Open Menu icon

Privacy Policy

Last Updated: Dec 30, 2024

Expand All
Expand/Collapse Icon

Obagi Cosmeceuticals LLC, an affiliate of Waldencast plc (collectively, “Obagi”, "we, “us,” or “our”) respects your privacy and is committed to protecting it through our development and compliance with this Privacy Policy. This Privacy Policy describes how we collect, use and share certain information about you as well as your rights and choices about such collection, use and sharing. It applies when you access or use our websites and other products and services (collectively, the “Services”), contact our service team, engage with us on social media, or otherwise interact with us.

We encourage you to read this Privacy Policy carefully to understand how we handle your information. By accessing or using the Services, whether or not you purchase any of our Services, you acknowledge that you have read and understand this Policy and that we collect, use, and disclose your information as set forth below. If you do not agree with our policies and practices, your choice is not to use the Services.

This Privacy Policy does not apply to any information collected by websites that are not owned/operated by Obagi.

Please note that this Privacy Policy may change from time to time. We will post any Policy changes on this page. Each version of this Policy will be identified at the top of the page by its last updated date.

If you have any questions regarding this Privacy Policy or our privacy practices, please email us at moc.igabo@lagel.

We collect the personal information you provide to us when you purchase our products or visit our website. The categories of information we may collect include:

  • Personal Identifiers, including name, email address, postal address, telephone number, and online Identifiers
  • Internet Activity
  • Commercial Information, including purchases
  • Financial Information, including credit or debit card number
  • Location Information, including general location data
  • Physical and Audio Data, including physical characteristics or descriptions and photos
  • Protected Classifications and Other Personal Characteristics, including age
  • Health Data, including data related to physical or mental health
  • Consumer Communications, including direct communications with our consumers
  • Inferences from Other Data, including inferences created from other personal information collected

Browser Cookies

We use cookies to create a better experience for you on our site. For example, cookies prevent you from having to login repeatedly, and they help us remember items you've added to your cart. We also use third-party cookies, which are cookies placed by third parties for advertising and analytics purposes. You can control these cookies through your browser settings.

Information from other sources

We may collect personal information about you from third-party sources, including Ad Networks and Other consumers (e.g., referrals). 

The categories of information we may collect include:

Ad Networks

  • Personal Identifiers, including Name, Email address, Postal address, and Telephone number

Other consumers (e.g., referrals)

  • Personal Identifiers, including Name and Email address
  • Consumer Communications, including Direct communications with our consumers

How long we keep your data

We do not retain data for any longer than is necessary for the purposes described in this Policy.

Why we process your information

We process personal information for the following business and commercial purposes:

  • Analyzing Data
  • Conducting Surveys
  • Creating Customer Profiles
  • Delivering Targeted Ads
  • Fulfilling Customer Orders
  • Improving Our Products & Services
  • Internal Business Operations
  • Managing Event & Guest Data
  • Meeting Compliance & Legal Requirements
  • Operating Our Website or Mobile Apps
  • Preventing Fraud
  • Processing Payments
  • Providing Customer Support
  • Sending Promotional Communications
  • Storing and Managing Data
  • Tracking Purchases & Customer Data

We may disclose personal information about you for business and commercial purposes when you purchase our products or visit our website:

Personal Information Sharing Categories
Personal Information CategoryCategories of Service ProvidersCategories of Third Parties
Personal IdentifiersBusiness Operations Tool, Commerce Software Tools, Consultant Contractors, Customer Support Tools, Cybersecurity Providers, Data Analytics Providers, Governance, Risk & Compliance Software, IT Contractors, IT Infrastructure Services, Order Fulfillment Contractors, Payment Processors, and Sales & Marketing ToolsAd Networks, Affiliates, Business Partners, Data Analytics Providers, Data Cooperative, Payment Processors, Sales & Marketing Tools, Sampling Vendor, and Shipping Services
Internet ActivityBusiness Operations Tool, Commerce Software Tools, Consultant Contractors, Customer Support Tools, Cybersecurity Providers, Data Analytics Providers, IT Contractors, IT Infrastructure Services, Order Fulfillment Contractors, Payment Processors, and Sales & Marketing ToolsAd Networks, Data Analytics Providers, Data Cooperative, Payment Processors, and Sales & Marketing Tools
Commercial InformationBusiness Operations Tool, Commerce Software Tools, Consultant Contractors, Customer Support Tools, Data Analytics Providers, IT Contractors, IT Infrastructure Services, Order Fulfillment Contractors, Payment Processors, and Sales & Marketing ToolsAd Networks, Affiliates, Business Partners, Data Analytics Providers, Data Cooperative, Payment Processors, and Sales & Marketing Tools
Financial InformationBusiness Operations Tool, Commerce Software Tools, and IT ContractorsPayment Processors and Sales & Marketing Tools
Location InformationData Analytics Providers, IT Contractors, IT Infrastructure Services, Payment Processors, and Sales & Marketing ToolsAffiliates, Business Partners, Data Analytics Providers, and Sales & Marketing Tools
Protected Classifications and Other Personal CharacteristicsBusiness Operations Tool, Consultant Contractors, Customer Support Tools, Data Analytics Providers, IT Contractors, IT Infrastructure Services, and Sales & Marketing ToolsSales & Marketing Tools
Health DataCustomer Support Tools, Data Analytics Providers, IT Contractors, IT Infrastructure Services, and Sales & Marketing ToolsNone
Consumer CommunicationsBusiness Operations Tool, Commerce Software Tools, Consultant Contractors, Customer Support Tools, IT Contractors, IT Infrastructure Services, Order Fulfillment Contractors, and Sales & Marketing ToolsSales & Marketing Tools
Inferences from Other DataBusiness Operations Tool, Consultant Contractors, Customer Support Tools, Data Analytics Providers, IT Contractors, IT Infrastructure Services, Payment Processors, and Sales & Marketing ToolsData Analytics Providers and Sales & Marketing Tools

This section provides additional information for people in the European Economic Area (EEA) or United Kingdom (UK). The terms used in this section have the same meaning as in the General Data Protection Regulation and the UK Data Protection Act (GDPR). The term “personal information” as used in this notice has the same meaning as “personal data” in the GDPR.

Collection and Disclosure of Personal Data

The personal data we collect and how we share it is described above in our Privacy Policy.

We may disclose your personal information to the following third party controllers for business purposes:Analog Republic, LinkedIn Ads, Blue Retargeting, Criteo, Google Ads, Insighta, Meta Ad Network, Shopify Audiences, Microsoft Clarity, Pinterest Ads, Tiktok Ads, Facebook Pay, USPS, Snowplow, ProAffiliates, PayPal - Pay with PayPal, Venmo, Pay Later, X Ads, Microsoft Ads, UPS, Afterpay, Apple Pay, BoxOut Health, Google Pay, Shop Pay, KapturBox, Odore. To understand how these parties handle your data, please refer to their respectiveprivacy policies.

Cookie Notice

We use cookies to improve your experience on our site and to allow us and third parties to personalize the marketing content you see on other websites and social media. Website visitors from European Privacy Law regions can control cookie settings. Manage your region specific consent settings here.

Essential Cookies

We use these cookies for things like security, logins, site errors, and processing payments. We can't turn these necessary cookies off, but you can control them in your browser.

Cookie NameProviderDuration
__cf_bmCloudflare31 Mins
_cfuvidCloudflareSession
_cmp_aShopify1 Day
_tracking_consentShopify1 Year
access_token1 Year
BVBRANDIDBazaarvoice1 Year
BVBRANDSIDBazaarvoice31 Mins
cart_currencyShopify14 Days
extole_access_token1 Year
keep_aliveShopify31 Mins
locale_bar_acceptedShopifySession
localizationShopify1 Year
receive-cookie-deprecationShopifySession
secure_customer_sigShopify1 Year
shopify_pay_redirectShopify1 Hour
xtl_bid1 Year
Analytics Cookies

These cookies tell us how you use our sites and apps, and provide information to help us improve your experience.

Cookie NameProviderDuration
_gaGoogle Analytics1 Year 1 Month 4 Days
_ga_6SSYY3VT71Google Analytics1 Year 1 Month 4 Days
_ga_P0QDC3S0DCGoogle Analytics1 Year 1 Month 4 Days
_ga_YTLD42CFG2Google Analytics1 Year 1 Month 4 Days
_landing_pageShopify14 Days
_orig_referrerShopify14 Days
_shopify_sShopify31 Mins
_shopify_sa_pShopify31 Mins
_shopify_sa_tShopify31 Mins
_shopify_yShopify1 Year
Personalization Cookies
We do not use cookies to personalize content for you.
Advertising Cookies

These cookies help us decide which products, services and offers may be relevant for you. We use this data to customize the marketing content you see on websites, apps and social media, and to measure your interactions with that content. We might use these cookies to advertise our products to you when you visit other websites.

Cookie NameProviderDuration
__kla_idKlaviyo1 Year 1 Month 4 Days
_fbpMeta Ad Network2 Months 28 Days
_gcl_auGoogle Ads2 Months 28 Days
_pin_unauthPinterest Ads1 Year
_pinterest_ct_uaPinterest Ads1 Year
_tt_enable_cookieTiktok Ads1 Year 25 Days
_ttpTiktok Ads1 Year 25 Days
_ttpTiktok Ads1 Year 25 Days
ar_debugPinterest Ads1 Year
blueIDBlue Retargeting1 Year
ckidBlue Retargeting1 Year
cto_first_party_domainCriteoSession
cto_first_party_idCriteoSession
cto_partner_idCriteoSession
IDEGoogle Ads1 Year 1 Month 4 Days
uidCriteo1 Year 25 Days

Lawful Bases and Legitimate Interests

We process personal data on the following lawful bases:

  • Complying with legal obligations
  • Fulfilling contracts
  • Consent
  • Legitimate interests

Where we process personal data on the basis of our legitimate interests, we pursue the following interests: Analyzing Data, Conducting Surveys, Creating Customer Profiles, Delivering Targeted Ads, Fulfilling Customer Orders, Improving Our Products & Services, Internal Business Operations, Managing Event & Guest Data, Meeting Compliance & Legal Requirements, Operating Our Website or Mobile Apps, Preventing Fraud, Processing Payments, Providing Customer Support, Sending Promotional Communications, Storing and Managing Data, and Tracking Purchases & Customer Data.

International Data Transfers

We may send the personal data of individuals in the EEA/UK/CH to third countries, including the United States, where it may be stored or processed, for example on our service providers’ cloud servers. When we transfer personal data, we rely either on Adequacy Decisions as adopted by the European Commission (EC), the UK Information Commissioner's Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC) on the basis of the EU-US Data Privacy Framework, UK-US Data Bridge, and Swiss-U.S. Data Privacy Framework agreements, Standard Contractual Clauses (SCCs) issued by the EC or the FDPIC, or International Data Transfer Agreements (IDTAs) approved by the ICO. Data protection authorities have determined that the SCCs and IDTAs provide sufficient safeguards to protect personal data transferred outside the EEA/UK/CH. You may read more about international data transfer mechanisms at the following links:

Privacy Rights

Individuals in the EEA/UK/CH have the following rights regarding their personal data.Make a Privacy Request by clicking here. Once you submit a request, we will verify your identity and process your request in most cases within 30 days.

Right to access. You have the right to request a copy of the personal data we hold about you.

Right of portability. You have the right to ask us to transfer your data to another party.

Right to rectification. You have the right to request that we rectify any incorrect information we have about you.

Right of erasure. You have the right to request that we erase (delete) any personal information we hold about you.

Right to withdraw consent. You have the right to withdraw your consent at any time when we rely on your permission to process your personal data.

Right to object. You have the right to object to our use of data about you.

Right to restrict processing. In certain circumstances, you have the right to restrict our processing of your personal data to storage only, subject to some exceptions. This right applies when:

  • You have contested the accuracy of your personal data and we are still verifying its accuracy.
  • Your personal data has been unlawfully processed under the GDPR.
  • You need for us to keep your data in order to establish, exercise, or defend a legal claim.
  • You have previously objected to our processing of your personal data and the status of that review is still pending.

Right to lodge a complaint with a supervisory authority. You have a right to lodge a complaint with a supervisory authority. For more information, you can visit theInformation Commissioner’s Office website at https://ico.org.uk/, the Federal Data Protection and InformationCommissioner’s website at https://www.edoeb.admin.ch/, or see a list of EU Data Protection Authorities athttps://www.gdprregister.eu/gdpr/dpa-gdpr/.

Inquiries

Controller contact information

Obagi

moc.igabo@ycavirp

This section provides additional information for people in Canada. The terms used in this section have the same meaning as in the Personal Information Protection and Electronic Documents Act (PIPEDA).

Collection and Disclosure of Personal Data

The personal information we collect and how we share it is described above in our Privacy Policy.

We may disclose your personal information to the following third parties for business purposes: Afterpay, Apple Pay, Blue Retargeting, Criteo, Facebook Pay, Google Ads, Google Pay, Impact, LinkedIn Ads, Meta Ad Network, Microsoft Ads, Microsoft Clarity, Obagi Affiliates, Odore, PayPal - Pay with PayPal, Venmo, Pay Later, Pinterest Ads, ProAffiliates, Shop Pay, Shopify Audiences, Snowplow, Tiktok Ads, UPS, USPS, Waldencast, and X Ads.

Privacy Rights

Individuals in Canada have the following rights regarding their personal information. Make a Privacy Request by clicking here. Once you submit a request, we will verify your identity and process your request in most cases within 30 days.

Right to Access

You have the right to be informed of the existence, use, and disclosure of your personal information and to be given access to that information.

Right to Correct

You have the right to contest the accuracy and completeness of the personal information we have about you, and to have it amended as appropriate.

Right to Withdraw Consent

You have the right to withdraw your consent to the collection, use, and disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice.

Right to Delete

You may request that we delete personal information we have obtained about you. However, we may retain your personal information if it is necessary for certain purposes, as allowed by law.

Right to Opt-Out

You have the right to opt out of the use of your personal information for targeted advertising.

You may exercise your right to opt-out.

Authenticating Your Request

Once we receive your request, we will verify the information you provided by matching the information that we have collected. If we cannot authenticate your request, we may ask for additional information from you. If you are unable to provide additional information, or we are unable to authenticate the request using commercially reasonable efforts, we may deny your request.

Cross-Border Transfers

Your personal information may be processed in foreign jurisdictions, including the United States, where it may be subject to access by foreign courts, law enforcement, and other government agencies, in accordance with the laws of those jurisdictions.

Contact

If you have any questions or concerns regarding how we handle your personal information, you may contact the following person at our organization:

General Counsel
moc.igabo@lagel

If you believe your rights have been violated and you are not able to resolve the issue directly with us, you may file a complaint with the Office of the Privacy Commissioner.