United States Privacy Supplement

1. Scope and relationship with the Global Privacy Policy

This United States Privacy Supplement provides additional information for residents of US States that grant consumer privacy rights. It supplements the Skin Shop Global Privacy Policy. It applies only where a State privacy law applies to Island Organics Limited and to the relevant processing.

US privacy laws differ by State and may contain thresholds, exemptions and definitions. Nothing in this Supplement is intended to create a right not provided by applicable law. We may choose to honour a request voluntarily even where a particular statute does not apply.

2. Categories of personal information

Depending on your interaction with us, we may collect the following categories. The examples describe our general practices and should be read with the Global Privacy Policy.

3. Purposes and disclosures

We use personal information to process transactions and delivery; manage accounts, rewards and subscriptions; provide support; handle returns and complaints; investigate safety and quality concerns; secure our services and prevent fraud; comply with law; improve products and services; and conduct marketing, analytics and advertising subject to applicable choices.

We may disclose relevant categories to Shopify and approved apps, payment and fraud providers, warehouses and carriers, Freshdesk, LoyaltyLion, subscription providers, analytics and advertising partners, marketplaces, professional advisers, authorities and a genuine buyer or successor in a corporate transaction. The Global Privacy Policy explains these recipient categories in more detail.

4. Sale, sharing and targeted advertising

We do not sell personal information for money. However, some US State laws define 'sale', 'sharing' or 'targeted advertising' broadly. The use of advertising cookies, pixels or audience tools may fall within those definitions even when no money is paid.

Where required, you may opt out through the 'Do Not Sell or Share My Personal Information' or privacy-preferences link, or by submitting a US Privacy Request. We also process legally recognised universal opt-out preference signals, such as Global Privacy Control, where required and technically applicable. An opt-out signal applies to the browser or device from which it is sent unless it is linked to an authenticated account as permitted by law.

Important: The statements and website links in this section must match the actual Shopify advertising configuration. If Meta, Google, TikTok or affiliate pixels receive identifiable or linkable data, that activity must be assessed under each applicable State law.

5. Consumer health and sensitive data

Skin Shop is a cosmetics retailer and is not generally a healthcare provider covered by HIPAA. Nevertheless, some State laws protect consumer health information outside HIPAA. Information about skin conditions, pregnancy, medication, allergies, symptoms or suspected adverse reactions may qualify as sensitive or consumer health data.

We collect such information only when you voluntarily provide it for support, a refund, a complaint, product guidance or a safety investigation. We use it for the requested service, product-safety and quality monitoring, legal compliance and claims. We do not use it for targeted advertising, cross-context behavioural advertising, advertising audiences or general-purpose AI training. We do not sell consumer health data.

Where applicable law requires consent before collecting or sharing consumer health or other sensitive data, we will request that consent separately. You may withdraw consent and request deletion subject to applicable law and necessary safety, legal or claims records.

6. State privacy rights

Depending on your State and whether its law applies, you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccuracies;
• delete personal information, subject to exceptions;
• obtain a portable copy of eligible information;
• opt out of sale, sharing, targeted advertising or qualifying profiling;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent for processing that requires consent;
• use an authorised agent where permitted;
• appeal a refusal to act on a request in States that provide an appeal right; and
• receive equal service and not be discriminated against for exercising applicable rights.

7. How to exercise your rights

Submit a request through https://support.skinshop.co.uk and mark it 'US Privacy Request'. State your State of residence, the right you wish to exercise and the email address associated with your account or order. Do not send passwords, full payment-card details or unnecessary medical records.

We may request information reasonably necessary to authenticate access, correction, deletion or portability requests. We do not require identity verification for an opt-out where the law prohibits it. An authorised agent may be asked to provide proof of authority, and we may contact you directly where permitted.

We will respond within the period required by applicable law and explain any extension, denial or appeal method. Requests are normally free; where the law permits a fee for manifestly unfounded, excessive or repetitive requests, we will explain it before proceeding.

8. Appeals

If we deny a request and your State provides an appeal right, you may appeal through the same support channel within the period stated in our response. Mark the message 'US Privacy Appeal' and explain why you believe the decision should be reconsidered. We will provide the outcome and any available method to contact the relevant State authority.

9. California disclosures

If the California Consumer Privacy Act (CCPA) applies, California residents have rights to know/access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal treatment. The categories collected, sources, purposes and recipient categories are described in sections 2 and 3 and in the Global Privacy Policy.

We do not knowingly sell or share the personal information of consumers under 16. We retain each category only as long as reasonably necessary for the disclosed purpose, using the periods and criteria in the Global Privacy Policy. California residents may use an authorised agent. Where required, our website will provide a clear 'Do Not Sell or Share My Personal Information' link and honour applicable opt-out preference signals.

The CCPA currently applies only if statutory thresholds or other applicability criteria are met. Publication of this section does not represent that Island Organics Limited necessarily meets those thresholds.

10. Other State-specific provisions

Residents of States including Colorado, Connecticut, Oregon, Texas and others may have rights to access, correct, delete, obtain portability, opt out of targeted advertising or sale, and appeal. Universal opt-out signals are honoured where required. State-specific sensitive-data consent rules and exemptions may apply.

Washington's My Health My Data Act may require a separate, prominently linked Consumer Health Data Privacy Policy containing only the disclosures required by that Act. If Skin Shop's practices fall within that law, a separate notice will be published and consent/deletion mechanisms will be implemented. This US Supplement is not intended to replace that separate statutory notice.

11. Children

Skin Shop products and customer accounts are intended for adults. We do not knowingly collect personal information directly from children under 13 and do not knowingly sell or share personal information of consumers under 16. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

12. Financial incentives and loyalty programmes

Skin Shop may offer loyalty points, discounts or promotions. If a programme constitutes a financial incentive or bona fide loyalty programme under applicable law, we will provide any required programme-specific notice describing material terms, the personal information involved, how the value is reasonably related to the benefit offered, and how to opt in or withdraw. Participation is voluntary.

13. Changes and contact

We may update this Supplement as laws and our practices change. The current effective date appears above. For questions or requests, use https://support.skinshop.co.uk and mark the message 'US Privacy'.