The purpose of this Privacy Policy (the "Policy") is to describe how PT INOVASI IRVASCA INDONESIA, a limited liability company established under the laws of the Republic of Indonesia, with address at Griya Pamoyanan, Blok G 17, Pamoyanan Bogor, Indonesia, 16136, ("IRVASCA"), collects, uses, discloses or otherwise processes personal information about its clients and prospects ("you" or "your") in order to provide you with the best possible service.

IRVASCA collects, stores, processes, uses and discloses personal information about you in connection with your use of IRVASCA web sites, IRVASCA apps, your use of our connected products (if and when available), or when you visit our stores or visit our social media pages, in your jurisdiction.

For the purposes described in this Policy, IRVASCA may collect the following categories of personal information:

• • Identification and Contact information (such as name, address, phone number or e-mail address), when you are willing to provide them for instance to sign up for an online account or fill out a customer information card in store, to participate in an event or to make a purchase.
• • Demographic information like your gender and birthday.
• • Your image when you visit our stores (as CCTVS are in place), or your voice when you call IRVASCA Clients Services (since your call may be recorded).
• • Preferences and interests which you choose to disclose in the course of your contacts or encounters with our client advisors (which may include your preferences about our collections or other luxury brands, your size, your lifestyle, or basic information on your family circle).
• • Information, which may include health information, related to possible adverse effect caused by our cosmetic products.
• • Information you submit or post in a public space, on our social media pages or our websites, for example for a product review.
• • Information about your purchases. This could include the products you purchased and their prices.
• • If you use our web sites, we may collect information about the browser you are using, and your browsing behaviour.
• • If you use our mobile app, we may collect your GPS location, subject to your consent when required. We might also look how often you use the app and where you downloaded it. We may collect information about the browser you are using, and your browsing behaviour.
• • If you use our connected products, we may collect information regarding your use of such products (such as which features on our product you use the most, or battery level information), as well as geolocation information if necessary to provide you the service you requested.

We may also collect information posted on third party websites or social media platforms about our products and services, when necessary for the purposes defined hereunder.

• Your personal information is collected either directly from you (e.g., if you create an account on one of our sites/apps or make a purchase or otherwise interact with our client advisors in stores or with our Client Services), or from you passively (e.g., when using tracking tools like browser cookies), or from third parties (e.g. through social media platforms).

• If you choose not to submit any personal information when requested to perform a contract or when required by law, you will not be able to receive the product or service you ordered or otherwise register on our web sites, apps or other media.

Some categories of personal information above may be considered as sensitive personal information that requires special protection under applicable laws, such as payment information, health information, information about physical location of a person in the past or at present, etc. We treat your personal information that may be deemed sensitive as confidential, in compliance with the requirements under local laws and only for the purposes as outlined below.

We may collect or use the information described above for the purposes specified at the time of collection or hereafter in this Policy:

• • to improve our understanding of your interests and concerns, and to improve our understanding of your use of our products: we may use your information to make our website, apps and products/services better. We may use your information to customise your experience with us and to tailor our marketing activities to fit your needs and interests to allow us to better serve you and respond to your needs.
• • to provide you with our goods and/or services requested by you, to process your order, respond to your requests or questions, and manage your complaints: for example, we use your information to process your order and deliver your products. Or, we may use your information to send you information you requested, or to communicate with you about your account or our relationship: we may contact you about changes to the Site or about service updates. we may also contact you about feedback or about this Policy or website terms.
• • for security purposes: we may use information to protect our company, our customers, our associates, and our websites or apps against fraud, theft or any wrongdoing which may affect our activity and to ensure the security of our activity online and offline.
• • to manage the possible adverse effect caused by our cosmetic products in accordance with our legal obligations under applicable laws, including as a manufacturer of cosmetic products.
• • for anti-counterfeiting purposes, and fight against illegal resale channels for our products in violation of IRVASCA's general terms and conditions of sale and IRVASCA's selective distribution network (by monitoring in particular, quantities or frequency of products purchased), as it is our legitimate interest to protect against online counterfeiting and preserve our distribution network.
• • for marketing purposes: we may use your information to contact you, subject to your consent when applicable, about new products and special offers we think you will find valuable.
• • for analytics purposes, we may use your information to analyse the e-reputation of IRVASCA or our products and to measure the effectiveness of our online or offline campaigns or events, to preserve IRVASCA's image and optimise our marketing campaigns.
• • other purposes: we use information to maintain transaction and other business records for legal, administrative and audit purposes. We also use information to meet legal, insurance and processing requirements and to ensure observation of our policies as notified to you.

We do not disclose or otherwise share your personal information we collect, except:

• • with companies within IRVASCA Group of Companies: only authorised personnel with a need to know have access to the information, for purposes of internal audit, billing or administrative purposes and to provide you with the same level of services around the world. A list of IRVASCA stores is available on our website;
• • with service providers and agents who perform services on our behalf: for example, we share information with vendors who send emails for us. we may also share personal information with service providers that help us operate our websites and service providers appointed by us to deliver your products.
• • subject to your consent, with our business partners we have engaged to perform any functions with reference to the above purposes: for example we will share information with third parties who jointly sponsor an event or promotion with us.
• • with any third party as part of any business restructuring or reorganisation (including dissolution or liquidation). This includes if we are merged of all or part of our business or assets are transferred, assigned or sold.
• • when we are required to do so by law or when it is necessary to comply with applicable law: for example we might share information to respond to a court order.

We may collect certain information through cookies, web beacons and other automated means. A cookie is a text file which is stored in a dedicated area of your device’s hard drive, for instance when you visit online service, when you read an email or while installing or using a mobile app. A cookie allows its sender to identify the device on which it is stored during the period of validity of consent, which does not exceed 13 months.

What type of cookies do we use?

• • Some cookies may be functional to collect information which will allow us to facilitate your browsing such as languages preferences, memorising log-in, or saving the content of your shopping basket or wish list.
• • Other cookies also collect information on your behaviour by collecting referring URLS (where our visitors come from, which banners they clicked on and which directed them to our website), pages accessed, times of websites visits. Such information will allow us to enhance our web sites and apps, have a better understanding of the products and services you would prefer, and offer you more personalised communications and/or more personalised content on our website or our applications.
• • We also use cookies for web analytics to measure the web sites activity and determine the areas of the web sites which are the most visited, hence improving visibility of our content.
• • We use cookies to ensure security of online transactions/purchases through device fingerprinting, which allows to identify certain aspects of the equipment used to place an order.
• • Our websites or apps may contain third party cookies (delivered by advertising agencies, analytics providers, etc.) enabling them to collect browsing information on your devices, including to measure the efficiency of our advertising campaigns on third party websites. Third party cookies are subject to said third party privacy policies.
• • We may include in our website or apps the possibility to share content with third parties or to let other persons know you browsed our website. Such is the case for instance of “Like” and “Share” functionalities offered by social network platforms (“Facebook”, “Twitter”, etc).

• Social networks which offer these functionalities may identify you even though you do not use these functionalities on our website. Indeed, such functionalities allow social network platforms to track information about your browsing on our website whenever your social network account is active while browsing our website.

• We do not control how these platforms collect your personal data while you are browsing our website. We invite you to read the Privacy policies of these social networks to find out how they use information they collect (including for advertising purposes) through these buttons. These Privacy policies should provide you information about how to manage your preferences on your social networks account.

Acceptance of cookies

• • Except for functional or security cookies, the use of cookie on a Device depends on the user’s choice, which can be made and modified freely and at any time.
• • You can manage cookies by setting your browser to accept or reject cookies on your Device, either globally or cookie by cookie. Settings that you make may change your internet browsing capacity and may sometimes alter your ability to access to certain services that require the use of cookies.
• • Such is also the case if we or one of our business partners can no longer recognise the type of browser your Device is using and are unable to determine information such as language, display settings or country/region of connection. We cannot be held liable for the minimised access to our services as a result of cookies you previously deleted or rejected.

If you share your Device with other people and the Device operates several browsers, we cannot guarantee that personalised services and advertisement designed to match your personal use of the Device (if such personalised services and advertisement are available) will correspond to your own use and rather than someone else’s.

• Information we collect about you may be transferred to, stored and processed in countries/regions where a IRVASCA entity is located to ensure you may benefit from better services wherever you visit IRVASCA and for the purposes defined in this Policy. We may also transfer your personal information to the service providers invoIRVASCAed in the maintenance of our web sites, apps or social media or any other tool used for the processing of our clients or prospects information.

• When we transfer your information, we will provide a standard of protection for your personal information that is at least comparable to that provided under the applicable laws. This may include entering into data transfer agreements or any other valid grounds for transfers under applicable law.

• You can obtain a list of the relevant third countries/regions and copy of these safeguards upon request.

• Your personal information will not be kept in a form that allows you to be identified for any longer than is reasonably considered necessary by IRVASCA for achieving the purposes for which it was collected or processed or as it is established in the applicable laws related to data retention periods.

• We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

• You may request access to the personal information we maintain about you, or information about the ways in which we use or disclose your personal information ("access request"). If you make such an access request, we will provide you with all the information as required by law. We may charge a reasonable fee for an access request. If so, we will inform you of the fee before processing your request.

• You may also request that we correct, amend, erase, any of your personal information which we hold about you, and which is incomplete, out of date or inaccurate ("correction request"). You may also request that we limit the access to, stop disclosing, transferring or granting access to, delete your personal information. You also have the right to lodge a complaint with the competent supervisory authority.

• When our use, collection, disclosure and/or processing of your personal information is based on your consent (for instance when you accept to receive communication materials), you may withdraw, via email to support@irvasca.com, any consent you previously provided to us. Your withdrawal of consent does not affect the lawfulness of processing based on your consent before withdrawal, nor does it affect our right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

• Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request.

• To make an access request and/or a correction request, please contact us at support@irvasca.com, and we will respond to your request as soon as reasonably possible. In general, our response will be within ten (10) business days. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. We may refuse a request to exercise these rights where we are required or permitted to do so under applicable law.

• We will provide an adequate level of protection for the personal data and make sure that appropriate technical and organisational security measures are in place (including education and training of relevant personnel) to protect the personal information against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and against all other unlawful forms of processing.

• However, to the extent that no method of transmission over the Internet is completely secure, we cannot guarantee the security of any of your personal information stored or sent to Us. We encourage you to use caution when using the Internet to access our web sites, apps or social media.

• Our web sites and apps are not directed to children. We do not knowingly collect personal information from children without permission from a parent or guardian, unless permitted by applicable law.

• You must be at least 21 years old to provide us with your personal information.

• If we are notified in writing via the method stated at the "Contact Us" section below or learn that a minor below 21 years old has submitted personal data to us through our media or otherwise, we will delete such personal information.

• We may link to third party sites or services we do not control and which are governed by their own privacy policy. This Policy does not apply to those third party sites. We strongly advise you to check the privacy policies of all third party sites you visit to find out how they are treating your personal information.

• Our Policy may change from time to time to reflect changes in our processing of your personal information. We will notify you of any material changes as required by law. We will post an updated copy on our website.

• If you have any questions about the protection of your personal information please contact us at support@irvasca.com.

• This Policy is made in both the English language and the Indonesian language. Both texts are equally original. In case of any inconsistency or different interpretation between the English text and the Indonesian text, the relevant Indonesian text shall be deemed to be automatically amended to conform with and to make it consistent with the relevant English text.

By [signing][click 'agree' below], I hereby acknowledge that I have read this Policy, understand its content, and consent to the intended use of my personal information by IRVASCA through the manner as elaborated in this Policy. In addition, I confirm that all personal information that I have provided or will provide to IRVASCA is true and accurate.