Applicant Privacy Notice

Introduction

Olaplex, Inc. and its affiliates("Olaplex", "we", "us" and "our") respect your concerns about privacy. This Job Applicant Privacy Notice describes the types of personal information we collect about all current and former applicants and interview candidates ("applicants" or "you" or "your"), and third parties whose information you provide to us in connection with your application (e.g., next-of-kin, emergency contact information).

Olaplex will be the data controller of your personal information. In addition, where processing of personal information is undertaken by other associated companies of Olaplex for their own independent purposes, these associated companies may be co-controllers of your personal information.

This Privacy Notice describes the categories of personal information we may process, how your personal information may be processed, for what purposes we process your data and how your privacy is safeguarded. This Privacy Notice does not form part of a contract of employment or engagement.

If you have any questions about this Privacy Notice please contact DataPrivacy@Olaplex.com.

What data do we process?

We collect various types of personal information about you for the purposes described in this Privacy Notice including:

• personal details: your title and name, birth name, preferred name, any additional names, gender, home contact details (e.g., address, telephone or mobile number, e-mail), immigration and eligibility to work information, details of any disability and any reasonable adjustments required as a result;

• recruitment and selection data: skills and experience, qualifications, references, CV and application, record of interview, interview notes and assessment, vetting and verification information, right to work verification, information related to the outcome of your application, details of any offer made to you;

• equality and diversity data: where permitted by law and provided voluntarily, data regarding gender, race, nationality, and sexuality (stored anonymously for equal opportunities monitoring purposes); and

• any other personal information which you choose to disclose to Olaplex personnel during the course of the application process whether verbally or in written form (for example in work emails).

Certain additional information will sometimes be collected where this is necessary and permitted by applicable local laws.

Some of the information collected by Olaplex and described above constitutes special category data (also known as sensitive data). Sensitive data includes information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health, trade union membership, sex life or sexual orientation, biometric or genetic information, and information relating to criminal records, offences or proceedings. Olaplex only collects personal information when permitted or required to do so by law, in circumstances described below.

How does Olaplex collect data?

Olaplex collects and records your personal information from a variety of sources, but mainly directly from you (e.g., when you apply for a job through our websites) or from our service providers that handle applications on our behalf.

We also obtain some information from third parties, for example, references from a previous employer or recruitment agencies (where permitted by applicable law).

Where we ask you to provide personal information to us on a mandatory basis, we will inform you of this at the time of collection. Failure to provide any mandatory information may mean that we cannot carry out our recruitment process.

Apart from personal information relating to you, you may also provide Olaplex with personal information of third parties, such as contact information of individuals listed as referees in your application. Before you provide such third party personal information to Olaplex you must first inform these third parties of any such data which you intend to provide to Olaplex and of the processing to be carried out by Olaplex, as detailed in this Privacy Notice.

What are the purposes for which data are processed?

We collect and process your personal information because it is in our legitimate business interests to consider your suitability for a role within Olaplex. These legitimate business interests include:

• recruitment and selection, including to:

• assess your skills, qualifications, and suitability for the role;

• carry out reference checks, where applicable;

• make a job offer and provide a contract of employment;

• on-board you as an employee where you accept an offer of employment from us;

• contact you if you are not successful should another potentially suitable vacancy arise following the completion of the recruitment process for the role you applied for;

• keep records related to our hiring processes;

• comply with legal or regulatory requirements, including checking your legal right to work;

• communicate with you about the recruitment process; and

• deal with any query, challenge or request for feedback received in relation to our recruitment decision.

• protecting the private, confidential and proprietary information of Olaplex, its employees, its clients and third parties;

• to enforce our legal rights and obligations, and for any purposes in connection with any legal claims made by, against or otherwise involving you;

• to comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country; and

• for other purposes permitted by applicable laws, including legitimate interests pursued by Olaplex where these are not overridden by the interests or fundamental rights and freedoms of applicants and where these have been explained to you before the relevant data is collected or the processing is carried out.

We may also need to process your personal information to decide whether to enter into a contract of employment (or other arrangement) with you, or in order to take steps at your request prior to entering into such a contract.

In certain circumstances, we may also rely on your consent for the purposes of processing your job application. Where we rely on your consent, we will notify you of this at the point at which we collect your personal information.

Sensitive data may be collected and processed by Olaplex for the following purposes:

• documentation such as work permits, details of residency, proof of citizenship will be processed to assess and review eligibility to work for Olaplex in the jurisdiction in which you work. We process this information where (i) we have your explicit consent to do so, (ii) it is in the public interest to do so, such as, to determine whether an individual has committed an unlawful act or has been involved in dishonesty, malpractice or other serious misconduct, or (iii) we need to process this information to exercise rights and perform obligations in connection with your employment with Olaplex;

• information about your health, including any medical condition, health and disability to consider whether we need to provide appropriate adjustments during the recruitment process. We need to process this information to exercise rights and perform obligations in connection with your employment with Olaplex;

• your racial or ethnic origin, religious or philosophical beliefs, sexual orientation or disability status may be used for the collection of statistical data subject to local laws. The provision of this information is optional and we process this information where we have your explicit consent to do so, or where it is in the public interest to do so, such as, to ensure meaningful equal opportunity or diversity monitoring and reporting within Olaplex; and

• Any information that is required in order for us to establish, exercise or defend legal claims.

Additional information regarding specific processing of personal information may be notified to you.

Personal information relating to criminal convictions and offences will only be processed where authorised by applicable laws. For example, a criminal record check may be carried out on recruitment.

Retention of personal information

Olaplex retains personal information for as long as is required to satisfy the purpose for which it was collected by us or provided by you. This will usually be the period of the application process. We may keep some specific types of data, for example, your CV, for longer where we have a legitimate business reason to do so, such as to contact you for future opportunities.

Disclosures of personal information

We share your personal information with other Olaplex affiliates and Advent International, Inc, and any of their employees where it is necessary to do so for any of the purposes described in this Privacy Notice.

Olaplex also shares personal information with service providers that perform services on our behalf, such as our recruitment platform provider; our Professional Employer Organization (if a candidate is hired); HR and recruitment service providers; accounting, payment and expense reimbursement providers; travel providers; professional advisors (e.g., lawyers and accountants), and electronic signature providers. In accordance with applicable law, we have entered into legally binding agreements requiring our service providers to use and disclose personal information only as necessary to perform services on our behalf or to comply with applicable legal requirements.

In addition, we may disclose personal information about you (a) if we are required or permitted to do so by law or legal process, for example due to a court order or a request from a law enforcement agency, (b) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, (c) in connection with an investigation of suspected or actual fraudulent or other illegal activity, and (d) in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution, or liquidation).

Security of data

We have implemented appropriate technical, physical and organisational measures to secure your personal information in accordance with applicable laws.

International Transfer of Personal information

From time to time your personal information (including sensitive data) will be transferred to associated companies of Olaplex to process for the purposes described in this Privacy Notice. This will be applicable for example where the relevant company or a manager from that company is responsible for conducting or approving the relevant process or the data is part of a global directory where other individuals need to have access. These associated companies or managers are located elsewhere in the world (for example, Olaplex, Inc. is located in the United States).

Personal information may also be transferred to third parties (e.g., service providers, as set out above), who may have systems or suppliers located outside the UK or EU. As a result, in some circumstances your personal information will be transferred to countries outside of the EU or UK whose data protection laws may be less stringent than in the EU or UK. By submitting your personal information to us you agree to the transfer, storage and processing of your personal information in a country other than your country of residence including, the United States.

Your rights as a data subject

Subject to applicable law, you may have the right to request:

• confirmation of whether we process personal information relating to you and, if so, to request a copy of that personal information;

• that we rectify or update your personal information that is inaccurate, incomplete or outdated;

• that we cease to process certain personal information where you object to its use and we do not have an overriding legitimate interest in carrying out the processing and it is not necessary for the establishment, exercise or defence of legal claims;

• that we erase your personal information in certain circumstances, such as where we collected personal information on the basis of your consent and you withdraw that consent, or when you object to use of your personal information;

• that we restrict the use of your personal information in certain circumstances, such as while we consider another request that you have submitted, for example a request that we update your personal information;

• withdrawal of your consent where you have given us consent to process your personal information; and

• that we provide a copy of your personal information to you in a structured, commonly used and machine readable format in certain circumstances.

If you wish to exercise any of your data protection rights or if you consider that we have processed your personal information in violation of applicable law, please contact us at dataprivacy@olaplex.com.

If you consider that we have processed your personal information in violation of applicable law and failed to remedy such violation to your reasonable satisfaction, you may also lodge a complaint with the relevant data protection authority in your jurisdiction.

Notice of changes

Olaplex may change or update this Privacy Notice at any time. We will notify you of any material changes to this Privacy Notice to the extent required to do so by applicable law.

This Privacy Notice was last updated on 5 May 2021.