We engage in these activities to manage our relationship with you, comply with a legal obligation, or provide you with Services / perform a contract with you, where the processing is in our legitimate interest and not overridden by your data protection interests or fundamental rights, or with your consent.

Interacting with Professionals

In addition, we and our service providers collect and use information regarding Professionals.

Such information includes:

• Your preferred language
• Professional biography and education
• Webstore account number and ID
• Data related to your licensures, specialties, affiliations, publications, credentials, and other achievements
• Data related to your use and purchase of our products, your interactions with us, and services for those to whom you provide care

We use Personal Data about Professionals for the following purposes (in addition to the purposes listed under Consumers and the Public), including:

Fulfilling requests related to our Professional Services.

• To pay for services or reimburse expenses.
• To assist in planning trips related to our business or conferences.
• To provide you with the products and samples you have requested.
• To identify and engage with Professionals as scientific experts or professional leaders.
• To enforce the contractual terms and conditions governing our relationship with Professionals.

Engaging with Professionals

• To interact with you based on your professional expertise and opinion by digital or other means.
• To involve you in programs/panels of professionals.
• To reach out to you for your professional expertise, for example, in the context of surveys relating to products or services offered by us or an affiliate.
• To collaborate with you on events, publications, or advisory meetings.
• To seek your views on products and services promoted by us, an affiliate, or business partner for development and improvement purposes.

Allowing Professionals to participate in special programs, events or promotions.

• In these cases, we may use Professionals’ Personal Data in additional ways as disclosed as part of these special programs, activities, events, or promotions.

Allowing Professionals to create a webstore.

• We give Professionals the opportunity to create a webstore to help them provide optimal patient services and convenient access to our products.

Accomplishing our business purposes.

• To comply with anti-corruption and transparency obligations.
• To track and respond to concerns and meet our regulatory monitoring and reporting obligations, including those related to product complaints, product/patient safety, and background checks.
• To better understand how our products and services affect Professionals and their patients.

We engage in these activities to manage our relationship with you, comply with a legal obligation, or provide you with Services / perform a contract with you, where the processing is in our legitimate interest and not overridden by your data protection interests or fundamental rights, or with your consent.

Interacting with Customers

We use Personal Data about Customers for the following purposes (in addition to the purposes listed under Consumers and the Public), including:

Providing the Services and fulfilling your requests.

• To complete your transactions with us.

Accomplishing our business purposes.

• To comply with anti-corruption and transparency obligations.
• To track and respond to concerns and meet our regulatory monitoring and reporting obligations, including those related to product complaints, product/patient safety, and background checks.
• To better understand how our products and services affect Professionals and those for whom they care.

Accomplishing our business purposes.

• To comply with anti-corruption and transparency obligations.
• To track and respond to concerns and meet our regulatory monitoring and reporting obligations, including those related to product complaints, product/patient safety, and background checks.
• To better understand how our products and services affect Professionals and those for whom they care.

We engage in these activities to manage our relationship with you, to comply with a legal obligation, in some circumstances when we have your consent and/or because we have a legitimate business interest.

Incentives for Personal Data

We may offer programs with financial incentives to consumers or Professionals in order to collect their personal information. If you participate in those programs, we will obtain your consent, which can be revoked at any time. Please note revocation of consent may affect your eligibility to participate in those programs.

Disclosure of Personal Data

We disclose Personal Data:

To our subsidiaries and affiliates for the purposes described in this Privacy Policy.

• You can consult the list and location of our subsidiaries or affiliates here.
• The EltaMD subsidiary or affiliate that has collected your Personal Data will be responsible for Personal Data about you that is transferred and used.

To our third party service providers, to facilitate services they provide to us.

• These can include providers of services such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services.

To third parties, to permit them to send you marketing communications, consistent with your choices.

To third-party sponsors of sweepstakes, contests, and similar promotions, consistent with your choices.

In connection with providing our Professional Services to other companies with which we collaborate regarding particular products or services.

• These can include our co-promotion partners for products that we jointly develop and/or market.

By using the Services, you may also elect to disclose Personal Data.

• You may disclose Personal Data on message boards, chat, profile pages, blogs, and other services to which you are able to post data and content (including, without limitation, our Social Media Pages). Please note that any Personal Data you post or disclose through these services will become public and may be available to other users and the general public.
• You may also disclose Personal Data through your social sharing activity. When you connect your Services account with your social media account, you may share data with your friends associated with your social media account, with other users, and with your social media account provider. By doing so, you authorize us to facilitate this sharing of data, and you understand that the use of shared data will be governed by the social media provider’s privacy policy.

We engage in these activities to manage our relationship with you, comply with a legal obligation, or provide you with Services / perform a contract with you, where the processing is in our legitimate interest and not overridden by your data protection interests or fundamental rights, or with your consent.

Other Uses and Disclosures

We also use and disclose your Personal Data as necessary or appropriate:

To comply with applicable law and regulations.

To cooperate with public and government authorities

To cooperate with law enforcement.

To exercise or defend our legal rights, or to protect your vital interest or those of other persons.

In connection with a sale, reorganization, joint venture or other business transaction, where we have a legitimate interest in disclosing or transferring your Personal Data to a third party.

For other legal reasons, such as enforcing our terms and conditions or protecting our rights, privacy, safety, or property, and/or that of our subsidiaries or affiliates, you, or others.

These uses and disclosures of your personal data can occur outside your country of residence.

EltaMD does not sell or exchange your Personal Data for monetary compensation. See below section “Choices and Access” for more information about how EltaMD may share your Personal Data with third parties and the choices you have to restrict or stop such sharing.

OTHER DATA

“Other Data” is any data that on its own does not reveal your specific identity or does not directly relate to an identifiable individual:

• Browser and device data
• App usage data
• Data collected through cookies, pixel tags, and other technologies
• Demographic and other data provided by you that does not reveal your specific identity
• Data that has been aggregated in a manner such that it no longer reveals your specific identity

Some Other Data will be considered Personal Data in some countries. If we are required to treat Other Data as Personal Data under applicable law, then we will use and disclose it for the purposes for which we use and disclose Personal Data, as detailed in this Privacy Policy.

Collection of Other Data

We and our service providers may collect Other Data in a variety of ways, including:

Through your browser or device

• Certain data is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows or Mac), screen resolution, operating system name and version, device manufacturer and model, language, Internet browser type and version, and the name and version of the Services (such as the App) you are using.

Through your use of an App

• When you download and use an App, we and our service providers may track and collect App usage data, such as the date and time the App on your device accesses our servers and what data and files have been downloaded to the App based on your device number.

Using cookies

• Cookies are pieces of data stored directly on the computer that you are using. Cookies allow us to collect data such as browser type, time spent on the Services, pages visited, referring websites, and other traffic data. For more information about cookies, please see our Cookies Policy
• We do not currently respond to browser do-not-track signals. If you do not want data collected through the use of cookies, most browsers allow you to automatically decline cookies or be given the choice of declining or accepting a particular cookie (or cookies) from a particular website. You may also wish to refer to http://www.allaboutcookies.org. If, however, you do not accept cookies, you may experience some inconvenience in your use of the Services. You also may not receive advertising or other offers from us that are relevant to your interests and needs.

Using pixel tags, and other similar technologies

• Pixel tags (also known as web beacons and clear GIFs) may be used to, among other things, track the actions of users of the Services (including email recipients), measure the performance of our marketing campaigns, and compile statistics about usage of the Services and response rates.

Analytics

• We use Google Analytics which uses cookies and similar technologies to collect and analyze data about use of the Services and report on activities and trends. This service may also collect data regarding the use of other websites, apps, and online resources. You can learn about Google’s practices by going to www.google.com/policies/privacy/‌partners/, and opt out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

Using Adobe Flash technology (including Flash Local Shared Objects (“Flash LSOs”)) and other similar technologies

• We may use Flash LSOs and other technologies to, among other things, collect and store data about your use of the Services. If you do not want Flash LSOs stored on your computer, you can adjust the settings of your Flash player to block Flash LSO storage using the tools contained in the Website Storage Settings Panel. You can also go to the Global Storage Settings Panel and follow the instructions. Please note that setting the Flash Player to restrict or limit acceptance of Flash LSOs may reduce or impede the functionality of some Flash applications.

IP Address

• Your IP address is automatically assigned to your computer by your Internet Service Provider. An IP address may be identified and logged automatically in our server log files whenever a user accesses the Services, along with the time of the visit and the page(s) visited. Collecting IP addresses is standard practice and is done automatically by many websites, applications, and other services. We use IP addresses for purposes such as calculating usage levels, diagnosing server problems, and administering the Services. We may also derive your approximate location from your IP address.

Physical Location

• We may collect the physical location of your device by, for example, using satellite, cell phone tower, or Wi-Fi signals. We may use your device’s physical location to provide you with personalized location-based services and content. In some instances, you may be permitted to allow or deny such uses of your device’s location, but, if you do, we may not be able to provide you with the applicable personalized services and content.

Uses and Disclosures of Other Data

We may use and disclose Other Data for any purpose, except where we are required to do otherwise under applicable law. In some instances, we may combine Other Data with Personal Data. If we do, we will treat the combined data as Personal Data as long as it is combined.

SECURITY

We seek to use reasonable organizational, technical, and administrative measures to protect Personal Data within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us by contacting Consumer Affairs.

CHOICES AND ACCESS

Your choices regarding our use and disclosure of your Personal Data

We give you choices regarding our use, sale, and disclosure of your Personal Data for marketing purposes.

You may opt out from:

• Receiving electronic communications from us: If you no longer want to receive marketing-related emails, texts or SMS messages from us, you may opt out by following the instructions contained in each such message or by contacting Consumer Affairs.
• Receiving marketing communications related to our Professional Services: If you use our Professional Services and no longer want to receive marketing communications from us, you may opt-out by contacting Consumer Affairs. In your request, please provide your name and address where you no longer wish to be contacted.
• Our sharing of your Personal Data with subsidiaries or affiliates for their direct marketing purposes: If you would prefer that we discontinue sharing your Personal Data on a going-forward basis with our subsidiaries or affiliates for their direct marketing purposes, you may opt out of this sharing by contacting Consumer Affairs.
• Our sharing of your Personal Data with unaffiliated third parties for their direct marketing purposes: If you would prefer that we discontinue sharing your Personal Data on a going-forward basis with unaffiliated third parties for their direct marketing purposes, you may opt-out of this sharing by contacting Consumer Affairs.
• Opt out of the sale of your Personal Data: EltaMD does not sell or exchange your Personal Data for monetary compensation. However, from time to time, EltaMD may share your Personal Data with third parties for a third party’s own direct benefit including, for example, organizations which we work with to conduct market research. This type of sharing may be considered a “sale” under certain applicable laws. For more information on the type of information we “sell” in this manner, the categories of third parties who receive the information, and to request that we stop engaging in activities that may involve the “sale” of your Personal Data, click the “Do Not Sell My Personal Information” link on our homepage.

We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related communications from us, we may still send you important administrative messages, from which you cannot opt out.

How you can access, change, or delete your Personal Data

If you would like to review, correct, update, suppress, restrict, or delete Personal Data that you have previously provided to us, object to the processing of your data, or if you would like to request to receive an electronic copy of your Personal Data for purposes of transmitting it to another company (to the extent this right to data portability is provided to you by applicable law), you may contact us by contacting Consumer Affairs. We will respond to your request consistent with applicable law.

For your protection, we may only implement requests with respect to the Personal Data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.

Please note that we may need to retain certain data for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion (e.g., when you make a purchase or enter a promotion, you may not be able to change or delete the Personal Data provided until after the completion of such purchase or promotion), or to be able to honor opt-out requests.

RETENTION PERIOD

We retain Personal Data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law and Company policy.

The criteria used to determine our retention periods include:

• The length of time we provide the Services to you (for example, for as long as you have an account with us or keep using the Services);
• The length of time we have an ongoing relationship with you;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); and
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, government investigations or regulatory considerations).

THIRD PARTY SERVICES

This Privacy Policy does not address, and we are not responsible for, the privacy, data, or other practices of any third parties, including any third party operating any website or service to which the Services link. The inclusion of a link on the Services does not imply endorsement of the linked site or service by us or by our subsidiaries or affiliates.

In addition, we are not responsible for the data collection, use, disclosure, or security policies or practices of other organizations or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer, including with respect to any Personal Data you disclose to other organizations through or in connection with the Apps or our Social Media Pages.

OUR ADVERTISING

We use third-party advertising companies to serve advertisements regarding goods and services that may be of interest to you when you access and use the Services and other websites or online services.

Such advertisements are served based on your access to and use of our Services and other websites or online services on any of your devices, as well as on data received from third parties. Third-party advertising companies make this possible by placing or recognizing a unique cookie on your browser (including through the use of pixel tags). They also use these technologies, along with data they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop. If you would like more information about this practice, and to learn how to opt out of it in desktop and mobile browsers on the particular device on which you are accessing this Privacy Policy, please visit http://optout.aboutads.info/#/ and http://optout.networkadvertising.org/#/.

MINORS

Unless otherwise indicated, the Services are not directed to minors as defined by applicable law. For example, in the US, minors are often individuals under the age of 13 but certain states may have different age limits, and in the EEA, we honor Member State laws, and we do not knowingly collect Personal Data from minors. In certain jurisdictions, explicit consent is required prior to collecting personal information from minors. If you provide us with Personal Data of minors, you represent that you have the appropriate authority to do so and that you can demonstrate such authority to us upon request.

JURISDICTION AND CROSS-BORDER TRANSFER

Your Personal Data may be stored and processed in any country where we have facilities or in which we engage service providers, and, by using the Services, you understand that your Personal Data will be transferred to countries outside of your country of residence, to businesses which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your Personal Data.

Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here. For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission, to protect your Personal Data. You may obtain a copy of these measures by clicking here.

SENSITIVE PERSONAL DATA

Unless we specifically request it, we ask that you not send us, and you not disclose, any sensitive Personal Data (e.g., social security numbers, data related to racial or ethnic origin, political opinions, religion or other beliefs, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Services or otherwise to us.

THIRD-PARTY PAYMENT SERVICE

We may use a third-party payment service to process payments made through the Services. If you wish to make a payment through the Services, your Personal Data will be collected by such third party and not by us, and will be subject to the third party’s privacy policy, rather than this Privacy Policy. We have no control over, and are not responsible for, this third party’s collection, use and disclosure of your Personal Data.

UPDATES TO THIS PRIVACY POLICY

The “LAST UPDATED” legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes will become effective when we post the revised Privacy Policy on the Services. Your use of the Services following these changes means that you accept the revised Privacy Policy.

CONTACTING US

Click here to identify the controller responsible for collection, use, and disclosure of your Personal Data under this Privacy Policy.

If you have any questions about this Privacy Policy, please contact Consumer Affairs or:

Colgate-Palmolive Company

300 Park Avenue

New York, NY 10022

United States of America

1-800-468-6502

ADDITIONAL INFORMATION FOR THE EEA

You may lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection law has occurred. A list of data protection authorities is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.