Last updated: October 2026

Privacy Notice

This Privacy Notice (the "Notice") describes how Jemella Limited trading as ghd (“ghd”, “we”, “us”), an affiliate of Wella Company International Operations Switzerland S.à.r.l. (along with its other subsidiaries and affiliates, "Wella Company") collects and uses personal data (as defined below) when you visit our website (ghd Official Website) (the "Site") or otherwise interact with us online or in person. This Notice does not explain how we process personal data for recruitment purposes; please see our Global Applicant Privacy Notice here instead.

For the purposes of applicable data protection laws, the primary "data controller" is Jemella Limited.

About this Notice

ghd provides beauty products and services (our "Products and Services") to consumers and professionals (our “customers”). In addition to our customers, we process personal data about people who visit the Site, attend our sites, events and tradeshows, as well as people who engage with us across our social media accounts (collectively, “you”).

When we say “personal data” under this Notice we mean any information that can identify you (or could reasonably identify you), either on its own or when combined with other details.

Unless otherwise defined in this Notice, capitalized terms used in this Notice have the same meaning as in our Terms of Use. Depending on your location, how you interact with us, or the features you use, additional notices, terms or jurisdiction‑specific rules may also apply; in which case you will be presented with those terms or notices prior to disclosing personal data with us. Where there is any inconsistency, those specific notices will take precedence for their respective context. We recommend you review any applicable privacy notices provided to you prior to disclosing any personal data with us.

Governing Laws

We are committed to maintaining high standards of data protection when we process personal data. This Notice provides a global overview of our approach to processing personal data and how we use it in accordance with data privacy laws across the main regions, including, for example, the EU / UK General Data Protection Regulation (known as the “GDPR”) and any other local privacy laws applicable to the relevant jurisdiction in which we process personal data and where you are based.

For residents of the following jurisdictions, this Notice should therefore be read in conjunction with the relevant Annex listed below which covers supplementary information.

Australia – Annex A
Canada – Annex B
India – Annex C
Kingdom of Saudi Arabia – Annex D
New Zealand – Annex E
Turkey – Annex F
United States – Annex G

If your jurisdiction is not listed above, and you believe our Notice does not otherwise cover mandatory information for your jurisdiction elsewhere in the Notice, please contact us using our contact details below.

To help you find information quickly on any question you might have, we have set out an index below.

What categories of personal data does ghd collect about me and how is it used?. 2

Who will ghd share my personal data with?. 16

What happens if ghd transfers my personal data outside its original country?. 17

How long will ghd keep my personal data for?. 17

How does ghd use AI and other automated decision-making technologies to process my personal data?. 18

What rights do I have in respect of my personal data?. 18

How do I stop receiving marketing communications?. 20

How old do I have to be to use the Site?. 20

How does ghd protect my information?. 20

What about the terms of other sites which are linked to the Site?. 20

Who can I contact about data privacy?. 21

How do you update this Notice?. 21

What categories of personal data does ghd collect about me and how is it used?

We have set out below the ways in which you might interact with ghd, the information we process about you and why we need it. We have also included the relevant legal reason for each processing activity (called a “lawful basis”) for each way that we use it. Please use the links to take you to the scenario most appropriate to you.

We use AI and other automated decision-making technologies to process personal data you provide, and which is collected from your use of this site. We use this personal data to provide, personalize, market, and improve our services and our Notice explains what personal data we use and our lawful basis for using it. If AI is used to make automated decisions about you our Notice sets out how you can exercise your privacy rights.

Note that one lawful basis described below is “legitimate interests” that is applicable in certain jurisdictions. Relying on this lawful basis mean that we use your information in ways that are necessary for our business to operate effectively and deliver a high‑quality experience. This includes uses such as:

Providing and improving our onsite and online services, including managing any accounts you create on the Site.
Processing and fulfilling product purchases, whether made in store or online, including arranging delivery and providing customer support.
Running and improving our business operations, such as organising events and trade shows, and delivering in‑person or virtual demonstrations.
Keeping you informed about your bookings, orders and service updates, including appointment reminders, order confirmations, and changes to your booking.
Supporting our business‑to‑business (“B2B”) relationships, such as onboarding your company as a customer or vendor and inviting you to relevant business events.
Protecting the security and integrity of the Site, including preventing fraud, misuse or unauthorised access.
Maintaining accurate internal records, including for administration, accounting and operational management.
Sending you relevant updates or offers, based on services you’ve used or products you have purchased (you can opt out at any time – see more here).
Understanding how the Site and Products and Services are used, so we can fix issues, improve the experience and make our digital and in‑person services easier to navigate.

You may not always be required to share the below information, however if you do not provide certain information, we may not be able to provide you with our Products and Services.

(a) If you are a customer purchasing our Products and Services

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To set up your account with us or on the Site and enable you to access our Products and Services.	First name, last name, email address, billing and/or delivery address, date of birth, phone number, and country of residence, and your account details such as your username, password, and your answers to security questions.	Our legitimate interests.
To process transactions and fulfil orders which you have placed, including purchases of our Products and Services.	First name, last name, email address, billing and/or delivery address, phone number, country of residence, and information about your purchases.	Processing your data is necessary for us to deliver the Products and Services you have agreed to receive under a contract with us.
To process your payments and orders (where we may use our payment service providers for orders made online) or manage orders.	First name, last name, email address, billing and/or delivery address, phone number, gender, and country of residence, information about the purchases you made, credit/debit card details, delivery address, and the date and time of the purchase.	Processing your data is necessary for us to deliver the Products and Services you have agreed to receive under a contract with us.
To recognise returning visitors across browsing sessions using device recognition and identity matching (Contact Match). ghd uses Wunderkind to identify a visitor's device through device fingerprinting, based on technical characteristics such as browser type, operating system, IP address and device model, rather than relying solely on cookies. If you give access consent through our Privacy Preference Center or cookie banner, Wunderkind collects these characteristics and assigns a pseudonymous identifier to your device. This identifier may be checked against Wunderkind's Identity Network, a cross-client technology platform that stores associations between pseudonymous device identifiers and hashed contact identifiers, to determine whether you are already a known subscriber on ghd’s marketing list. If there is a match, and you have separately given marketing consent, we may send triggered marketing email or text message based on your on-site activity (such as cart addition, product page view or category page view). This includes both behavioural deployments (triggered by a recipient’s most recent high-intent action, such as cart addition, product page view or category page view) and on-demand segment-based deployments. Wunderkind operates the Identity Network as an independent data controller and retains ownership of the network and its proprietary identifiers. Your first-party data is not accessed by or transferred to other participants in the Identity Network, and any disclosures of data connected with the network are limited to information that is aggregated, anonymised or does not individually identify you or ghd.	IP address, user agent string, network and browser data, URL context, browsing and shopping behaviour, segment/customer-state data, and online identifiers (including cookies, device IDs and Wunderkind IDs (BXID)).	Your consent (access consent via our Privacy Preference Center, aligned with the GDPR position). Marketing emails or text messages are sent only where you have separately given marketing consent.
To capture information entered into forms on the Site before you press submit (Field Mapping). Wunderkind may use this information to identify returning visitors and, if you have separately given marketing consent, to send relevant marketing messages. This data capture only occurs after you have given consent via our cookie banner.	Information entered into forms on the Site, such as an email address or phone number during checkout or sign-up.	Your consent (access consent via our Privacy Preference Center or cookie banner). Marketing messages are sent only where you have separately given marketing consent.

(b) To assist you with any queries or respond to your questions for customer service purposes

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To allow you to interact with our online chatbot and/or customer service teams regarding your account and transactions so we can provide adequate customer services.	Account details such as your username, email address, any correspondence you have with us, and your answers to security questions.	Our legitimate interests.
To contact you directly, or to enable our third party providers to contact you, about customer services, including to respond to your queries about our Products and Services and/or the status of your transaction.	First name, last name, email address, billing and/or delivery address, phone number, account details including your username, and information about the purchases you made, as well as any correspondence with us, and any emails, texts and other digital messaging, phone, audio or video calls, and any online or offline conversations you have with us, including via our chatbots or customer service teams.	Our legitimate interests.
To contact you directly, or to enable our third party providers to contact you, to provide you with adequate customer service in case you have a medical issue related to our Products and Services.	Account details including first name, last name, email address, phone number, username, and information about the purchases you made; any correspondence with us, and any emails, texts and other digital messaging, phone, audio or video calls, and any online or offline conversations you have with us, including via our chatbots or customer service teams; as well as information about potential medical conditions you may have through our consultations (which may be via our online tools), or through our customer service teams, including data relating to your hair or skin/scalp health, or medical issues.	Our legitimate interest for non-sensitive information (such as account details), and our legal obligations (for example, to ensure we comply with consumer and health and safety regulations) for processing of sensitive information (such as health data).
To contact you directly, or to enable our third party providers to contact you, regarding technical issues, including to assist with troubleshoot or IT problems on the Site.	First name, last name, email address, phone number, account details including your username, and information about the purchases you made; any correspondence with us, and any emails, texts and other digital messaging, phone, audio or video calls, and any online or offline conversations you have with us, including via our chatbots or customer service teams; as well as device and technical information such as IP address, device type, operating system, browser type and version, unique identifiers such as cookie IDs or session IDs, diagnostic log data (such as timestamps, error codes, and request identifiers), and similar information generated by your device or browser when interacting with the Site.	Our legitimate interests.
To provide you with service-related communications including technical and other service updates (for example, changes to our terms and conditions, updates affecting service functionality). This does not include marketing communications.	First name, last name, email address, account details, such as your username and any subscriptions you may have, billing and/or delivery address, phone number, and any related correspondence with us.	Processing your data is necessary for us to deliver the Products and Services you have agreed to receive under a contract with us.

(c) To promote our Products and Services

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To promote and offer Products and Services in accordance with your preferences, and/or to contact you about a promotion, competition, or survey via email marketing campaigns.	First and last name, email address, and phone number(s) (associated with your account and/or which you call our customer service teams on), postal address, company role/title, company name and address, sector/industry; demographic and, where relevant, information relating to your past purchases or account in accordance with local marketing rules.	Our legitimate interests (or where legally required, your consent).
To promote or display adverts or content that may be more relevant to you based on your general location, for example by showing campaigns, offers or events available in your area.	Location data, such as your approximate geographic location (e.g., country, city‑level or region‑level), derived from your IP address or device/browser settings; as well as technical and browsing data related to how you interact with the Site, where required to determine and apply location‑based advertising preferences. Where you visit the Site anonymously and/ or visit the Site using your browser’s private or incognito mode we may verify whether we know you by checking whether the device ID you are using to visit the Site matches the device ID information we already hold (and we can link it to the records we hold on you) as well as recognising the manner in which the Site is used (i.e. how you behave on the Site). We do this so that if you are already known to us, we can check whether you have given your consent to receive marketing.	Our legitimate interests (or, where required by law, your consent). We will only use device ID and website usage matching to verify you and your device are already known to us if you have given us your consent to do this. We do this through our cookies consent platform. Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To contact you about a promotion, competition, or survey via our social media accounts.	Information about your social media handle used to contact ghd through our social media accounts, our customer services or consumer affairs teams.	Our legitimate interests (or where legally required, your consent).
To tailor promotions and educational offerings to profiles.	Data relating to your account details, such as transactions, consumer behaviour, browsing and purchasing history, demographic information (e.g., age range, gender, where applicable), and job title and employer, professional qualifications, membership of professional bodies, education and certification.	Our legitimate interests.
Where applicable, to determine member level points and offer member rewards, as well as tailoring promotions and educational offerings to profiles.	Data relating to your account details, such as username and membership level, and transactions, consumer behaviour, browsing and purchasing history, demographic information (e.g., age range, gender, where applicable), and job title and employer, professional qualifications, membership of professional bodies, education and certification.	Our legitimate interests.
To monitor your activity and engagement with our Products and Services to understand usage trends, improve customer retention, and enhance overall user experience.	Data relating to your account details, such as username and membership level, and transactions, consumer behaviour, browsing and purchasing history, demographic information (e.g., age range, gender, where applicable) job title and employer, professional qualifications, membership of professional bodies, education and certification, as well as data contained in your communications with us (e.g., customer service interactions, chatbot conversations) and technical and device information (e.g., IP address, device type, browser type, cookie IDs or session IDs, diagnostic log data). Where you visit the Site anonymously and/ or visit the Site using your browser’s private or incognito mode we may verify whether we know you by checking whether the device ID you are using to visit the Site matches the device ID information we already hold (and we can link it to the records we hold on you) as well as recognising the manner in which the Site is used (i.e. how you behave on the Site). We do this so that if you are already known to us, we can check whether you have given your consent to receive marketing.	Our legitimate interests (or, where required by law, your consent). We will only use device ID and website usage matching to verify you and your device are already known to us if you have given us your consent to do this. We do this through our cookies consent platform. Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To suggest relevant courses, educational materials, and learning opportunities based on your skill level, engagement history, and profile.	Data relating to your account details, such as username, membership level and course enrolments, and data relating to transactions, consumer behaviour, browsing and purchasing history, demographic information (e.g., age range, gender, where applicable), job title and employer, professional qualifications, membership of professional bodies, education and certification, as well as data contained in your communications with us (e.g., learning queries, or interactions with support or our chatbots) and technical and device information (e.g., cookie IDs, session IDs, browsing analytics).	Our legitimate interests (or where legally required, your consent).
To analyse purchasing patterns for forecasting trends, or to gather information (see next column) before a product launch to inform our marketing strategies or analyse preferences.	Account details, such as your name, username, or email address, any device identifiers (like cookies or session IDs), demographics, and consumer behaviour data, such as which products you viewed, added or removed, and purchase-related data (where applicable) such as delivery or payment preferences you’ve previously saved, and other professional information (where relevant) such as job title, employer, qualifications, membership of professional bodies, education and certification.	Our legitimate interests.
To remember and save the products you’ve selected or shown interest in so the Site can keep your cart or wish list up to date and available when you return or move between devices, to enhance your user experience.	Account details, such as your name, username, or email address, any device identifiers (like cookies or session IDs), and consumer behaviour data, such as which products you viewed, added or removed, and purchase-related data (where applicable) such as delivery or payment preferences you’ve previously saved.	Our legitimate interests.
To send targeted campaigns or marketing communications and event invites based on our analysis (as described above) or your saved items.	Account details, such as your name, username, or email address, any device identifiers (like cookies or session IDs), demographics, and consumer behaviour data, such as which products you viewed, added or removed, and purchase-related data (where applicable) such as delivery or payment preferences you’ve previously saved, and other professional information (where relevant) such as job title, employer, qualifications, membership of professional bodies, education and certification.	Our legitimate interests (or where legally required, your consent).
To ensure we consider any medical conditions prior to making recommendations of our Products and Services that might not otherwise be safe for you to use, and to comply with health and safety requirements.	Information about potential medical conditions you may have through our consultations (which may be via our online tools), or through our customer service teams, including data relating to your hair or skin/scalp health conditions, or medical issues.	Our legal obligations. Unless explicitly stated otherwise, we only use health‑related sensitive information to meet our health and safety obligations and to avoid unsafe recommendations of our Product and Services, and never for marketing or profiling purposes.

(d) To improve our Products and Services

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To carry out research for our products, including improvements or developing new ones.	Photos, videos, or other information you may submit to us, such as comments on our forums or providing reviews to our Products and Services. We will not use user‑generated content collected for research or product development purposes for marketing or promotional activities unless we have obtained your specific consent to do so.	Our legitimate interests.
To display the content you choose to post publicly on our platforms, such as your photos, videos, reviews or comments, so that it can be viewed by other users.	Photos, videos, or other information you may submit to us, such as comments on our forums or providing reviews to our Products and Services. You should avoid including sensitive data in public content.	Our legitimate interests.
To measure the effectiveness of the content or adverts.	Information on how you interact with our Products and Services (for example, impressions, clicks, conversions), and inferred information about lifestyle and interests, style, as well as data on purchases, open and click-through rates via tracking pixels and links, your browsing information and other device identifiers such as your IP address.	Our legitimate interests (or where legally required, your consent). Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To develop our Products and Services, or conduct research, where you choose to participate in voluntary consumer research, product development activities or trials.	Information you provide as part of the research, such as your contact details, product-usage feedback, photos or videos, and - if relevant to the research and only where you choose to provide it - health‑related information (e.g., scalp, hair, or skin conditions, allergies, or other trial-specific data).	Our legitimate interests (or, where you provide information that reveals health‑related or other special‑category data, we rely on your consent).

(e) To manage our business events and tradeshows

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To manage our business events and tradeshows, for example, as well as provide and administer in-person or virtual events and product demos.	First and last name, contact details, event registration and attendance information, and (if you choose to provide them) any accessibility requirements or dietary preferences.	Our legitimate interests (or, where you provide information that may reveal health‑related or other sensitive characteristics (such as accessibility needs or dietary preferences), we rely on your consent).
To capture our events which you attend and promote future events or activities.	Images and video recordings taken at our events, including group or crowd shots where you may appear incidentally. We will inform you in advance that photography or filming is taking place (for example, through event notices, signage or pre‑event communications).	Our legitimate interests.

(f) If you are a B2B customer

If you’re a B2B customer and you are interacting with us on behalf of your employer, please refer to the table below.

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To create your business account and give you access to our Products and Services on behalf of your employer.	First name, last name, your employer, job title, work email address, work delivery and/or billing address, work phone number, your account details, password, and your answers to security questions.	Our legitimate interests.
To handle and complete orders that your employer has placed with us.	First name, last name, your employer, job title, work email address, work delivery and/or billing address, work phone number, your account details, and password.	Processing your data is necessary for us to fulfil our obligations under the contract with your employer.
To fulfil the orders you place on your employer’s behalf and make sure the right products reach the right location.	First name, last name, your employer, job title, work email address, work delivery and/or billing address, and work phone number.	Processing your data is necessary for us to fulfil our obligations under the contract with your employer.
To process payments and orders (where we may use our payment service providers for orders made online) or manage orders which you make on behalf of your employer.	Information about the purchases you (or your employer) made, credit/debit card details, work delivery and/or billing address, and the date and time of the purchase.	Processing your data is necessary for us to fulfil our obligations under the contract with your employer.
To share information and services you ask for, and to let you know about updates or features that may be useful for you or your employer, or to invite you to business events.	First name, last name, work email address, work delivery and/or billing address, work phone number, and your correspondence with us (including emails, messages, calls or chatbot interactions).	Our legitimate interest (or, where legally required, your consent).

(g) When we use cookies and similar tracking technologies

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To generate analytics and insights - often in aggregated or anonymised form - to improve the Site and our Products and Services, and to understand how effective our content and adverts are. We may also group users into interest segments based on how they interact with the Site and content. This helps us understand trends and measure the effectiveness of our content or adverts, but we do not make decisions about you based solely on this profiling, and you can object to this type of processing at any time.	Information about your visit to the Site, such as pages accessed and links clicked, how you navigate to and from the Site and ghd content (such as how you scroll over the Site and ghd content, which parts you click and how long you spend on each page), your preferences, the Products and Services that you have viewed or searched for, crashes, download errors, response times, IP address, Device type (i.e. make and model), unique device identification numbers, browser-type, and time zone settings. Where feasible, we aggregate and/or anonymise analytics so the results no longer identify you.	Our legitimate interests (or where legally required, your consent). Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To ensure the Site displays clearly and works smoothly on your device.	Information about your visit to the Site, such as pages accessed and links clicked, how you navigate to and from the Site and ghd content (such as how you scroll over the Site and ghd content, which parts you click and how long you spend on each page), your preferences, the Products and Services that you have viewed or searched for, crashes, download errors and response times, IP address, Device type (i.e. make and model), unique device identification numbers, browser-type, and time zone settings.	Our legitimate interests (or where legally required, your consent). Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To show you relevant ghd brand content and advertising on other websites, based on how you use the Site. This includes using cookies and similar technologies to understand which products or content you viewed, so we can present advertising that is more useful to you.	Information about your visit to the Site, such as pages accessed and links clicked, how you navigate to and from the Site and ghd content (such as how you scroll over the Site and ghd content, which parts you click and how long you spend on each page), your preferences, the Products and Services that you have viewed or searched for, crashes, download errors and response times. Where you visit the Site anonymously and/ or visit the Site using your browser’s private or incognito mode we may verify whether we know you by checking whether the device ID you are using to visit the Site matches the device ID information we already hold (and we can link it to the records we hold on you) as well as recognising the manner in which the Site is used (i.e. how you behave on the Site). We do this so that if you are already known to us, we can check whether you have given your consent to receive marketing.	Your consent (we will only use cookies or similar technologies for this purpose if you opt in). Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To recognise returning visitors across sessions using device fingerprinting and identity matching (Contact Match) through our technology partner, Wunderkind, and, where you have separately given marketing consent, send triggered marketing emails based on your on-site activity (such as cart or browse abandonment).	Browser type, operating system, IP address, device model, and a pseudonymous identifier checked against Wunderkind's Identity Network, a cross-client technology platform. Hashed contact identifiers, including hashed email tokens, hashed telephone numbers and UID2. We do not use Wunderkind to collect precise GPS location or sensitive data.	Your consent via our Privacy Preference Center or cookie banner; separate marketing consent for triggered marketing. Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To capture data typed into forms (for example, an email address during checkout or newsletter sign-up) before you submit the form (Field Mapping), to identify returning visitors and, where you have separately given marketing consent, send relevant marketing messages.	Data typed into forms on the Site before submission, such as an email address at checkout or newsletter sign-up.	Your consent via our Privacy Preference Center or cookie banner. Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To enable social media features on the Site - for example, embedded videos, “like” or “share” buttons, or other tools provided by third‑party social media platforms. These features help you interact with our content in the ways you choose.	Technical and browsing information such as your IP address, device type and ID, operating system, browser type and version, time zone settings, unique identifiers (including cookies, pixels and session IDs), diagnostic log data (including timestamps, request identifiers and error codes), the webpage you visited, referrer URL, and approximate location derived from your IP address. Where you are logged into the relevant social media platform, that platform may also associate your visit to the Site with your social media account or profile.	Our legitimate interests (or, where third-party tracking is triggered, your consent). Please also see our Cookie Notice here for our use of non-essential tracking technologies.
To allow social media platforms to recognise you when you visit the Site and to personalise the ads you see on those platforms. This involves using cookies, pixels and similar technologies so that the platform can link your browsing activity on the Site to your social media profile.	Technical and browsing information such as your IP address, device type, operating system, browser type and version, time zone settings, unique identifiers (including cookies, pixels and session IDs), diagnostic log data (including timestamps, request identifiers and error codes), the webpage you visited, referrer URL, and approximate location derived from your IP address. Where you are logged into the relevant social media platform, that platform may also associate your visit to the Site with your social media account or profile.	Your consent. Please also see our Cookie Notice here for our use of non-essential tracking technologies.

(h) For security purposes

Processing activity: Why does ghd use your information?	Personal data: What information might ghd process?	Lawful basis: What ground does ghd rely on?
To ensure the security of our premises, assets and people, and to protect our business from crime, unauthorised access or other security risks.	Images and video recordings, including CCTV on our premises.	Our legitimate interests.
To report or support the investigation of suspected crimes or incidents to law enforcement or other competent authorities, where we are legally required or permitted to do so.	Images and video recordings, including CCTV on our premises.	Our legal obligations.

Which third party sources might ghd obtain information about me from?

We may receive information about you from third party sources. We will only do this where we have obtained confirmation from these third parties that they have complied with applicable data protection laws to share your personal data with us. Examples of this are:

Our social media partners may share with us your user ID for that site, the name, email address and location associated with the user ID and any other information permitted under the privacy policy for that website. We may also share information about you to that social networking site. This is to enhance your experience between platforms, such as to allow you to engage with sites, interact with discussion forums, and sign-in to our Site using your social media log-in details.
Our retailers, distributors and third-party brand partners may pass information to us including any of the data categories listed above such as your name, contact details, information automatically collected via cookies, information in relation to our products purchased at their stores, for example, (whether in store or online through their own website or similar), and services requested using their websites and/or applications.
Our technology partners and market research organisations may share information with us, including your browsing patterns, location, and device identifiers.

Who will ghd share my personal data with?

We take care to restrict access to your personal data on a ‘need to know’ basis. Whenever we share your data with a third party, we will implement appropriate measures to ensure it is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

Here is some more information about when we will share your personal data:

Within the Wella Company group. ghd is part of the Wella Company group, which has offices located across the globe that partially share responsibilities when processing your information to provide you with our Products and Services.
Regulators, authorities, and other third parties. Sometimes we may have a legal obligation to share your personal data with regulators, courts, and other authorities (e.g. tax and law enforcement authorities).
Acquiring entities. If ghd or any Wella Company entity that processes your personal data is sold or transferred, your personal data may be transferred to the new owner.
Our data processors. ghd engages third party service providers to perform functions on ghd’s behalf, for example website and data hosting, e-commerce sites, payment processing, communication distribution, marketing lists management, research and analytics, customer service, identifying whether we know an anonymous visitor already to verify whether they have consented to marketing, chatbots, market research, consultants, providing loyalty programmes and IT support and other services. These providers may process your personal data on our behalf, as necessary to perform their support functions, and following our instructions and relevant local data protection laws. In particular, ghd uses Wunderkind as a technology partner to provide device recognition and identity matching services (Contact Match). In this capacity, Wunderkind acts as ghd’s processor. Separately, Wunderkind operates an Identity Network, a cross-client technology platform that stores associations between pseudonymous device identifiers and hashed contact identifiers, of which it is an independent data controller. Email addresses and telephone numbers are hashed by Wunderkind on ingestion and are not stored in plaintext. First-party data is not accessed by or transferred to other participants in the Identity Network. Wunderkind retains ownership of its proprietary identifiers and the Identity Network. For more information, see Wunderkind’s privacy policy (https://www.wunderkind.co/privacy). Information about the legal basis on which Wunderkind processes data as an independent controller of the Identity Network is available in Wunderkind’s privacy policy (https://www.wunderkind.co/privacy). Where SMS/text messaging is enabled, Wunderkind uses Infobip Ltd (United Kingdom) as a sub-processor for text message delivery.
Third party service providers. ghd also engages other service providers such as professional advisers and auditors where necessary to obtain advice, manage risk, or comply with legal and regulatory requirements; business partners involved in delivering our Products and Services, such as distributors, logistics providers, couriers; and other partners who help us deliver orders, run events, or support our commercial operations.
Third party advertisers and ad-tech partners. We may share certain information with our advertising partners - including platforms such as Meta and Google. This information may include your email address (where appropriate), device and usage data, and information collected through cookies or similar technologies. Please see our Cookie Notice here for further information.

Where we share personal data with third parties, we ensure that we do in compliance with applicable data protection laws. You may have rights to manage your preferences, withdraw consent or object to certain types of data processing. For more information, please refer to What rights do I have in respect of my personal data? section of this Notice.

What happens if ghd transfers my personal data outside its original country?

Some of the recipients we share personal data with, such as service providers and other third parties, may be in countries outside of the jurisdiction which we collect the data from or your country of residence.

If the recipients are in countries which do not provide adequate protections for personal data, we will implement mechanisms to ensure that the personal data continues to benefit from a level of protection that is essentially equivalent to that required in the jurisdiction of origin. We will also require any third-party recipients to maintain appropriate technical and organisational security measures to protect the personal data throughout the transfer and subsequent processing. Such mechanisms may include using relevant safeguards such as the EU/UK Standard Contractual Clauses or other applicable data transfer agreements which ensure personal data is protected to an appropriate standard and allow organisations to continue international data flows without compromising the safety of your personal data. You may ask for a summary of the safeguards which we put in place with our third parties via Who can I contact about data privacy?.

In connection with the Contact Match service described above, personal data is transferred to Wunderkind’s environment hosted on Google Cloud infrastructure in the United States. These transfers are made under the UK International Data Transfer Agreement (for UK data), EU Standard Contractual Clauses (for EEA data), and/or the EU-US, Swiss-US and UK-US Data Privacy Framework, as applicable. Wunderkind also uses sub-processors including Google Cloud (USA), AWS (USA), Looker (USA), Taplytics (Canada), Infobip Ltd (United Kingdom) and certain India-based service providers. Data is encrypted in transit (TLS) and at rest, and email addresses and telephone numbers are hashed on ingestion.

How long will ghd keep my personal data for?

We only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, to meet our legal or regulatory obligations, or to protect our legal rights. Once data is no longer required, we will securely delete or anonymise it. The specific retention period depends on the type of data we hold. For example:

Customer account and support data: Contact details, account information, and correspondence are typically kept for up to 7 years after your last interaction with us, to maintain accurate records, manage ongoing customer relationships, and comply with commercial record keeping laws (e.g., contract limitation periods).
Website and device data (e.g., analytics logs, cookies, IP addresses): Technical logs and analytics data collected through the Site are usually retained for up to 7 years, depending on the tool used, to help us understand website performance and user interaction patterns. Cookie lifespans vary by type, but marketing/analytics cookies typically last up to 24 months, unless you delete them sooner through your browser or privacy settings. Please refer to our Cookie Notice for more information.
Marketing and advertising data (other than Contact Match, described below): Marketing preferences, engagement data, and identifiers used for advertising (e.g., hashed email addresses, audience segment information) are generally retained for up to 7 years after your last interaction with our marketing materials. This allows us to manage opt out requests and assess campaign effectiveness. If you choose to receive marketing from us, we will keep the information we need for this purpose for as long as you continue to receive our marketing communications. If you later opt out, we will stop using your information for marketing and keep only what is necessary to record your marketing preferences.
Contact Match data: Wunderkind retains production data (including online identifiers, opted-in email addresses, on-site behaviour events and related technical metadata) for up to 2 years from last activity. System logs (operational, security and audit records) are retained for up to 3 years. Identity-related personal data is typically retained for approximately 13 to 24 months from last interaction. Email addresses and phone numbers are treated the same: both are hashed on ingestion and deleted on individual erasure request or on withdrawal of consent.
Transactional and payment data: Purchase records, invoices, and payment details are normally kept for 7 years to comply with tax and financial reporting obligations.
Legal, compliance, and risk-related data: Where legally permissible, we may retain your personal data for longer in limited circumstances, such as:
if we need the data to handle or defend a complaint;
where we reasonably expect legal proceedings;
where legal proceedings are ongoing; or
where applicable law requires certain records to be kept for specific periods (e.g., commercial, financial, or audit requirements).

We regularly review our retention practices to ensure that personal data is not kept longer than necessary. Where personal data is retained, that period will comply with any applicable local law.

How does ghd use AI and other automated decision-making technologies to process my personal data?

We use AI and other automated decision-making technologies to process personal data you provide, and which is collected from your use of this website. We use this personal data to provide, personalize, market, and improve our services and our Notice explains what personal data we use and our lawful basis for using it. If AI and other automated decision-making technologies are used to make automated decisions about you our Notice sets out how you can exercise your privacy rights.

What rights do I have in respect of my personal data?

You may have several rights in relation to your personal data. The rights available differ depending on where you are located but may include:

Right to be informed. The right to know how we collect, use, and store your personal data. This includes clear information about the data we collect, the purposes of processing, and the legal basis for doing so in accordance with applicable data protection laws. This is why we will share a privacy notice (such as this one) prior to you disclosing personal data to us. Please read these carefully.
Right of access. The right to confirm with us whether we process your personal data, and if it is, to request access to that personal data, including the categories of personal data processed, the purpose of the processing and the recipients or categories of recipients of that data. We do have to take into account the interests of others though, so this is not an absolute right, and if you want to request more than one copy, we may charge a fee if permissible under local law.
Right to rectification. The right to rectify or correct inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.
Right to erasure (right to be forgotten). The right to ask us to erase or delete personal data concerning you. This is not an absolute right but if a request is refused in whole or in part, we will provide reasons for the refusal.
Right to restriction of processing. In limited circumstances, the right to request that we restrict processing of your personal data, unless we think we have a legitimate interest for processing your data which overrides your request.
Right to data portability. The right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit that data to another entity.
Right to withdraw consent. If you have consented to our processing of your personal data, you have the right to withdraw your consent at any time. This includes cases where you wish to opt out from marketing messages that you receive from us. You can withdraw your consent to cookies and similar technologies (including device fingerprinting and Field Mapping) at any time via “Cookie Settings” in the website footer.
Right to object. The right to object, on grounds relating to your situation, at any time to the processing of your personal data, including profiling, by us and we may be required to stop processing your personal data.
Rights relating to automated decision-making. Under certain circumstances, the right to request human intervention in relation to an automated decision so that you can express your view and to contest the decision.
Right to lodge a complaint. When making a complaint to us, we may request that you put your complaint in writing to assist with our investigation. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint and in accordance with any local legal requirements. If we fail to respond to your complaint within the timeframes set by applicable laws or if you are dissatisfied with the response that you receive from us, you may also have the right to lodge a complaint with the competent data protection supervisory authority, depending on your jurisdiction.

If you would like to confirm which rights apply to you specifically, or to exercise any of these rights as applicable within your jurisdiction, find out more, or lodge a complaint, please contact us via Who can I contact about data privacy?. We may apply any exceptions or other conditions available under applicable privacy laws when responding to any requests submitted to us by you.

For more information about the use of cookies and similar technologies by ghd (including your opt-out choices) please see our Cookie Notice.

How do I stop receiving marketing communications?

We will only send you marketing communications if you consent to this, or if we are otherwise permitted by law (for example, in some jurisdictions we are entitled to send marketing communications to you based on similar Products and Services which you have previously purchased or engaged with). If at any time you decide that you no longer wish to receive marketing communications from us, you may opt out by clicking on the relevant ‘unsubscribe’ link in the communication you receive, or by contacting us via Who can I contact about data privacy?.

You may also unsubscribe from receiving certain text (SMS) or multimedia (MMS) messages by replying “STOP” to the number sending the message. When we engage in SMS communications with you, separate terms we present to you may apply or supplement these terms.

Please note that whilst we will honour your request to stop receiving marketing communications, there may be a short period before your opt-out is fully processed, during which you may still receive some marketing messages. We will, however, continue to send you service-related communications such as emails confirming purchases through the Site and may keep your information for record keeping purposes (where legally applicable).

How old do I have to be to use the Site?

Age eligibility and parental authorisation requirements vary by country. The Site is intended for individuals who have reached the digital age of consent in their jurisdiction. To find the minimum age for your service, see the applicable Terms of Use.

If you are under the applicable age, we will require verifiable consent from your parent or legal guardian before processing your personal data where the law requires it. We do not knowingly collect or process personal data of individuals below this age. If we discover such data has been collected, we will delete it promptly. By accessing or using the Site, you confirm that you meet the applicable age requirement.

If you are under the digital age of consent, please do not use the Site or provide any personal data. If we are made aware that we have received such information, without verification of parental consent, or any information in violation of our policy, we will use reasonable efforts to locate and remove that information from our records. If you require further information, please contact us below.

If you are a parent or guardian and you are aware that your child has provided us with personal data without consent, please contact us below.

How does ghd protect my information?

We implement appropriate technical and organisational security measures, including physical, administrative and technical safeguards to protect your personal data from unauthorized access, use and disclosure. To ensure the security of your personal data, we communicate our privacy and security guidelines to all ghd employees and enforce privacy safeguards within ghd.

The measures we use to protect your personal data are designed to provide a level of security appropriate to the risk of processing your personal data. However, please be aware that no electronic transmission of information can be entirely secure. We cannot guarantee that the security measures that we have in place to safeguard personal data will never be defeated or fail, or that those measures will always be sufficient or effective.

What about the terms of other sites which are linked to the Site?

We may sometimes link to other third party websites and social media platforms which are not operated by ghd. We are not responsible or liable for these websites, any content on them, or their policies and notices. A link does not mean we endorse the views of the linked website or social media platforms. We have no control over the availability of any of these websites or social media platforms. As such, you should read the privacy notices and terms of use for any third-party site you link to from the Site, including social media platforms and other websites or services particularly with user-generated content features.

Who can I contact about data privacy?

If you have any questions regarding this Notice or how we handle your personal data, you may contact us using this form. Alternatively, you can email Wella Company’s Global Data Privacy Officer at wella.data.privacy@wella.com.

You can also send postal mail to us at:

FAO Jemella Limited c/o Wella Company Data Privacy Team

St George's House, 5 St George's Road,

Wimbledon, London SW19 4DR

If you wish to make a complaint about how we handle your personal data, please contact us using the details above. If you are not satisfied with our response, you have the right to lodge a complaint with the competent data protection supervisory authority. For UK residents, this is the Information Commissioner’s Office (ICO), which can be contacted at ico.org.uk.

How do you update this Notice?

We may update this document from time to time, for example if we implement new systems or processes that involve a change to the way we use personal data. We will publish an updated Notice here with the 'Last updated' date at the top of this Notice.

Your continued use of our Products and Services after such updates means we will process your personal data in line with the updated Notice. If we are legally required to obtain your consent for updates to this Notice, we will explain this in the local annexes linked here under Governing Laws.

Please ensure you review the latest version of the Notice, prior to sharing any personal data with ghd.

Annex A – Supplementary Privacy Notice for Australian Residents
For residents in Australia only, Annex A applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.
For residents in Australia only, references to “personal data” in the Notice shall mean “personal information” as understood under the Privacy Act 1988 (Cth).
For residents in Australia only, we will rely on the notice and reasonable expectation mechanisms in the Australian Privacy Principles (including Australian Privacy Principle 5, 6 and 7) as the lawful basis of processing, except where consent is required (in which case we will obtain your consent where relevant). Provisions in the Notice referring to other ‘lawful bases’ not recognised under Australian law shall not apply.
What happens if ghd transfers my personal data outside its original country?
For residents in Australia, for a list of the Wella Company group entities and third parties that we may share your data with, and the countries they are located in, please contact us as set out below (“Who can I contact about data privacy?”).
For residents of Australia only, the following paragraph will apply in addition to the provisions above in the section "What rights do I have in respect of my personal data?":
When making a complaint. In most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If we fail to respond to your complaint within a reasonable time of receiving it in writing or if you are dissatisfied with the response that you receive from us, you can make a complaint to the applicable regulator, the Office of the Australian Information Commissioner (OAIC). You can contact the OAIC at:
Email: enquiries@oaic.gov.au
Mail: GPO Box 5288, Sydney NSW 2001
Phone: 1300 363 992
Visit: oaic.gov.au

Annex B – Supplementary Privacy Notice for Canada Residents

For residents in Canada only, Annex B applies to the collection, use, and disclosure of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What categories of personal data does ghd collect about me and how is it used?

References to “personal data” in the Notice shall mean “personal information” as understood under Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) or substantially similar provincial privacy laws in Canada, as applicable.

We will rely on the lawful basis of consent when collecting, using or disclosing personal data, as required under applicable privacy laws. Provisions in the Notice referring to lawful bases other than consent shall not apply if inconsistent with applicable laws in Canada.

What happens if ghd transfers my personal data outside its original country?

For a list of the Wella Company group entities and third parties that we may share your data with, please contact us as set out below (“Who can I contact about data privacy?”).

How old do I have to be to use the Site?

For residents in Canada’s Province of Quebec only, you must be aged 14 or over to use the Site and any person under the age of 14 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Site?” shall accordingly be construed.

Annex C – Supplementary Privacy Notice for India Residents

For residents in India only, this Annex C applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) shall govern any processing of personal data (a) within the territory of India; or (b) outside the territory of India, if such processing is in connection with any activity relating to offering of goods or services to data subjects within the territory of India (where (a) and (b) shall hereinafter be referred to as “India-governed Personal Data”).

Lawful Basis for Processing

For residents of India or in case of processing of India-governed Personal Data only, the sub-sections “Lawful basis” for each of the uses of circumstances under which personal data may be collected, as set out under the section titled "What categories of personal data does ghd collect about me and how is it used?", will be deemed replaced and substituted with the following, to the extent of any conflict:

Your acceptance of this Privacy Notice denotes free, specific, informed, unconditional and unambiguous consent to such processing of your personal data as set out above, for the purposes set out above, in accordance with the terms of the above Notice read with this Annex D.
We do this in our legitimate interests (where we consider these are not overridden by your rights), such as to manage our business effectively, or to comply with our legal obligations (e.g. commercial sales and goods law).
We may also do this to take steps to enter into any contract with you or your employer or to fulfil our obligations under any contract with you (for example, our Terms of Use).
We may also do this where you may have voluntarily provided your personal data to ghd and have not indicated that you do not consent to the use of such personal data.

What happens if ghd transfers my personal data outside its original country?

For residents of India or in case of processing of India-governed Personal Data only, ghd will ensure that no transfers of personal data of Indian residents or of India-governed Personal Data shall be made to countries or territories outside of India that are identified as restricted or prohibited territories under the DPDP Act, as notified from time to time by the Government of India.

What rights do I have in respect of my personal data?

For residents of India or data subjects from whom ghd has collected India-governed Personal Data only, sub-sections (a), (b) and (c) of section "What rights do I have in respect of my personal data?" will be deemed amended and substituted as follows:

Right of access. You have a right to seek information regarding all other persons (including third parties) who may have access to and are processing your personal data that is collected by ghd in accordance with the Notice. Such information should include the identity details of such third party controllers or processors of such personal data and a description of the personal data shared by ghd with such third parties/persons.
Right to rectification

You have the right to rectify/complete/update inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible.

Right to erasure (right to be forgotten)

You have the right to ask us to erase personal data concerning you.

In addition to the above amendments to the section "What rights do I have in respect of my personal data?" and the remaining rights set out therein, for residents of India or data subjects from whom ghd has collected India-governed Personal Data only, the following additional rights shall also be available:

The section will also include the following two further provisions:

Right to grievance redressal

You have a right to grievance redressal from ghd in respect of any act or omission by us in relation to the performance of obligations in relation to (i) the personal data of data subjects; and (ii) exercise of his/her/their rights under the DPDP Act.

Right to nominees

You have a right to nominate any other individual who shall, in the event of death or incapacity, exercise your rights as a data subject.

How old do I have to be to use the Site?

For residents of India only, you must be aged 18 or over to use the Site and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Site?” shall accordingly be construed.

Annex D – Supplementary Privacy Notice for Kingdom of Saudi Arabia Residents

For residents in the Kingdom of Saudi Arabia ("KSA") only, or individuals whose personal data is processed in KSA, Annex D applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For KSA data subjects the Personal Data Protection Law promulgated by Royal Decree No. M/19, dated 09/02/1443H on 24 September 2021 ("PDPL") and its Implementing Regulation and Regulation on Personal Data Transfer outside the Kingdom issued on 22/02/1445H (07/09/2023G) (each the Implementing Regulations and Data Transfer Regulations and together, the "Regulations") and other laws and/or regulations regarding data privacy in KSA apply.

Capitalised terms used below and not defined have the meaning set out in the PDPL and Regulations.

For KSA data subjects, the data controller of your personal data is Jemella Limited, with address at 82 Dean Street, London, W1D 3SP.

What categories of personal data does ghd collect about me and how is it used?

With respect to KSA data subjects only, please note that where we obtain your consent to process sensitive categories of data or sensitive health data, we will always obtain your explicit consent. 'Sensitive categories of data' means personal data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown. 'Sensitive health data' means any personal data related to an individual's health condition, whether their physical, mental or psychological conditions, or related to Health Services received by that individual.

We may obtain information from third party sources.

Where we receive information about you from third party sources, we will only do so in accordance with applicable law.

How are advertisements personalized for me?

Where we use your data to provide you with personalized recommendations for our Products and Services, tailor our content to better suit your interests or offer personalised and customised Products and Services, we will always obtain your consent before doing so.

Who will ghd share my personal data with?

Where we share your personal data with third parties, we will only do so in accordance with applicable law.

What happens if ghd transfers my personal data outside its original country?

As you may expect, some of the recipients we share personal data with may be in countries outside of the jurisdiction which we collect the data from. Some of these countries have a legal regime which provides an adequate level of protection for this data.

If recipients are in countries which do not provide adequate protections for personal data, we will take all necessary measures to ensure that transfers of personal data to these countries are adequately protected as required by applicable data protection law. This may include using appropriate safeguards such as Standard Contractual Clauses. You can ask for a copy of such appropriate safeguards by contacting us as set out in the main body of the Notice.

What rights do I have in respect of my personal data?

You have rights in relation to your personal data. These can be summarised in broad terms as follows:

Right to access

You have the right to confirm with us whether we process your personal data, and access to your personal data.

Right to request access

Subject to certain conditions, you have the right to request access to a copy of your personal data in a clear and readable format.

Right to rectification

Right to erasure

You may have the right to ask us to erase personal data concerning you, however please note that this is not an absolute right.

Right to contact the competent authority

You have the right to contact the data protection regulator in the Kingdom of Saudi Arabia if you are not satisfied with our use of your Personal Data or response to the exercise of your rights. The relevant data protection regulator is the Saudi Data and AI Authority (SDAIA). They can be contacted here: https://sdaia.gov.sa/en/Contact/Pages/ContactUs.aspx

To exercise any of these rights, find out more, or lodge a complaint, please contact us using the details in the main body of the Notice. We may apply any exceptions or other conditions available under law when responding to correction, deletion, or other requests.

Right to withdraw consent

When relying on your consent to process your Personal Data, you have the right to withdraw your consent at any time by using the mechanisms provided by us to that end or by contacting us as set out in the main body of the Notice. Please be aware that the withdrawal of your consent will not affect the lawfulness of any processing of Personal Data carried out on the basis of your consent prior to withdrawal. You can withdraw your consent to cookies and similar technologies (including device fingerprinting and Field Mapping) at any time via “Cookie Settings” in the website footer.

How old do I have to be to use the Site?

For residents in KSA only, you must be aged 18 or over to use the Site and any person under the age of 18 shall be treated as a ‘child’. The terms set out in the section “How old do I have to be to use the Site?” shall accordingly be construed.

Annex E – Supplementary Privacy Notice for New Zealand Residents

For residents in New Zealand only, Annex E applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

What rights do I have in respect of my personal data?

Right to rectification

You may have the right to rectify inaccurate or incomplete personal data concerning you. We encourage you to review any information you have provided to us regularly to ensure that it is accurate and up to date, and to inform us of any changes as soon as possible. If you make a request to rectify or correct of any of your personal information that we hold, you have the right to provide to us a statement of the correction sought (Correction Statement). If we do not make the correction you have requested, you can request that we attach the Correction Statement to the information and we will take reasonable steps to ensure that this occurs.

When making a complaint, in most cases we will ask that you put your request in writing to us. We will investigate your complaint and will use reasonable endeavours to respond to you in writing within a reasonable time of receiving the written complaint. If you are dissatisfied with the response that you receive from us, you can refer your complaint to the Office of the Privacy Commissioner (OPC). You can contact the OPC:

by telephoning – (04) 474 7590 or (09) 302 8680;
by writing to – PO Box 10 094, The Terrace, Wellington 6143; or
by submitting an online complaint form, located at the OPC website: privacy.org.nz

Annex F – Supplementary Privacy Notice for Turkey Residents

For residents in Türkiye only, Annex F applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

For data subjects residing in Türkiye, the Law No. 6698 on the Protection of Personal Data ("LPPD") and other laws and/or regulations regarding data privacy in Türkiye apply.

Your personal data are collected by written and electronic means.

What happens if ghd transfers my personal data outside its original country?

In the event that your personal data is transferred abroad, it is transferred in accordance with Article 9 of the LPPD.

What rights do I have in respect of my personal data?

Right to learn whether your personal data are processed or not;
Right to request information regarding your data, if your personal data are processed;
Right to learn the purpose of processing of your personal data, and whether your personal data are used for the intended purposes or not;
Right to learn the identity of third parties to whom your personal data are transferred in Türkiye or abroad;
Right to request completion or correction of your data, if your personal data are processed incompletely or inaccurately;
Right to request deletion or destruction of your personal data;
If your personal data are corrected, deleted or destroyed, to request notification of these transactions to third parties to whom your personal data are transferred;
Right to raise objections against any consequences that may arise in disfavour of you as a result of analysis of the processed data solely and exclusively through automatic systems; and
Right to claim indemnification of your damages and losses, if any, incurred due to illegal or unlawful processing of your personal data.

If you have any question concerning your rights in relation to processing of your personal data please contact us as set out below. The requests in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest.

Who can I contact about data privacy?

If you have any questions regarding this Notice or how we handle your personal data, you may contact us using this form.

Alternatively, you can email Wella Company’s Global Data Privacy Officer, Lisa Townsend, at wella.data.privacy@wella.com.

Annex G Part I - Supplementary Privacy Notice for United States Residents (excluding residents of California)

For residents of a US state (excluding California) that has applicable privacy laws, including but not limited to, Colorado, Delaware, Oregon or Virginia, Annex G Part I applies to the processing of your personal data. You may have the right to obtain confirmation that we maintain certain personal data relating to you, to verify its content, origin, and accuracy, as well as the right to access your personal data, request updates or corrections to your personal data, and request deletion or portability of your personal data. You may also have the right to obtain the identities of the third parties to whom we disclose your personal data. You may also request restriction of the processing of your personal data, including for targeted advertising. Additionally, in certain states you may have the right to opt-out of the “sale” of your personal data, as the term is defined under applicable law.

In addition, our use of device fingerprinting technology and participation in Wunderkind’s Identity Network (as described in the main body of this Notice), together with Field Mapping (the pre-submission capture of form data described above) and SMS/text message delivery, may constitute a “sale” or “sharing” of personal information under applicable US state privacy laws, because pseudonymous identifiers derived from your device and information captured through Field Mapping may be used to identify returning visitors and support relevant marketing messages. You may opt out of this processing using the methods described above, including by broadcasting a Global Privacy Control (GPC) signal.

In connection with the Contact Match service described in the main body of this Notice, IP addresses processed through Wunderkind may be used to derive approximate geographic location. Depending on the resolution achieved, IP-derived geolocation may qualify as precise geolocation (defined under certain state laws as the location of an individual within a radius of 1,850 feet), which may constitute sensitive personal information. As a precautionary measure, ghd treats IP addresses processed through Contact Match as potentially giving rise to sensitive personal information obligations. You may limit the use of your sensitive personal information by clicking the “Limit the Use of My Sensitive Personal Information” link on the Site, where available. In some states, you can designate an authorized agent to make a request on your behalf. Please note that we may need to retain certain information for recordkeeping purposes, to complete any transactions that you began prior to your request, or for other purposes as required or permitted by applicable law. In any event, should you choose to exercise any of your rights as detailed above, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.

We do not retaliate against customers who exercise any of their rights described in this Notice.

You can exercise your rights for any of the jurisdictions listed above by contacting us as detailed above.

How old do I have to be to use the Site? You must be aged 13 or over to use the Site and our other digital offerings, including our social media. Additionally, the Site is not intended for or directed to the residents of Colorado, Connecticut, Delaware, Maryland, or New Jersey who are under the age of 18 years. For these states, if we become aware that anyone under the age of 18 has provided us with personal information, we will delete the information from our records.

Bona Fide Loyalty Program Disclosure. We may provide programs, such as sweepstakes, contest, or other similar promotional campaigns (collectively, the “Programs”). When you sign up for one of these Programs, we typically ask you to provide your name and contact information (such as email address and/or telephone number). Because our Programs involve the collection of personal information and offering of certain benefits, they might be interpreted as a “bona fide loyalty program” under Colorado law.

You may withdraw from participating in a Program at any time by contacting us using the designated method set forth in the applicable Program rules. Visit the terms and conditions page of each Program to view full details, including how to participate.

Annex G Part II – Supplementary Privacy Notice for California Residents

For residents of California only, Annex G Part II applies to the processing of your personal data in addition to, and where specified, in the place of the relevant sections of the above Notice.

CA Personal Information. Consistent with the "What categories of personal data does ghd collect about me and how is it used?" section above and the Cookie Notice here, we collect certain categories and specific pieces of information about individuals that are considered 'Personal Information' in California (CA Personal Information). Specifically, we collected the following types of CA Personal Information in the preceding 12 months:

Identifiers:name, title, organisation, address, email address, phone number, date of birth, age, gender, and government identifiers.
Internet or other electronic network activity information: internet protocol (IP) address, your login data, browser type and version, device IDs, time zone setting and location, browser plug-in types and versions, operating system and platform, pages and services you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).
Audio, electronic, visual, or similar information: phone, audio, or video calls, texts and other digital messaging, emails, and any in-person conversations you have with us.
Geolocation data: approximate location derived from IP address (city, postal code or region).

Certain CA Personal Information that we collected about you in the preceding 12 months may be considered Sensitive Personal Information within the meaning of California Privacy Law, including:

Precise geolocation information (only with your permission, in order to provide location services); and
Social security, driver’s license, state identification card, or passport number (to manage our Customer relationships).

We only use and disclose Sensitive Personal Information as necessary in connection with the performance of services and the provision of goods, compliance with federal, state, or local laws, and as otherwise specified by Section 7027(m).

Third-party partners (e.g., IT service providers, analytics service providers);
Business partners;
Commercial clients;
Public sources; and

Purposes of collection and use. We may collect and use CA Personal Information for:

Business purposes, including:
- improving the Site and our Products and Services;
- operating the Site;
- providing you with information and Products and Services you request from us, or we think you may be interested in;
- providing you with location services (only if you ask or allow us to);
- carrying out and complying with our agreement with the customer;
- administering and managing our product offering tiers and fees, invoicing, and billing; and
- complying with our legal obligations, including carrying out required checks on new customers, and to prevent money laundering or fraud.
Commercial purposes, including:
- marketing communications (including direct marketing);
- customer service;
- providing you with special offers and other information we believe will be of interest to you; and
- inviting you to participate in surveys and provide feedback to us.

Disclosure of CA Personal Information. We also disclosed your CA Personal Information as follows:

Business Purposes. We may disclose the above categories of CA Personal Information to third-party partners, third party applications; and other companies or organisations, such as market research firms and data aggregators, for any of the business purposes described above.
Commercial Purposes. We may share the above categories of CA Personal Information with third-party partners; third party applications; and other companies or organisations, such as market research firms and data aggregators, for any of the commercial purposes described above.

Sale or Sharing of CA Personal Information. Selling / sharing of information We disclosed personal information to advertising business partners for the purposes of supporting our advertising efforts. Our use of online tracking technologies may be considered a “sale” / “sharing” under California law. You can opt out of being tracked by these third parties by clicking the “Your Privacy Choices” link at the bottom of our website and selecting your preferences.

If you are not logged into your account, your request to opt out of “sale” / “sharing” will be linked to your browser identifier only and not linked to any account information because the connection between your browser and the account is not known to us.

In addition, our use of device fingerprinting technology and participation in Wunderkind’s Identity Network (as described in the main body of this Notice), together with Field Mapping (the pre-submission capture of form data described above) and SMS/text message delivery, may constitute a “sale” or “sharing” of personal information under California law, because pseudonymous identifiers derived from your device are used within a cross-client identity graph that benefits multiple participating clients and information captured through Field Mapping may be used to identify returning visitors and support relevant marketing messages. You may opt out of this processing using the methods described above, including by broadcasting a Global Privacy Control (GPC) signal. For more information about the Identity Network, see the “If you are a customer purchasing our Products and Services” and “Who will ghd share my personal data with?” sections of this Notice.

Where ghd sends you marketing text messages via the Contact Match service, we do so only with your prior express written consent as required by applicable law. You may opt out of marketing text messages at any time by replying “STOP” to any message you receive, or by contacting us as set out above. Message and data rates may apply. Consent to receive marketing text messages is not a condition of purchasing any products or services. You may opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

Categories of personal information disclosed that may be considered “sale” / “sharing”: identifiers, device ID, Internet or other network activity, broad geolocation data (e.g. country, city, postal code or region-level location), and commercial data.

Categories of third parties to whom personal information was disclosed that may be considered “sale” / “sharing” include advertisers and marketing partners, data analytics providers, and social media networks. To request a list of the specific third parties to whom personal information was disclosed that may be considered “sale” / “sharing”, you can contact us as set out below.

We do not have actual knowledge that we sell or share for cross-context behavioural advertising, the personal information of California residents under 16 years of age.

Retention of CA Personal Information. We retain your CA Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include (i) for as long as we have an ongoing relationship with you; (ii) as required by a legal obligation to which we are subject to; or (iii) as advisable in light of our legal position (such as in regard of applicable statutes of limitations, litigation, or regulatory investigations).

Your Rights under California Privacy Law. Subject to certain exceptions detailed in CA Privacy Law and other applicable laws and regulations, as a California resident, you have the right to: (i) request to know/access your CA Personal Information, including what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You may only exercise your right to know twice within a 12-month period; (ii) request deletion of your CA Personal Information; (iii) request correction of your CA Personal Information; (iv) limit the use of sensitive personal information. We only collect sensitive personal information, as defined by applicable privacy laws, for the purposes allowed by law or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you. Some of the purposes for the collection and processing of sensitive personal information allowed by law include: to perform the services or provide the goods reasonably expected; to prevent, detect, and investigate security incidents; to resist malicious, deceptive fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions; to ensure the physical safety of natural persons; for short-term, transient use; to perform services on behalf of us; and to verify or maintain the quality or safety of a product or service provided by us; (v) opt-out of the “sale” or “sharing” of your CA Personal Information, as such terms are defined under California Privacy Law; and (vi) to be retaliated against for exercising privacy rights conferred by CA Privacy Law.

Exercising California Consumer Rights. If you are a California resident and wish to request the exercise of these rights as detailed above or have questions regarding the CA Personal Information collected or shared with third parties, please contact us as set out above or call 800-252-4765.

You may be asked to provide additional proof of identification so that we can verify your identity and validate the request.
Please note that you are limited by law in the number of requests you may submit per year. In some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the CA Personal Information that we maintain relates to you. In other instances, we may decline to honor your request where an exception under California Privacy Law applies, such as where the disclosure of CA Personal Information would adversely affect the rights and freedoms of another consumer.
In any case, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.

Authorized Agents. To the extent that you elect to designate an authorized agent to make a request on your behalf, they must provide appropriate documentation including written signed permission from you, proof of your identity, and verification of their identity; or a valid, designated power of attorney as defined under the California Probate Code.

Opt-Out Preference Signals. We respond to opt-out preference signals communicated via the Global Privacy Control and will process such signals with respect to the browser or device communicating the signals, or with respect to you specifically if you have signed onto your ghd account while communicating Global Privacy opt-out preference signals. To use Global Privacy Control opt-out preference signals, please follow the instructions here: https://globalprivacycontrol.org/.

California Shine the Light. We do not disclose CA Personal Information to third parties for such third parties' use for direct marketing purposes. Under California’s Shine the Light law, California residents may request (i) a list of the categories of CA Personal Information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To make a request, please contact us as described above. We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.

California’s “Eraser Button” Law. If you are a California resident under 18 years old and a registered user of the Site, you can request that we remove content or information that you have posted to the Site. Fulfilment of the request may not ensure complete or comprehensive removal (e.g., if the content or information has been reposted by another user). To request removal of content or information, you can contact us as set out below.

Incentive Programs. We may provide price discounts, coupons, services, and other perks for customers who have opted in to our marketing email lists. Through these offerings, customers may provide us with CA Personal Information, as set out above, depending on how they choose to interact with us when and after they opt-in to our programs. There is no obligation to opt-in and customers may opt-out at any time. Because these program offerings involve the collection of CA Personal Information and offering of certain benefits, they may be considered a “financial incentive” program under CA law.

The value of any financial incentive we offer is reasonably related to the value of any CA Personal Information you provide to us. The precise value of the CA Personal Information collected will vary and is dependent on a number of factors, including, for example, whether and to what extent you take advantage of any offerings and whether and to what extent you opt out of any offerings.

Financial incentive disclosure. We offer our customers a loyalty program that provides certain perks, such as rewards and exclusive offers. We may also provide other programs, such as sweepstakes, contest, or other similar promotional campaigns (collectively, the “Programs”). When you sign up for one of these Programs, we typically ask you to provide your name and contact information (such as email address and/or telephone number). Because our Programs involve the collection of personal information and offering of certain benefits, they might be interpreted as a “financial incentive” program under California law.

Under California law, the value of your personal information to us is related to the value of the free or discounted products or services, or other benefits that you obtain or that are provided as part of the applicable Program, less the expense related to offering those products, services, and benefits to Program participants.