Supplemental Privacy Policy | COCOJOJO

Supplemental privacy disclosures covering additional rights, incentives, international transfers, automated processing, and related privacy practices.

1. Notice of Financial Incentive

This section is provided pursuant to Cal. Civ. Code Section 1798.125(b) and 11 CCR Section 7016. COCO JOJO LLC may offer programs, discounts, rewards, loyalty benefits, wholesale account benefits, referral rewards, or other incentives that may be considered "financial incentives" under the CCPA/CPRA because they involve the collection, retention, or use of personal information.

1.1 Programs That May Constitute Financial Incentives

Email or SMS sign-up discounts (e.g., a percentage off a first order in exchange for an email address)
Loyalty, rewards, or VIP programs
Referral and affiliate reward programs
Wholesale, trade, or professional account pricing tied to account registration
Promotional offers requiring submission of personal information

1.2 Material Terms

Participation in any such program is entirely voluntary, requires your opt-in, and you may withdraw at any time by contacting us at the address in Section 7 or by following the unsubscribe or cancellation instructions provided with the program. The personal information collected typically includes identifiers (such as name, email address, phone number, and purchase history). We use this information to administer the program, communicate with you, and personalize offers.

1.3 Good-Faith Estimate of Value

The CCPA/CPRA requires a good-faith estimate of the value of the consumer data that forms the basis of any financial incentive, and a description of the method used to calculate that value. COCO JOJO LLC reasonably and in good faith estimates that the value of the personal information provided in connection with these programs is approximately equal to the value of the discount, reward, or benefit offered. We calculate this value based on the expense reasonably related to offering the incentive (including the monetary cost of discounts and rewards) measured against the value to our business of the personal information collected. We do not assign a distinct dollar value to any individual element of personal information; the estimate reflects the aggregate value of the program to the business and the consumer.

Any difference in price, rate, level, or quality of goods or services offered through these programs is reasonably related to the value provided to COCO JOJO LLC by the consumer's personal information. We do not use financial incentives to discriminate against consumers who exercise their privacy rights.

2. Cosmetovigilance and Adverse Event Reporting (MoCRA)

As a cosmetics manufacturer subject to the federal Modernization of Cosmetics Regulation Act of 2022 ("MoCRA"), COCO JOJO LLC maintains a cosmetovigilance program for the collection, evaluation, recordkeeping, and - where applicable - reporting of adverse events associated with cosmetic products.

2.1 Information We Collect for Cosmetovigilance

If you voluntarily report an adverse reaction, product complaint, sensitivity, or undesirable side effect, we may collect: your contact information; a description of the reaction or complaint; the product and batch or lot number; the date and circumstances of use; and any photographs, images, or health-related information you choose to provide. Some of this information may constitute sensitive personal information under the CCPA/CPRA.

2.2 How We Use Cosmetovigilance Information

We use this information solely to evaluate product safety, investigate complaints, maintain adverse-event records as required by MoCRA, fulfill quality-assurance and regulatory obligations, and, where legally required, report serious adverse events to the U.S. Food and Drug Administration ("FDA") or other applicable health authorities. Consistent with 11 CCR Section 7027, we do not use this sensitive personal information to infer characteristics about you. We retain adverse-event records for the period required by MoCRA and applicable law (generally a minimum of six years, and three years for small businesses, where applicable).

2.3 Disclosure for Safety and Regulatory Purposes

We may disclose adverse-event information to the FDA, other health or regulatory authorities, our quality and safety personnel, contract manufacturers, suppliers, insurers, and legal advisors, in each case to the extent necessary for product safety evaluation, regulatory compliance, or legal purposes.

3. Legal Bases for Processing, by Activity

For users in jurisdictions requiring a legal basis for processing (such as the EEA, UK, and Switzerland), the following table maps our principal processing activities to their legal bases under Article 6 GDPR and analogous laws. This supplements the general legal-basis disclosure in the Privacy Policy.

Processing Activity	Legal Basis
Processing and fulfilling orders, managing accounts	Performance of a contract (Art. 6(1)(b))
Processing payments and evaluating Net-30 credit	Contract performance and legitimate interests (Art. 6(1)(b), (f))
Tax, accounting, and regulatory recordkeeping	Legal obligation (Art. 6(1)(c))
Cosmetovigilance and adverse-event reporting	Legal obligation and vital interests (Art. 6(1)(c), (d))
Fraud prevention, security, and IT protection	Legitimate interests (Art. 6(1)(f))
Marketing emails and SMS	Consent, or legitimate interests where permitted (Art. 6(1)(a), (f))
Advertising cookies and cross-context behavioral advertising	Consent (Art. 6(1)(a))
Product and service improvement, analytics	Legitimate interests (Art. 6(1)(f))
Processing sensitive personal information	Consent or as necessary for the requested service / legal compliance (Art. 9(2))

4. Profiling, Automated Processing, and Targeted Advertising

4.1 What Profiling Means

For transparency, "profiling" means any form of automated processing of personal information used to evaluate, analyze, or predict aspects concerning a person, such as their preferences, interests, behavior, location, or purchasing habits. COCO JOJO LLC may use profiling techniques to personalize content, recommend products, build audience segments, and deliver relevant marketing.

4.2 Your Right to Opt Out of Profiling for Advertising

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and to opt out of the use of your personal information for cross-context behavioral advertising. You may exercise these rights using the opt-out methods in Section 11.5 of the Privacy Policy, by emailing us, or by transmitting a Global Privacy Control signal.

4.3 Targeted Advertising via Email (Separate from Cookies)

Separately from cookie-based advertising, if you have provided your email address, we may use it (in hashed or other non-cookie form) to deliver targeted advertising of COCO JOJO products on third-party platforms such as social media and search engines. This email-based advertising opt-out is separate from the cookie opt-out. To opt out of email-based targeted advertising, email us at the address in Section 7 with the subject line "Opt Out of Email-Based Advertising." Opting out of cookies alone does not opt you out of email-based advertising, and vice versa.

5. Recognized Opt-Out Preference Signals

COCO JOJO LLC honors opt-out preference signals that we recognize as valid. A signal is considered valid where: (1) it is transmitted in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object; and (2) the platform, technology, or mechanism sending the signal makes clear to the consumer that its use is intended to opt the consumer out of the sale and sharing of personal information. At present, we recognize and process the Global Privacy Control ("GPC") signal as a valid opt-out preference signal for California residents, consistent with Cal. Civ. Code Section 1798.135(b) and 11 CCR Section 7025.

6. California Job Applicant and Candidate Privacy Notice

This section applies to California residents who apply for employment, internships, or contractor engagements with COCO JOJO LLC ("Candidates"), and is provided pursuant to the CCPA/CPRA.

6.1 Categories of Personal Information Collected from Candidates

Contact information (name, address, email, phone, signature)
Government identifiers where legally required (e.g., for I-9 / work authorization)
Professional and employment history, certifications, and references
Education information
Information you voluntarily provide regarding accommodation needs
Inferences and assessments drawn from application materials
Publicly available professional and social-media information

6.2 How We Use Candidate Information

We use Candidate personal information to evaluate candidacy, administer the application and hiring process, conduct background and reference checks where permitted, comply with legal obligations (such as work-authorization verification), protect against fraud and security incidents, and establish or defend legal claims.

6.3 Candidate Rights and No Sale or Sharing

Candidates have the rights to know, access, correct, and delete personal information, and the right to non-discrimination, subject to exceptions under the CCPA/CPRA. COCO JOJO LLC does not "sell" or "share" Candidate personal information for cross-context behavioral advertising, and does not use Candidate sensitive personal information except for the purposes permitted under 11 CCR Section 7027. We retain unsuccessful applicant data for two (2) years from the application date, and records of hired individuals for the duration of engagement plus seven (7) years.

7. Virtual Try-On, Image, and AI Skin-Analysis Technologies

To the extent COCO JOJO LLC offers (now or in the future) virtual try-on, shade-matching, AI skin-analysis, or similar image-based technologies, the following applies. Photographs or images you submit for such features are used solely to provide the requested feature. Where such technology is operated by a third-party vendor, image processing may be performed by the vendor under contract, and COCO JOJO LLC may not retain the underlying images after your session ends. Where COCO JOJO LLC retains such images, they are stored only for the limited period necessary to provide the feature and are then deleted or anonymized. We do not use facial geometry or similar data to identify you, and we do not sell or share such images. If any such feature would collect biometric information as defined by applicable law, we will provide a separate notice and obtain any consent required before collection.

8. How to Contact Us and Exercise Rights

All rights described in this Supplement may be exercised using the methods in Sections 11.2 and 30 of the Privacy Policy. For consistency across all COCO JOJO LLC policies, privacy requests, opt-outs, and questions about this Supplement may be directed to:

Company	COCO JOJO LLC
Privacy Requests	support@cocojojo.com (subject line: "Privacy Request - [Right]")
Mailing Address
Website	www.COCOJOJO.com

Note on contact email: To maintain consistency across the COCO JOJO LLC policy suite, privacy requests and related questions are directed to support@cocojojo.com.