer to view cookie lists and update choices. Preferences apply per browser/device; clearing cookies may require re-opting-out. Our websites are not designed to respond to browser “Do Not Track” signals.

HOW WE USE INFORMATION TO ADVERTISE

We may process your information to advertise our products and services, including targeted advertising. Third-party advertising companies may use cookies, pixel tags and similar technologies to collect device identifiers, online activity, commercial information and inferences to deliver targeted ads. You can opt out of cookie-based advertising via cookie preferences (you may still see non-targeted ads). We also work with third-party platforms (including social networks) for ad delivery/measurement and may convert your contact details to a unique value for matching. You may request we refrain from this via the PRIVACY REQUEST PORTAL.

INTERNATIONAL TRANSFERS

Your personal information may be transferred, stored or processed outside your country (e.g., the United States) under applicable foreign laws. We protect transferred information as described here and comply with applicable data-transfer requirements (e.g., data transfer agreements, E.U. Standard Contractual Clauses, or other mechanisms). To request details where required by law, use the PRIVACY REQUEST PORTAL.

HOW WE PROTECT INFORMATION

We maintain administrative, technical and physical safeguards designed to protect personal information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use, and restrict access on a need-to-know basis.

HOW LONG WE RETAIN INFORMATION

We retain personal information as long as reasonably needed for the purposes outlined here, considering:

• The purposes for which it was collected (including to provide products/services).
• Your marketing preferences and how you engage with Le Labo.
• Applicable legal or regulatory requirements.
• Whether the information may be relevant to protecting our rights (e.g., limitation periods).

For more information, submit a request through the PRIVACY REQUEST PORTAL.

HOW WE TREAT CHILDREN’S INFORMATION

Our products and services are designed for a general audience and are not intended for or directed to children.

UPDATES TO OUR PRIVACY POLICY

We may update this Privacy Policy periodically and without prior notice to reflect changes in our practices. We will post a notice on our websites for any significant changes and indicate the “Last Update” date above.

HOW TO CONTACT US

If you have questions or would like to exercise your rights, contact us through the PRIVACY REQUEST PORTAL.

YOUR DATA CONTROLLER

A data controller is the entity responsible for establishing the purposes and means of processing your personal information. Selected examples are listed below.