PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

[Last Modified: September 15, 2026]

Applicability of this CCPA Notice

This California Consumer Privacy Act Notice (the “CCPA Notice”) is an integral part of the Natasha Denona Makeup LLC Privacy Policy (the “Privacy Policy”) and applies to Personal Information collected directly or indirectly from California residents by Natasha Denona Makeup LLC, including its subsidiaries and affiliates (collectively, “Natasha Denona,” “Natasha Denona Group,” “we,” “us,” or “our”) while operating our website.

The California Consumer Privacy Act, as amended, and other applicable California privacy laws apply to visitors, customers, employment applicants, independent contractors, and other individuals who are California residents. Capitalized terms not defined in this CCPA Notice have the meanings given in the Privacy Policy or under applicable California law.

Part I: Our Collection and Use of Personal Information

Personal Information We Collect

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information includes Sensitive Personal Information.

Personal Information does not include publicly available information, deidentified or aggregated information, or information excluded from the CCPA, including certain health information governed by HIPAA or CMIA, clinical-trial data, information covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or California Financial Information Privacy Act, and information governed by the Driver’s Privacy Protection Act. We do not process or use Sensitive Personal Information from users of our website except as described in this CCPA Notice.

Categories of Personal Information Collected

Category Examples Collected
A. Identifiers Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license or passport number, and similar identifiers. Yes. We may collect an online identifier, IP address, real name, account name, and email address.
B. California Customer Records personal information Name, signature, Social Security number, physical characteristics, address, telephone number, passport or driver’s license or state identification number, insurance information, education or employment history, bank account or credit or debit card information, and medical or health insurance information. Yes. We may collect a name and credit card or other payment information when provided.
C. Protected classification characteristics Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex or gender, pregnancy or childbirth, sexual orientation, veteran or military status, and genetic information. Yes. Age and gender may be collected in connection with customer information.
D. Commercial information Records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies. Yes. We collect information about products purchased and order data.
E. Biometric information Fingerprints, faceprints, voiceprints, iris or retina scans, keystroke patterns, gait, sleep, health, or exercise information. No.
F. Internet or other electronic network activity Browsing history, search history, and information regarding interactions with our website, applications, advertisements, or other electronic resources. Yes. We collect information about interactions with our website, products, and advertisements.
G. Geolocation data Physical or approximate location, including location inferred from an IP address or movements. Yes. We may collect an approximate location inferred from an IP address when accessing our website or dashboard.
H. Sensory information Audio, electronic, visual, thermal, olfactory, or similar information. No.
I. Professional or employment-related information Current or past job history or performance evaluations. No.
J. Non-public education information Education records directly related to a student and maintained by an educational agency or institution. No.
K. Inferences Profiles reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes. No.
L. Sensitive Personal Information Government identifiers, account log-in information combined with access credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of mail, email or text messages, genetic data, biometric information used to uniquely identify a person, health information, and information about sex life or sexual orientation. No.

Disclosure of Personal Information for a Business Purpose

We may disclose the categories of Personal Information below to the following categories of recipients for the corresponding business purposes:

Personal Information categories Categories of recipients Business purposes
A-G Cloud storage, hosting, customer relationship management, information technology, payment processing, and similar service providers Storing and hosting information, processing orders, clearing credit-card transactions, and providing services on our behalf.
A-G Government entities and law-enforcement authorities Complying with legal obligations, court orders, subpoenas, or other lawful requests.
A-G Operating systems and technology providers Operating, maintaining, and providing functionality for our website and related systems.
A-G Data analysis providers Analyzing website use, customer activity, trends, and performance.
A-G Marketing, customer relationship management, social media, and advertising networks Marketing, delivering advertising, measuring campaigns, and providing interest-based or cross-context behavioral advertising.
A-G Security and fraud-prevention providers Debugging, protecting our systems, preventing fraud, and maintaining security.
A-G Customer-support providers and affiliates Responding to questions, providing customer service, and supporting our business operations.
A and F AI chat assistant service provider(s) Operating our AI-powered chat feature and analyzing use of the feature to improve the service.

How We Collect Personal Information

We collect Personal Information:

  • Directly from you, including when you create an account, place an order, contact us, submit a form, or otherwise provide information.
  • Directly or indirectly from your activity on our website, including through cookies, pixels, analytics tools, and similar technologies.
  • Indirectly from campaigns, content, advertisements, social media, and other interactions with our brand.
  • Through our AI chat assistant. When you interact with our AI-powered chat assistant, we may collect the content of your interactions and related usage, device, and technical information. We may analyze this information for analytics, service improvement, and website improvement. Please do not provide Sensitive Personal Information to the AI chat assistant, including financial account numbers, government identification numbers, health information, or similar sensitive details.

How We Use Personal Information

We may use Personal Information to fulfill the purpose for which it was collected, process and support orders, provide customer service, protect the security and integrity of our systems, prevent fraud, improve our products and website, analyze advertising and website performance, comply with legal obligations, respond to law-enforcement requests, and for the other purposes described in our Privacy Policy. We will not collect or use Personal Information for materially different purposes without providing notice as required by law.

Sale or Sharing of Personal Information

We do not sell Personal Information for money in the traditional sense. However, we may “share” Personal Information as that term is defined under California law for cross-context behavioral advertising. In the preceding twelve months, we may have shared or sold categories A, D, F, and G to advertising networks and advertising partners for cross-context behavioral advertising.

We do not knowingly sell or share Sensitive Personal Information or health information except as permitted by law and subject to appropriate contractual and other safeguards.

Retention of Personal Information

We retain Personal Information for as long as necessary to fulfill the purposes described in this notice and our Privacy Policy, honor your choices, comply with regulatory obligations, resolve disputes, enforce agreements, and protect our legal interests. Transactional data is generally retained for seven years after termination of the relevant relationship, subject to applicable requirements and exceptions. We may delete Personal Information at any time when permitted by law.

Amendments to this Notice

We may update this CCPA Notice at least every twelve months and whenever necessary to reflect changes in our practices or applicable law. The date above shows when this notice was last revised.

Children Under 16

We do not knowingly collect or sell the Personal Information of children under 16.

Part II: Your California Privacy Rights

Subject to applicable legal exceptions and verification requirements, California residents may have the following rights:

Right Description
Right to know You may request the categories and specific pieces of Personal Information we collected, the sources, business or commercial purposes for collection, and the categories of third parties to whom we disclose or sell Personal Information.
Right to delete You may request deletion of Personal Information that we collected from you, subject to exceptions under California law.
Right to correct You may request correction of inaccurate Personal Information that we maintain about you.
Right to opt out of sharing You may opt out of the sharing of Personal Information for cross-context behavioral advertising.
Right to opt out of sale or sharing You may opt out of the sale or sharing of Personal Information, as defined by California law.
Right to limit use of Sensitive Personal Information You may limit the use and disclosure of Sensitive Personal Information where the CCPA grants that right.
Right to opt out of automated decision-making You may opt out of automated decision-making or profiling in circumstances where California law provides that right.
Right to non-discrimination You have the right not to receive discriminatory treatment for exercising your California privacy rights.
Right to portability You may request your Personal Information in a portable format, where applicable.

For more information about California privacy rights, visit the California Attorney General’s privacy laws page.

How to Exercise Your Rights

You may opt out of sale or sharing by using the “Do Not Sell or Share My Personal Information” link or cookie-management tool on our website. You may also use the following industry opt-out resources:

To submit a request to know, delete, correct, limit use of Sensitive Personal Information, or exercise another applicable right, complete our Data Subject Request form or email wecare@natashadenona.com. We may need to verify your identity before completing a request. We will respond within the time required by applicable law.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We may require a signed permission, power of attorney, verification of your identity, and confirmation directly from you. We may deny a request when an authorized agent does not provide sufficient proof of authority or identity.

Financial Incentives

We do not offer financial incentives related to the collection, sale, or deletion of Personal Information.

Part III: Additional California Obligations

Direct Marketing

California residents may request information under California Civil Code section 1798.83 about certain disclosures of Personal Information for direct marketing purposes. Submit the request using the Data Subject Request form or by contacting us at wecare@natashadenona.com.

Do Not Track

Our website does not currently respond to “Do Not Track” browser signals because there is no commonly accepted industry standard for responding to them. For more information, visit www.donottrack.us.

Shine the Light

California residents may request information about certain disclosures of Personal Information to third parties for their own direct marketing purposes under California’s Shine the Light law. Submit the request using the Data Subject Request form or by contacting us at wecare@natashadenona.com.

Global Privacy Control

Where required by applicable law, we honor qualifying Global Privacy Control signals as a request to opt out of the sale or sharing of Personal Information. Learn more at globalprivacycontrol.org.

Contact Us

If you have questions about this CCPA Notice or our privacy practices, contact us at wecare@natashadenona.com or by mail at:

Natasha Denona Makeup LLC
Attn: Privacy
450 Lexington Avenue, 4th Floor
New York, NY 10017
United States