Shiseido Singapore Co. (Pte) Limited (“Shiseido”; collectively, "us", “we” or "ours") is committed to protecting your privacy and ensuring that your Personal Data is protected. For the purposes of this Privacy Notice, "Personal Data" means any personally identifiable data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access (or any materially similar or analogous concept or definition under applicable law). This may include biometric data such as photos, facial images and video / voice recordings.

This Privacy Notice explains the types of Personal Data we collect and how we use, disclose, transfer, process and protect that information.

We collect Personal Data through, but not limited to, the following means:

i) Data you provide to us, such as:

• When you use or interact with our websites, platforms, virtual environments, product and service offerings and/or applications (both web and mobile versions) (collectively, our "Platforms");
• When you shop on, browse, access, or interact with us via our Platforms;
• When you shop in-store at our physical stores. In addition, your image may be recorded on CCTV during those visits;
• When you connect with us through social media, participate in our surveys, promotions, campaigns and other activities, or attend our marketing events;
• When you subscribe to our newsletter or other marketing communication;
• When you agree and consent to be our member and/or create an account with us, whether through physical or electronic means, or any other joint membership that we have with our partners;
• When you voluntarily share with us any content (suggestions, testimonials, surveys or any other feedback) about your experience in using our products or services. This also includes your posts on our Platforms (such as photos, videos, personal stories, or other similar media or content); and
• When you contact us via our customer service or via any other channel (online chat, email, text message, telephone help line for any reason, compliments, feedback or a request, etc.).

ii) Automatically collected data

Subject to the set-up of your internet browser, the following categories of Personal Data may be collected automatically when you navigate through our Platforms, due to various tracking technologies such as browser cookies. Such information may include (but are not limited to):

• Technical information: your IP address, the browser (type and version) you use, the name of your access provider, your operating system and interface or data related to your device and language preferences;
• Connection data: logs (identifiers, date and time of connection to your account and/or to our Platforms);
• Personal Data relating to your use of our Platforms: pages viewed, the website from which you are visiting us, your navigation actions, searched products, date, time and duration of your visit;
• Location-related information, which can be derived from information such as your device's IP address or your device's GPS signal; and
• Information collected in and through cookies, local storage, pixels and similar technologies.

iii) Data we receive and collect from other sources

• Third parties and advertising partners: We may obtain Personal Data from third parties and sources, such as our advertising partners. This may be the case when you accept our cookies on the Platforms, which will help us understand your activities, how you use our Platforms, the purchases you make, the advertisements you watch, among others. Such information are necessary for us to optimize our media campaigns and ensure we are not delivering to you ads that do not fit your preferences and profile.
• Social media partners: Subject to your consent to the use of cookies or similar technologies, we might receive your Personal Data from social media platforms (such as Facebook and Instagram, when you voluntarily provide to them your Personal Data in accordance with their policies), when you link your account with us to your social media account, or when you use your social media account to access any of our Platforms (e.g. to create an account with us on our Platforms, to participate in one of our promotional campaigns or to make a purchase without having to create an account on our Platforms) or when using social media plug-ins (e.g. “like” and “share” buttons). We will manage such Personal Data in accordance with this Privacy Notice. For the avoidance of doubt, the mere use of our Platforms does not generally involve Personal Data processing activities or Personal Data transfers or disclosures by or to social media platforms. However, depending on your cookies choices or confidentiality set-up, social media platforms may independently collect and otherwise process Personal Data about or related to you in order to provide personalized advertising, including ads from Shiseido. For more information about the scope and purposes for which your Personal Data is processed by these social media platforms, please refer to their privacy notices.

If you provide Personal Data of a third party to us, you must obtain the necessary consent from that third party to transfer their Personal Data to us, and for us to collect, use, disclose, transfer or process that Personal Data in accordance with this Privacy Notice and all applicable law.

We may update this Privacy Notice from time to time by posting updated versions on our Platforms, and/or by sending an e-mail to you. Your continued membership, access to and/or use of the Platforms will be taken to be your agreement to, and acceptance of, all changes made in each updated version.

Please check back regularly for updated information on how we handle your Personal Data.

We do not collect, use, process or disclose your Personal Data without your consent (except where permitted and authorised by law). By providing your Personal Data to us, you hereby consent to us collecting, using, disclosing, transferring, and processing your Personal Data from the sources set out in Section 1 of this Privacy Notice and for the purposes set out in Section 3 of this Privacy Notice.

The types of Personal Data we collect include, but are not limited to, your: (a) first name and family name; (b) home address; (c) age and date of birth; (d) email address; (e) mobile number; (f) gender and, only if appropriate, your (g) user name and password; (h) billing and delivery address; (i) personal identification number; (j) skin and/or health information (such as your physical characteristics, skincare concerns and/or skincare regimes, skin type, skin conditions and medications for the same); (k) racial or ethnic origin; (l) biometric data; (m) billing and financial information (e.g. credit and debit card information); (n) purchase history; (o) product preferences and communication channel preferences; (p) communications data (such as your correspondence or feedback history with us); (q) technical information about your interaction with our Platforms (such as the type and configuration of your device or browser, your IP address, time zone, language settings, date and time of your visit, the URL of the website from which you have been referred and your browsing history); and (r) other information as may be reasonably required for us to fulfil the purposes set out in Section 3 below, in accordance with all applicable law.

We collect, use, disclose, transfer and process your Personal Data for the following purposes:

1. providing you with our products and services;
2. providing you with information on products and campaigns from us, Shiseido Group and our third party business partners via emails, phone messages, postal mails and social networking services, including back-in stock notifications (where we have your consent or are permitted to do so under applicable law);
3. including you in our databases and collaterals for our sales and marketing opportunities and campaigns;
4. tailoring ads on our Platforms, social media platforms and elsewhere to your interest, use patterns and history with us;
5. allowing you to purchase products and services offered for sale, including establishing an account for checkout purposes;
6. ensuring the quality of products and services we provide to you;
7. facilitating your transactions with us;
8. administering your accounts with us;
9. sending you product samples and/or products;
10. keeping you informed of updates, changes, and developments relating to us and our services;
11. notifying you about important changes to this Privacy Notice, and to our other policies or services;
12. providing you with personalized consultations (whether conducted in-person or remotely), and managing any related appointments;
13. responding to queries or feedback from you;
14. managing your comments and reviews on our products and services;
15. maintaining and operating the Platforms, and ensuring network and information security;
16. managing our administrative and business operations;
17. prevention and detection of fraud and any unlawful use of our Platforms;
18. ensuring business and disaster recovery (such as the creation of back-ups);
19. engaging third party business partners and data processors (whether located locally or overseas) for the purposes stated in this section;
20. performing customer profiling, market analysis, market surveys, and research to improve our product and service offerings to you;
21. for document and data retention or storage, record keeping, statistical analysis, internal reporting and research purposes;
22. preventing, detecting and investigating crime and analysing and managing commercial risks, or any complaints you make;
23. protecting and enforcing Shiseido's (including its affiliates and personnel) contractual and legal rights and obligations;
24. safeguarding the interests of Shiseido in the event of any claim, litigation or suits;
25. fulfilling the legitimate interests of Shiseido or any other person, in accordance with applicable law;
26. complying with applicable legal requirements, relevant industry standards and our policies or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
27. processing payment or credit transactions;
28. any other purposes for which you have provided the information; and
29. any other purposes which are reasonably related to the above or for the performance of our obligations in the course of or in connection with the provision of our product and services offerings to you.

If you wish to withdraw your consent to receive information on new products and campaigns, or any other services, you may do so by:

1. unsubscribing from our Platforms;
2. clicking the “Unsubscribe" link in the email(s) we send to you;
3. contacting our Data Protection Officer at the email address below; or
4. writing to us at the address below.

You may also withdraw your consent and request us to stop collecting, using, disclosing and/or processing your Personal Data for any or all of the purposes listed above in Section 3 by: (a) contacting our Data Protection Officer at the email address below; or (b) writing to us at the address below. Please note that if you choose to withdraw your consent to our use, disclosure, transfer and/or processing of your Personal Data, we may not be able to provide you with some or all of our services or you may not be able to use our Platforms. Please note that withdrawing consent does not affect our right to continue to collect, use and disclose Personal Data where such collection, use and disclosure without consent is permitted or required under applicable laws.

We will ensure that the Personal Data in our possession is accurate and complete to the best of our knowledge. You agree to only submit Personal Data which is accurate and not misleading and to keep it up to date. We may verify the Personal Data provided by you as part of our user verification processes or as required under applicable law.

You have a right to request for access and correction of your Personal Data. If you would like assistance in accessing and/or correcting your Personal Data, please contact our Data Protection Officer at the email address below.

Please note that we may in accordance with applicable law, charge you a reasonable fee to process your access request. If so, we will inform you of the fee before processing your request. We will get back to you within the earlier of 30 days or the period stipulated under applicable law.

Our Platforms are directed toward and designed for use by persons aged 13 or older. We do not intend to collect Personal Data from children under 13 years of age. We are not able to verify whether a Platform user is under 13 years of age and therefore, we recommend parents or guardians to be involved in the online activities of their children in order to consent to or prevent their children's Personal Data from being collected, used, disclosed and/or processed by us. In the event where we become aware that we have accidentally collected Personal Data from a child under the age of 13, we will remove that Personal Data from our records as soon as feasibly possible.

We do not disclose or transfer your Personal Data to third parties unless we have clearly asked for and obtained your consent to do so (except where permitted and authorised by law).
The Personal Data which you provide to us may be stored, processed, transferred between, and accessed from servers located in the United States (“USA”) and other countries. Some of these countries have laws and regulations which may not guarantee the same level of protection of Personal Data as Singapore. However, we will take reasonable steps to ensure that your Personal Data is provided a standard of protection as required under applicable data privacy law and handled in accordance with this Privacy Notice, regardless where your Personal Data is stored or accessed from.

We maintain strict procedures, standards, and security arrangements to protect Personal Data in our possession or under our control. Upon receipt of your Personal Data, whether through physical or electronic means of collection, we will make the necessary security arrangements to protect such Personal Data as are reasonable and appropriate in the circumstances. Such arrangements may comprise administrative measures, physical measures, technical measures, or a combination of such measures.

When disclosing or transferring your Personal Data over the internet, we take all reasonable care to prevent unauthorised access to your Personal Data. However, no data transmission over the internet can be guaranteed as fully secure and you acknowledge that you submit information over the internet at your own risk.

Please note that any information you choose to share in public areas such as our Platforms' community features, or other social areas, is by definition considered as public and can be seen by anyone accessing the related platform.

We may retain your Personal Data for as long as is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable law. After this period of time, we will destroy or anonymise any documents containing your Personal Data in a safe and secure manner.

This Privacy Notice is governed by Singapore law.

If you would like to access or correct any Personal Data which you have provided to us, submit a complaint in relation to your Personal Data, or have any queries about your Personal Data, please contact our Data Protection Officer by contacting us at dpo_dprogram@shiseido.com.sg. Alternatively, you may write to us at:

Attention: Data Protection Officer
SHISEIDO SINGAPORE CO. (PTE) LIMITED
182 Cecil Street
#18-01 Frasers Tower
Singapore 069547

For General Enquiries: customerservice_dprogram@shiseido.com.sg

Please note that to process your request, we may ask you for proof of identity.

Date: 1 June 2023