BRAZIL Lei Geral de Proteção de Dados

Purpose and General Principles

In accordance with Lei Geral de Proteção de Dados ("LGPD"), controllers of certain personal information have a duty to provide users located in Brazil with specific information and disclosures concerning how Spa & Bath Holdings, Inc. handles personal data and their data rights.

This PRIVACY NOTICE FOR BRAZIL RESIDENTS supplements the information contained in the Privacy Statement of Spa & Bath Holdings, Inc. Technologies, Inc. and its subsidiaries and applies solely to visitors, users, and others who reside in Brazil (“Brazil data subjects”). We adopt this notice to comply with LGPD. Any terms defined in the LGPD have the same meaning when used in this notice.

Rights Afforded Under LGPD

Controllers of certain personal information have a duty to provide users located in Brazil with access to specific information and disclosures concerning how personal data and data rights may be applicable. This section describes LGPD provides Brazilian data subjects with specific rights regarding their personal information:

• A right to the specific purpose, type, and duration of the processing, along with industrial secrecy;
• A right to accuracy, clarity, relevancy and updating of the data, in accordance with the need and for achieving the purpose of the processing;
• A right to the use of technical and administrative measures which are able to protect personal data from unauthorized accesses and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination;
• A right to confirmation of the existence of the processing;
• A right to free access to the data;
• A right to nondiscrimination;
• A right to information regarding the shared use of data by the controller along with the purpose, including ported data, along with observation of legal rights within by LGPD are observed by third parties;
• A right to facilitated and free of charge consultation about the form and duration of the processing, as well as about the integrity of their personal data;
• A right to correction of incomplete, inaccurate, or out-of-date data;
• A right to anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance of this law;
• A right to portability of the data to another service provider or product provider;
• A right to deletion of personal data, with consent of the data subject; and
• A right to information about the possibility of denying consent and the consequences of such actions.
• A right to revocation of consent:
  • before the national authority,
  • carried out based on one of the situations of waiver of consent, if there is noncompliance with the provisions of the LGPD, 
  • as an express request by the data subject or their legally constituted representative to the processing agent, or
  • if it is impossible to immediately adopt the measure, the controller shall send a reply to the data subject in which they may:
  
  — communicate that they are not the data processing agent and indicate, whenever possible, who the agent is; or

  — indicate the reasons of fact or of law that prevent the immediate adoption of the measure.

Processing of Children’s Data

The processing of children’s personal data shall be performed with specific and highlighted consent given by at least one of the parents or the legal representative.

Contact Information

If California, Nevada, or Brazil data subjects have any questions or comments about this notice, our Privacy Policy, the ways in which we collect and use personal information, choices and rights regarding such use, or wish to exercise rights, as applicable, please do not hesitate to contact us via the channels found under How To Contact Us in this Privacy Policy.