STATE SPECIFIC DISCLOSURES: California Residents This section applies solely to California residents and supplements our Privacy Policy above. Collection and Disclosure of Personal Information We may collect and disclose or may have collected and disclosed your personal information to certain categories of third parties, as described below. Category Disclose to Third Parties Contact information and personal identifiers We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Device Identifiers We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Demographic information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law Physical characteristics We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law Biometric information We may disclose or may have disclosed this information to: Service Providers Commercial information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Payment information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Identity verification information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Online or network activity information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Geolocation information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers fraud detection providers law enforcement authorities or other government officials where required or permitted by law Audio and visual information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law Professional or employment related information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law Health and medical information We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law User Content We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law Inferences We may disclose or may have disclosed this information to: Our Brands Our Subsidiaries and Affiliates Service Providers law enforcement authorities or other government officials where required or permitted by law In addition to the purposes set forth in the “How We Use Information” and “How We Share Information” sections set forth and above, we collect and may disclose this personal information for the following business or commercial purposes: To audit our interactions with you to ensure compliance with applicable law and to measure the effectiveness of our products, services, and advertisements; To detect, prevent, and prosecute harmful, fraudulent, or illegal activity; To identify and repair bugs on our websites or mobile applications; To provide services, such as customer service, order fulfillment, and payment processing, which we either conduct or engage service providers to conduct on our behalf; For research and development; To further our business goals, including to advertise our products and services; and For quality assurance.

Collection and Use of Sensitive Personal Information We may collect certain categories of personal information that may be used to infer characteristics about consumers. Some of these categories used to infer characteristics about consumers may be considered “sensitive personal information” under California law, such as health and medical information like your skincare concerns, and demographic information like your ethnicity. In addition to the purposes set forth above, we use this information to further our business goals, such as to advertise our products and services or provide personalized product recommendations.

Sale or Sharing of Personal Information We do not sell or share your personal information for monetary consideration. Certain advertising practices, such as those described in the How We Use Information to Advertise section, may be considered a “sale” under California law when the personal information is exchanged for non-monetary consideration. You have the right to opt out of these types of disclosures of your information. We may “sell” or “share” (or may have “sold” or “shared”) the following categories of personal information to the third parties listed below: Category Sold to or shared with Third Parties Contact Information and personal Identifiers Device identifiers Online or network activity information Commercial information Inferences We may sell or share or may have sold or shared this information to: Advertising companies Our Brands We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age. We do not sell or share sensitive personal information.

Financial Incentives We may offer you various financial incentives such as discounts and special offers when you provide us with contact information and identifiers such as your name, email address and/or mobile phone number. When you sign-up for one of our brand loyalty programs, marketing lists or other discounts and special offers, you opt-in to a financial incentive. You may withdraw from a financial incentive at any time by opting out from the brand marketing communications for which you initially signed-up for, or closing your brand loyalty member account. Generally, we do not assign monetary or other value to personal information, however, California law requires that we assign such value in the context of financial incentives. In such context, the value of the personal information is related to the estimated cost of providing the relevant financial incentive(s) for which the information was collected.

Your Rights If you are a California resident, you have the right to: Request, twice in a 12-month period, access to the personal information we have collected, used, disclosed, and sold or shared about you, Deletion of the personal information we have collected from you (subject to certain exceptions), Correction of the personal information we maintain about you, if that information is inaccurate, Limitation of our use and disclosure of sensitive personal information used for inferring characteristics about you, Opt-out of the sale of your personal information or sharing of your personal information for cross-context behavioral advertising purposes. You can exercise your rights by contacting us at [email protected] . Before processing your request, we will take reasonable steps to verify your identity, which will include verifying that the email address from which you submit the request matches the email address we maintain on file for you. To ensure you are the owner of the email address, you must respond to a confirmation email that we will send to such email address. In some cases, we may ask that you provide additional information to verify your identity. You may also designate an authorized agent to make a request on your behalf. The authorized agent will be required to provide proof that they have been authorized to act on your behalf. If the authorized agent does not provide such proof, you will be required to confirm your identity and the authenticity of the request. To opt-out of the sale or sharing of your personal information for cross-contextual behavioral advertising purposes, you must also edit your preferences using the “Do Not Sell or Share My Personal Information / Target Ads” link at the bottom of each our Brand websites. You may also use the Global Privacy Control signal. For more information about the Global Privacy Control, visit https://globalprivacycontrol.org/. We will not discriminate against you on account of your exercise of your California privacy rights. If you would like us to read this Privacy Policy to you, please contact us using the information provided in the “Contact Us” Section of this Privacy Policy. Colorado, Connecticut and Virginia Residents This section applies solely to Colorado, Connecticut, and Virginia residents and supplements our Privacy Policy above. If you are a Colorado, Connecticut, or Virginia resident, you have the right to: request access to, or correction or deletion of, your personal information; or opt out of the processing of your personal information for targeted advertising purposes or the sale of your personal information. Certain advertising practices, such as those described in the How We Use Information to Advertise section, may be deemed targeted advertising or a “sale” under some state laws. You can exercise your rights by contacting [email protected] . Before processing your request, we will take reasonable steps to verify your identity, which will include verifying that the email address from which you submit the request matches the email address we maintain on file for you. To ensure you are the owner of the email address, you must respond to a confirmation email that we will send to the email address. In some cases, we may ask that you provide additional information to verify your identity. You may appeal our decision with respect to a request you have submitted by contacting us at [email protected] . To opt-out of the processing of your personal information for targeting advertising purposes or the sale of your personal information, you must also edit your preferences using the “Do Not Sell or Share My Personal Information / Target Ads” Illinois Residents This section applies solely to Illinois residents and supplements our Privacy Policy above. As indicated in our Privacy Policy, we may collect biometric information such as facial geometry if you use certain of our virtual try-on applications. For Illinois residents who provide us with biometric information (such as during use of our virtual try-on apps), in accordance with Illinois state law, we will retain biometric information only until the occurrence of the first of the following: The initial purpose for collecting or obtaining such biometric information has been satisfied, or Three years following your last interaction with us. Utah Residents This section applies solely to Utah residents and supplements our Privacy Policy above. If you are a Utah resident, you have the right to: request access to your personal information; request the deletion of personal information you have provided to us; opt-out of the processing of your sensitive information; or opt out of the processing of your personal information for targeted advertising purposes or the sale of your personal information. Certain advertising practices, such as those described in the How We Use Information to Advertise section, may be deemed targeted advertising. You can exercise your rights by contacting [email protected] . Before processing your request, we will take reasonable steps to verify your identity, which will include verifying that the email address from which you submit the request matches the email address we maintain on file for you. To ensure you are the owner of the email address, you must respond to a confirmation email that we will send to the email address. In some cases, we may ask that you provide additional information to verify your identity. To opt-out of the processing of your personal information for targeting advertising purposes or the sale of your personal information, you must also edit your preferences using the “Do Not Sell or Share My Personal Information / Target Ads” Florida Residents Florida Civil Code Section § 1798.83 permits users of our Website that are Florida residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to: [email protected] GDPR 1. YOUR DATA PROTECTION RIGHTS UNDER THE GENERAL DATA PROTECTION REGULATION (GDPR): Arm Alpha is based in the United States. We make no claims that the Web Site or any of its content is accessible or appropriate outside of the United States. If you access the Web Site from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. However, as a courtesy to the Users of our Website, that are residents of the European Economic Area (EEA), we make sure to be compliant with the requirements thereof. We take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. If you wish to be informed about what Personal Information we hold about you that you want to be removed from our systems, you can contact our Data Protection Officer using the Contact Us Section of this Policy. In certain circumstances, you have the following data protection rights: The right to access, update or delete your information. You can access, update or request deletion of your Personal Information directly within your account settings. If you are unable to perform these actions yourself, please contact us to assist you. The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete. The right to object. You have the right to object to our processing of your Personal Information. The right of restriction. You have the right to request that we restrict the processing of your personal information. The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format. The right to withdraw consent. You also have the right to withdraw your consent at any time where we previously relied on your consent to process your personal information. Users, who are residents of the European Economic Area (EEA) have the right to object to the Company processing their Personal Information based on legitimate interests, direct marketing (including profiling), and processing for scientific and/or historical research and statistics purposes. Where a User objects to the Company processing their Personal Information based on its legitimate interests, the Company shall cease such processing immediately, unless it can be demonstrated that the Company’s legitimate grounds for such processing override the User’s interests, rights, and freedoms, or that the processing is necessary for the conduct of legal claims. Where a User objects to the Company processing their Personal Information for direct marketing purposes, the Company shall cease such processing immediately. Where a User objects to the Company processing their Personal Information for scientific and/or historical research and statistics purposes, the User must, under the GDPR, “demonstrate grounds relating to his or her particular situation”. The Company is not required to comply if the research is necessary for the performance of a task carried out for reasons of public interest. 2. SUBJECT ACESS REQUESTS AS PER THE GDPR Arm Alpha is based in the United States. We make no claims that the Web Site or any of its content is accessible or appropriate outside of the United States. If you access the Web Site from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. However, as a courtesy to the Users of our Website, that are residents of the European Economic Area (EEA), we make sure to be compliant with the requirements thereof. We take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. If you wish to be informed about what Personal Information we hold about you that you want to be removed from our systems, you can contact our Data Protection Officer using the Contact Us Section of this Policy. Users who are residents of the European Economic Area (EEA), may make subject access requests (“SARs”) at any time to find out more about the Personal Information which the Company holds about them, what it is doing with that Personal Information, and why. Users wishing to make a SAR may do so in writing and the SARs should be addressed to our Data Protection Officer using the Contact Us Section of this Policy. Responses to SARs shall normally be made within one month of receipt, however this may be extended by up to two months if the SAR is complex and/or numerous requests are made. If such additional time is required, the User shall be informed. All SARs received shall be handled by the Company’s Data Protection Officer. The Company does not charge a fee for the handling of normal SARs. The Company reserves the right to charge reasonable fees for additional copies of information that has already been supplied to a User, and for requests that are manifestly unfounded or excessive, particularly where such requests are repetitive. Please note that we may ask you to verify your identity before responding to such requests. 3. DATA BREACH NOTIFICATION AS PER THE GDPR Arm Alpha is based in the United States. We make no claims that the Web Site or any of its content is accessible or appropriate outside of the United States. If you access the Web Site from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. However, as a courtesy to the Users of our Website, that are residents of the European Economic Area (EEA), we make sure to be compliant with the requirements thereof. We take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. If you wish to be informed about what Personal Information we hold about you that you want to be removed from our systems, you can contact our Data Protection Officer using the Contact Us Section of this Policy. All Personal Information breaches must be reported immediately to the Company’s Data Protection Officer. If a Personal Information breach occurs and that breach is likely to result in a risk to the rights and freedoms of Users (e.g. financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), the Data Protection Officer must ensure that the Information Commissioner’s Office is informed of the breach without delay, and in any event, within 72 hours after having become aware of it. In the event that a Personal Information breach is likely to result in a high risk to the rights and freedoms of Users, the Data Protection Officer must ensure that all affected Users are informed of the breach directly and without undue delay. Data breach notifications shall include the following information: The categories and approximate number of Users concerned. The categories and approximate number of Personal Information records concerned. The name and contact details of the Company’s data protection officer (or other contact point where more information can be obtained). The likely consequences of the breach. Details of the measures taken, or proposed to be taken, by the Company to address the breach including, where appropriate, measures to mitigate its possible adverse effects. 4. LAWFUL, FAIR, AND TRANSPARENT DATA PROCESSING AS PER THE GDPR: Arm Alpha is based in the United States. We make no claims that the Web Site or any of its content is accessible or appropriate outside of the United States. If you access the Web Site from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. However, as a courtesy to the Users of our Website, that do fall under the jurisdiction of the GDPR, we make sure to be compliant with the requirements thereof. If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. If you wish to be informed about what Personal Information we hold about you that you want to be removed from our systems, you can contact our Data Protection Officer using the Contact Us Section of this Policy. The GDPR seeks to ensure that Personal Information is processed lawfully, fairly, and transparently, without adversely affecting the rights of the User. The GDPR states that processing of Personal Information shall be lawful if at least one of the following applies: The User has given consent to the processing of their Personal Information for one or more specific purposes. The processing is necessary for the performance of a contract to which the User is a party, or in order to take steps at the request of the User prior to entering into a contract with them. The processing is necessary for compliance with a legal obligation to which the data controller is subject. The processing is necessary to protect the vital interests of the User or of another natural person. The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. or The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the User which require protection of Personal Information, in particular where the User is a child. If the Personal Information in question is “special category data” (also known as “sensitive Personal Information”) (for example, data concerning the User’s race, ethnicity, politics, religion, trade union membership, genetics, biometrics (if used for ID purposes), health, sex life, or sexual orientation), at least one of the following conditions must be met: The User has given their explicit consent to the processing of such data for one or more specified purposes (unless EU or EU Member State law prohibits them from doing so). The processing is necessary for the purpose of carrying out the obligations and exercising specific rights of the data controller or of the User in the field of employment, social security, and social protection law (insofar as it is authorized by EU or EU Member State law or a collective agreement pursuant to EU Member State law which provides for appropriate safeguards for the fundamental rights and interests of the User). The processing is necessary to protect the vital interests of the User or of another natural person where the User is physically or legally incapable of giving consent. The data controller is a foundation, association, or other non-profit body with a political, philosophical, religious, or trade union aim, and the processing is carried out in the course of its legitimate activities, provided that the processing relates solely to the members or former members of that body or to persons who have regular contact with it in connection with its purposes and that the Personal Information is not disclosed outside the body without the consent of the Users. The processing relates to Personal Information which is clearly made public by the User. The processing is necessary for the conduct of legal claims or whenever courts are acting in their judicial capacity. The processing is necessary for substantial public interest reasons, on the basis of EU or EU Member State law which shall be proportionate to the aim pursued, shall respect the essence of the right to data protection, and shall provide for suitable and specific measures to safeguard the fundamental rights and interests of the User. The processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of an employee, for medical diagnosis, for the provision of health or social care or treatment, or the management of health or social care systems or services on the basis of EU or EU Member State law or pursuant to a contract with a health professional, subject to the conditions and safeguards referred to in Article 9(3) of the GDPR. The processing is necessary for public interest reasons in the area of public health, for example, protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of EU or EU Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the User (in particular, professional secrecy). or The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) of the GDPR based on EU or EU Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the User. 5. ERASURE OF USERS’ PERSONAL INFORMATION AS PER THE GDPR: Arm Alpha is based in the United States. We make no claims that the Web Site or any of its content is accessible or appropriate outside of the United States. If you access the Website from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. However, as a courtesy to the Users of our Website, that do fall under the jurisdiction of the GDPR, we make sure to be compliant with the requirements thereof. If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. You have the right to request that the Company erases the Personal Information it holds about them in the following circumstances: It is no longer necessary for the Company to hold that Personal Information with respect to the purpose(s) for which it was originally collected or processed. The User wishes to withdraw their consent to the Company holding and processing their Personal Information. The User objects to the Company holding and processing their Personal Information (and there is no overriding legitimate interest to allow the Company to continue doing so). The Personal Information has been processed unlawfully. The Personal Information needs to be erased in order for the Company to comply with a particular legal obligation Unless the Company has reasonable grounds to refuse to erase Personal Information, all requests for erasure shall be complied with, and the User informed of the erasure, within one month of receipt of the User’s request. The period can be extended by up to two months in the case of complex requests. If such additional time is required, the User shall be informed. In the event that any Personal Information that is to be erased in response to a User’s request has been disclosed to third parties, those parties shall be informed of the erasure (unless it is impossible or would require disproportionate effort to do so). 6. RECTIFICATION OF USERS’ DATA AS PER THE GDPR: Arm Alpha is based in the United States. We make no claims that the Web Site or any of its content is accessible or appropriate outside of the United States. If you access the Web Site from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. However, as a courtesy to the Users of our Website, that do fall under the jurisdiction of the GDPR, we make sure to be compliant with the requirements thereof. If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information. You have the right to request that the Company rectify the Personal Information it holds about them in the following circumstances: Users have the right to require the Company to rectify any of their Personal Information that is inaccurate or incomplete. The Company shall rectify the Personal Information in question, and inform the User of that rectification, within one month of the User informing the Company of the issue. The period can be extended by up to two months in the case of complex requests. If such additional time is required, the User shall be informed. In the event that any affected Personal Information has been disclosed to third parties, those parties shall be informed of any rectification that must be made to that Personal Information.