Privacy Policy

Prana6 Privacy Policy Effective Date: March 26, 2026 Last Updated: March 26, 2026 Table of Contents Introduction and Scope Who We Are Personal Information We Collect How We Collect Your Information How We Use Your Information Legal Bases for Processing (GDPR) Sharing and Disclosure of Information Cookies and Tracking Technologies Return and Exchange Policy Product Disclaimers Intellectual Property Data Retention Security of Your Information International Data Transfers Your Privacy Rights Children's Privacy Third-Party Links and Social Features Limitation of Liability Governing Law and Dispute Resolution Changes to This Policy Contact Us 1. Introduction and Scope Welcome to Prana6. This Privacy Policy ("Policy") describes how Prana6 ("Prana6," "we," "our," or "us") collects, uses, discloses, and safeguards your personal information when you interact with our brand. This Policy applies to all touchpoints through which you engage with Prana6, including our website, mobile applications, digital advertising, customer service channels, loyalty programs, promotional events, and any physical boutique or retail location operated by or on behalf of Prana6. As a luxury cosmetic and perfume brand, we are committed to the highest standards of data stewardship. This Policy has been drafted in alignment with the requirements of the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and all other applicable data protection and privacy laws across the jurisdictions in which we operate. By accessing our website, creating an account, purchasing our products, or otherwise engaging with our services, you acknowledge that you have read and understood this Policy. If you do not agree with the terms of this Policy, please refrain from using our services. 2. Who We Are Prana6 is the data controller responsible for the personal information collected through our services. For the purposes of applicable data protection legislation, Prana6 determines the purposes and means by which your personal data is processed. Our contact details are provided in Section 21 of this Policy. 3. Personal Information We Collect The personal information we collect about you varies depending on how you interact with Prana6. The following table provides a comprehensive overview of the categories of personal information we may collect and representative examples of each. Category Examples Personal Identifiers Full name, postal address, email address, telephone number, date of birth, username, account name Payment and Financial Information Credit or debit card numbers, billing address, payment method details, transaction history Commercial and Transactional Data Products purchased, order history, exchange history, loyalty program activity, wish lists, product preferences Digital and Network Activity IP address, MAC address, browser type, operating system, device identifiers, cookie IDs, pages visited, search queries, advertisement interactions Geolocation Data General location derived from IP address; precise GPS coordinates if you grant permission Physical and Beauty Characteristics Skin type, hair color, eye color, fragrance preferences, beauty concerns, skin sensitivities Biometric and Health Data Facial geometry (virtual try-on tools), dermatological data, allergy information, adverse reaction reports Audio and Visual Information Customer service call recordings, CCTV footage at boutiques and events, photographs you upload User-Generated Content Product reviews, ratings, testimonials, social media posts mentioning Prana6, survey responses Demographic Information Age, gender identity, ethnicity (where voluntarily provided) Professional Information Professional credentials in connection with professional or trade programs Inferences and Profiles Beauty and fragrance preference profiles, purchase behavior patterns, personalization data derived from the above categories We collect only the minimum personal information necessary for the purposes described in this Policy. Where we collect sensitive personal information — including biometric data, health information, or precise geolocation — we do so only with your explicit consent or as otherwise permitted by applicable law. 4. How We Collect Your Information Prana6 collects personal information through the following primary channels. Directly from you. We collect information you voluntarily provide when you create an account on our website, place an order, subscribe to our newsletter, register for our loyalty program, contact our customer service team, complete a fragrance profile questionnaire, participate in a contest or promotion, or submit a product review. Automatically through digital technologies. When you visit our website or interact with our digital applications, we automatically collect certain technical and behavioral data through cookies, web beacons, pixel tags, session replay technologies, and similar tracking mechanisms. This automated collection occurs regardless of whether you are logged into an account. From third-party sources. We may receive information about you from trusted third parties, including social media platforms (when you choose to authenticate through a social login), advertising and analytics partners, data enrichment providers, and other Prana6 retail partners. We may also receive information from friends or family members who send you a gift or make a referral on your behalf. Through in-store and event interactions. If you visit a Prana6 boutique or attend a Prana6-sponsored event, we may collect information through CCTV systems, boutique registration cards, or in-person consultations with our fragrance experts. 5. How We Use Your Information Prana6 uses the personal information we collect for the following purposes. Order Fulfillment and Account Management. We use your contact, payment, and transactional data to process and fulfill your orders, manage your account, administer your loyalty program membership, and provide post-purchase support including managing any eligible exchanges under our Discovery Kit program. Customer Service and Communications. We use your information to respond to your inquiries, resolve complaints, and communicate with you about your orders, account activity, and any exchanges you initiate. We may retain records of customer service interactions for quality assurance and training purposes. Marketing and Personalization. With your consent where required by law, we use your purchase history, browsing behavior, and beauty profile to deliver personalized product recommendations, targeted digital advertisements, and promotional communications via email, SMS, push notifications, or postal mail. You may opt out of marketing communications at any time. Analytics and Business Development. We use aggregated and anonymized data to analyze market trends, measure the effectiveness of our marketing campaigns, improve our website and application functionality, and develop new fragrance and cosmetic formulations. We may use artificial intelligence tools to generate insights from this data. Fraud Prevention and Security. We process certain data to detect, investigate, and prevent fraudulent transactions, unauthorized access to accounts, and other harmful or illegal activities. This includes analyzing behavioral signals and device fingerprinting data. Legal Compliance and Regulatory Reporting. We use your information as necessary to comply with applicable laws, regulations, and court orders. In accordance with cosmetic product safety regulations in the EU (Regulation (EC) No 1223/2009) and the US (FDA Modernization of Cosmetics Regulation Act), we use adverse event reports to fulfill our cosmetovigilance and product safety obligations. Competitions, Promotions, and Surveys. We use your information to administer any contests, sweepstakes, surveys, or promotional programs in which you choose to participate. 6. Legal Bases for Processing (GDPR) For individuals in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data only where we have a valid legal basis to do so. The following table summarizes the primary legal bases we rely upon. Processing Purpose Legal Basis Order fulfillment, payment processing, account management Performance of a contract (Article 6(1)(b) GDPR) Sending marketing communications and personalized advertising Consent (Article 6(1)(a) GDPR) Fraud prevention, security, and business analytics Legitimate interests (Article 6(1)(f) GDPR) Compliance with legal obligations (tax, cosmetovigilance) Legal obligation (Article 6(1)(c) GDPR) Processing biometric or health data Explicit consent (Article 9(2)(a) GDPR) Responding to adverse event reports Public interest in public health (Article 9(2)(i) GDPR) Where we rely on legitimate interests as our legal basis, we have conducted a balancing test to confirm that our interests do not override your fundamental rights and freedoms. You may request information about these assessments by contacting our Data Protection Officer. 7. Sharing and Disclosure of Information Prana6 does not sell your personal information to third parties for their own independent commercial purposes. We share your data only in the circumstances described below, and always subject to appropriate contractual safeguards. Within the Prana6 Corporate Group. We may share your personal information among Prana6 affiliates and subsidiaries to provide a seamless brand experience, administer our loyalty programs, and conduct consolidated business analytics. Service Providers. We engage carefully vetted third-party service providers who process personal data on our behalf under strict data processing agreements. These providers include payment processors, logistics and fulfillment partners, cloud hosting providers, customer relationship management platforms, email marketing services, and digital advertising networks. These entities are contractually prohibited from using your data for any purpose beyond the specific services they provide to Prana6. Advertising and Analytics Partners. We work with third-party advertising networks and analytics providers, including Google Analytics and social media advertising platforms, to measure the performance of our marketing campaigns and deliver relevant advertisements. These partners may collect data through cookies and similar technologies on our website, subject to their own privacy policies. Legal and Regulatory Authorities. We may disclose your personal information to governmental authorities, law enforcement agencies, courts, or regulatory bodies when required to do so by applicable law, legal process, or government request, or when we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Prana6, our customers, or the public. Business Transfers. In the event of a merger, acquisition, restructuring, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring or successor entity. We will provide notice of any such transfer and the choices available to you. Professional Advisors. We may share information with our legal counsel, accountants, auditors, and other professional advisors under obligations of confidentiality for the purposes of obtaining professional advice or managing legal proceedings. 8. Cookies and Tracking Technologies Prana6 uses cookies and similar tracking technologies on our digital platforms to enhance your browsing experience, measure website performance, and deliver relevant advertising. The following table describes the categories of cookies we deploy. Cookie Type Purpose Consent Required Strictly Necessary Essential for website operation, secure checkout, and fraud prevention No Performance / Analytics Measure traffic, user behavior, and website performance (e.g., Google Analytics) Yes Functional Remember your preferences, language settings, and currency choices Yes Targeting / Advertising Build interest profiles and deliver personalized Prana6 advertisements on third-party platforms Yes When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. You may change your cookie preferences at any time using the "Manage Cookie Preferences" link in the footer of our website. Please note that disabling certain cookies may affect the functionality of our website. Our website does not currently respond to browser "Do Not Track" signals. However, you may opt out of interest-based advertising by visiting the Network Advertising Initiative opt-out page or the Digital Advertising Alliance opt-out portal. 9. Return and Exchange Policy At Prana6, every product is crafted with exceptional care and formulated to the highest standards of quality. In accordance with applicable health, safety, and hygiene regulations governing cosmetic and fragrance products, and given the intimate nature of personal care items, all sales made through Prana6 are strictly final. We do not accept returns, and we do not issue refunds under any circumstances. This policy exists to protect the health and safety of all our customers, to maintain the integrity of our product inventory, and to comply with regulatory requirements applicable to opened cosmetic and fragrance products. Discovery Kit Exchange Program — Exclusive Exception Prana6 recognizes that discovering your signature fragrance is a deeply personal and exploratory experience. In recognition of this, we offer an exclusive exchange privilege for customers who purchase the Prana6 Discovery Kit. Under this program, a Discovery Kit purchaser may exchange up to two (2) perfumes from their Discovery Kit for alternative fragrances from the Prana6 collection. The following conditions govern the Discovery Kit Exchange Program: Eligibility. The exchange privilege is available exclusively to customers who have purchased an official Prana6 Discovery Kit directly from Prana6 or an authorized Prana6 retailer. Exchange Limit. Each Discovery Kit purchase entitles the customer to a maximum of two (2) fragrance exchanges in total. This limit is non-transferable and cannot be combined with other promotions or offers. Time Limit. Exchange requests must be submitted within thirty (30) calendar days of the confirmed delivery date of the Discovery Kit. Proof of Purchase. A valid proof of purchase (order confirmation number or receipt) is required to initiate an exchange. Product Condition. Exchange items must be returned in accordance with the instructions provided by our customer service team. Prana6 reserves the right to inspect returned sample vials prior to dispatching replacement fragrances. Availability. Exchanges are subject to product availability. Prana6 does not guarantee the availability of any specific fragrance and reserves the right to offer an alternative of equal or greater value if the requested fragrance is out of stock. Non-Transferability. The exchange privilege is personal to the original purchaser and may not be transferred, gifted, or sold to any third party. Final Sale on Exchanges. Fragrances received as part of an exchange are final sale and are not eligible for further exchange or return. Prana6 reserves the right to modify, suspend, or terminate the Discovery Kit Exchange Program at any time and to deny exchange requests that do not comply with the conditions set forth above. 10. Product Disclaimers Prana6 formulates its cosmetic and fragrance products using carefully selected, premium-grade ingredients. However, individual physiological responses to cosmetic and fragrance ingredients can vary significantly. Prana6 strongly advises all customers to carefully review the full ingredient list of each product prior to use and to perform a patch test on a small area of skin before full application. This is particularly important for individuals with known skin sensitivities, allergies, or dermatological conditions. Prana6 explicitly disclaims any liability for adverse allergic reactions, skin irritation, sensitization, or other adverse effects arising from the use of our products, except to the extent that such liability cannot be excluded under applicable law. If you experience an adverse reaction, discontinue use immediately and consult a qualified medical professional. Our products are cosmetic in nature and are regulated as cosmetics under applicable law. They are not intended to diagnose, treat, cure, or prevent any disease or medical condition. Any statements made regarding the benefits of our products have not been evaluated by the Food and Drug Administration (FDA) or equivalent regulatory authorities in other jurisdictions, unless explicitly stated otherwise. 11. Intellectual Property All content available through the Prana6 website, applications, and marketing materials — including but not limited to text, graphics, logos, trademarks, trade names, service marks, button icons, images, audio clips, digital downloads, data compilations, fragrance formulations, and software — is the exclusive intellectual property of Prana6 or its licensed content suppliers and is protected by applicable copyright, trademark, patent, trade secret, and other intellectual property laws. The Prana6 name, logo, and all related marks are registered or unregistered trademarks of Prana6. No license to use any Prana6 intellectual property is granted by virtue of accessing our website or purchasing our products. Any unauthorized reproduction, modification, distribution, public display, public performance, or commercial exploitation of Prana6 intellectual property is strictly prohibited and will subject the infringing party to civil and criminal liability to the fullest extent permitted by law. 12. Data Retention Prana6 retains your personal information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, as described in this Policy, unless a longer retention period is required or expressly permitted by applicable law. The following general principles govern our retention practices. Transactional and account data is retained for the duration of your account's active status and for a period of up to seven (7) years thereafter to comply with tax, accounting, and financial reporting obligations. Marketing data is retained until you withdraw your consent or opt out of marketing communications. Data collected in connection with legal proceedings or regulatory investigations is retained for the duration of those proceedings and for the applicable statute of limitations period thereafter. Upon the expiration of the applicable retention period, we will securely delete, destroy, or anonymize your personal information. Where anonymization is employed, the resulting data is no longer personal data and may be retained and used indefinitely for analytical and business improvement purposes. 13. Security of Your Information Prana6 takes the security of your personal information extremely seriously. We implement a comprehensive suite of technical, organizational, and physical security measures designed to protect your data against unauthorized access, disclosure, alteration, loss, or destruction. Our security infrastructure includes industry-standard Transport Layer Security (TLS) encryption for all data transmitted between your device and our servers, encryption of sensitive data at rest, role-based access controls limiting data access to authorized personnel on a need-to-know basis, regular penetration testing and vulnerability assessments, and documented incident response procedures. Notwithstanding the foregoing, no method of electronic transmission or storage is entirely secure. Prana6 cannot guarantee the absolute security of your personal information, and any transmission of data to our website is undertaken at your own risk. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities in accordance with our obligations under applicable law. 14. International Data Transfers Prana6 is a global brand, and the personal information we collect may be transferred to, stored in, and processed in countries other than the country in which you reside, including the United States. The data protection laws of these countries may differ from, and in some cases may be less protective than, the laws of your home jurisdiction. When we transfer personal data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland to a third country that has not been deemed to provide an adequate level of data protection by the European Commission or the UK Information Commissioner's Office, we implement appropriate safeguards to ensure that your personal data remains protected to the standard required by applicable law. These safeguards include the use of Standard Contractual Clauses (SCCs) approved by the European Commission, Binding Corporate Rules, or other legally recognized transfer mechanisms. By using our services, you acknowledge and consent to the transfer of your personal information to countries outside of your own, including to the United States, subject to the safeguards described in this Policy. 15. Your Privacy Rights Prana6 is committed to respecting and facilitating the exercise of your privacy rights. The specific rights available to you depend on your jurisdiction of residence. Rights Under the GDPR (EEA, UK, and Switzerland) If you are located in the EEA, the UK, or Switzerland, you have the following rights with respect to your personal data, subject to applicable legal exceptions. The right of access entitles you to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with supplementary information about our processing activities. The right to rectification allows you to request the correction of inaccurate or incomplete personal data we hold about you. The right to erasure (the "right to be forgotten") permits you to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected. The right to restriction of processing enables you to request that we limit the processing of your data in specific situations. The right to data portability allows you to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller. The right to object permits you to object at any time to the processing of your personal data for direct marketing purposes or where we rely on legitimate interests as our legal basis. You also have rights in relation to automated decision-making and profiling, including the right not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects on you. Rights Under the CCPA/CPRA (California Residents) California residents have the right to know the categories and specific pieces of personal information we have collected about them, the categories of sources from which we collected it, the business or commercial purposes for collecting or sharing it, and the categories of third parties with whom we share it. You have the right to request the deletion of your personal information, subject to certain exceptions. You have the right to correct inaccurate personal information. You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. You have the right to limit our use and disclosure of your sensitive personal information to that which is necessary to perform the services you have requested. You have the right to be free from unlawful discrimination for exercising any of your CCPA/CPRA rights. Rights Under Other US State Privacy Laws Residents of Virginia, Colorado, Connecticut, Texas, and other states with applicable consumer privacy legislation may have similar rights to those described above. We will honor all valid privacy rights requests from residents of any US state with applicable privacy legislation. How to Exercise Your Rights To exercise any of the rights described in this section, please submit a verifiable request to our Privacy Office using the contact information provided in Section 21. We will verify your identity before processing your request to protect against unauthorized disclosure. We will respond to your request within the timeframe required by applicable law (generally within 30 days for GDPR requests and 45 days for CCPA requests, with possible extensions). We do not charge a fee for processing your request unless it is manifestly unfounded or excessive. If you are located in the EEA or the UK and you believe that our processing of your personal data violates applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence. 16. Children's Privacy The products and digital services of Prana6 are intended for adults and are not directed at children. We do not knowingly collect, solicit, maintain, or process personal information from individuals under the age of sixteen (16) years without the prior, verifiable consent of a parent or legal guardian. In jurisdictions where a higher age threshold applies, we comply with the applicable local requirement. If we become aware that we have inadvertently collected personal information from a child under the applicable age threshold without appropriate parental consent, we will take prompt and reasonable steps to delete such information from our systems. If you are a parent or guardian and believe that your child has provided personal information to Prana6 without your consent, please contact us immediately using the information in Section 21. 17. Third-Party Links and Social Features Our website and marketing materials may contain links to third-party websites, social media platforms, and other online services that are not operated or controlled by Prana6. This Policy does not apply to those third-party services, and we are not responsible for the privacy practices, content, or security of any external website or platform. We encourage you to review the privacy policies of any third-party services you visit. Our website may also include social media features, such as "Share" buttons or embedded social media feeds. These features may collect your IP address and the page you are visiting, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the social media company providing them. 18. Limitation of Liability To the fullest extent permitted by applicable law, Prana6 shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising out of or related to your use of our services, your reliance on any information provided through our services, or any unauthorized access to or alteration of your personal information, even if Prana6 has been advised of the possibility of such damages. Prana6's total liability to you for any claim arising out of or related to this Policy or our data processing activities shall not exceed the greater of (a) the amount you paid to Prana6 in the twelve (12) months preceding the claim, or (b) one hundred US dollars (USD $100.00). Nothing in this Policy limits our liability where such limitation is prohibited by applicable law, including liability for death or personal injury caused by our negligence or for fraudulent misrepresentation. 19. Governing Law and Dispute Resolution This Policy and any disputes arising out of or related to our data processing practices shall be governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of law provisions, except to the extent that mandatory provisions of applicable data protection law in your jurisdiction require otherwise. Any dispute, claim, or controversy arising out of or relating to this Policy that cannot be resolved informally shall be submitted to binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules. You and Prana6 each waive the right to a jury trial and the right to participate in a class action, class arbitration, or representative proceeding. This arbitration provision does not apply to residents of the EEA or the UK, who retain the right to bring claims before the courts of their country of residence or before the relevant supervisory authority. 20. Changes to This Policy Prana6 reserves the right to update, amend, or modify this Privacy Policy at any time to reflect changes in our data processing practices, technological developments, or applicable legal requirements. We will revise the "Last Updated" date at the top of this document whenever material changes are made. For changes that materially affect your rights or our use of your personal information, we will provide prominent notice on our website and, where we have your contact information, via email prior to the changes taking effect. Your continued use of our services following the effective date of any changes constitutes your acceptance of the revised Policy. 21. Contact Us If you have any questions, concerns, or requests regarding this Privacy Policy, our data processing activities, or if you wish to exercise any of your privacy rights, please contact our dedicated Privacy Office. Prana6 Privacy Office Contact Method Details Email privacy@prana6.com EU Data Protection Inquiries eudataprotection@prana6.com Mailing Address Prana6 Legal & Privacy Department, 100 Luxury Avenue, Suite 500, New York, NY 10001, United States For customers located in the European Union, our EU Representative can be reached at the EU data protection email address above. For customers located in the United Kingdom, our UK Representative can be reached at the same address. If you are not satisfied with our response to your privacy inquiry, you have the right to lodge a complaint with the relevant data protection supervisory authority in your country of residence. In the EU, a list of national supervisory authorities is available on the European Data Protection Board website. In the UK, the relevant authority is the Information Commissioner's Office (ICO) at ico.org.uk. This Privacy Policy was prepared by the Prana6 Legal and Privacy Team and is effective as of March 26, 2026. Prana6 — The Essence of Protected Luxury.