Effective October 1, 2026.

KISS Products, Inc. and our employees, agents, subsidiaries, and affiliates (collectively, “KISS,” “we,” “our,” or “us”) are dedicated to safeguarding your personal information. This Privacy Policy aligns with our commitment to protecting your personal information across all of our websites, mobile apps, and other online properties that link to this Privacy Policy (the “Sites”), including arriausa.com.

This Privacy Policy applies only to the Sites, and covers only information collected in connection with your access to and use of the Sites. This Privacy Policy explains how we collect, use, disclose, and protect personal information and choices you can make about information you share.

For arriausa.com, the legal entity responsible for the processing described here is KISS Products, Inc. and its affiliates supporting ARRIA operations. This Policy explains our practices; using a Site does not itself constitute consent to every form of processing. Where applicable law requires consent, we will request it separately.

Personal information means information that identifies, relates to, describes, or can reasonably be linked to an individual or household, as defined by applicable law. It can include contact details, online identifiers, device information, purchase records and inferences, even when not stored with a name.

We may update this Policy by posting the revised Policy and effective date. We will provide additional notice and obtain consent to new uses of previously collected information where required by law. Posting an update alone is not consent.

We may collect information about you when you interact with the Sites, including when you log in, create an account, join our mailing list, make a purchase, request a service, request information, communicate with customer service, or upload content to the Sites through various means, including your social media account.

Examples of information we may collect:

• Contact information including name, addresses, email, and phone number
• Purchasing information including payment card information, billing and mailing addresses, and information about the products and services that you purchased
• Login credentials
• Demographic information including age/birth date, gender
• Social media handles
• Preferences regarding products and services
• Information that you choose to submit in connection with your comments or inquiries
• Photographs and other content that you provide

We may automatically collect information about how you interact with the Sites, including but not limited to: precise geolocation (with your knowledge and consent); location (based on IP address); browser type and version; operating system type; information you searched for on the Sites; pages you visited on the Sites; and the web page that referred you to our Sites. You may discontinue our collection and use of geolocation information by changing the settings on your browser or mobile device.

We may use information to:

• Facilitate your transactions, including processing and fulfilling purchases and shipping orders, and communicating about orders and order status
• Provide services you have requested
• Send you promotional and other communications, in accordance with applicable laws
• Respond to your inquiries
• Communicate with you about, and administer your participation in, special events, contests, sweepstakes, programs, offers, loyalty programs, surveys and market research
• Deliver advertisements based on your interests
• Provide you with an interactive social media experience
• Create and manage your account
• Help you locate distributors of our products

We may also use your information to ensure a secure online environment, comply with legal requirements, protect against and detect fraud, abuse, and other unlawful activity, enforce the Sites' Terms of Use and other corporate policies, and comply with all applicable laws and our reporting obligations.

To stop receiving marketing emails from us, please follow the “unsubscribe” instructions in the email you receive from us. We will process your request within 10 business days, or sooner if required by applicable law. We will communicate your request to service providers acting on our behalf where required.

For marketing sent independently by another business, use that business's unsubscribe process; this does not limit our own obligations under applicable law.

We may use third-party analytics services, such as Google Analytics, on our Sites. These providers may use technologies such as cookies to help us analyze visitors' use of our Sites. The information collected, including your IP address, may be disclosed to the analytics providers and other relevant third parties.

Our Sites do not respond to legacy Do Not Track browser signals. This is separate from legally recognized opt-out preference signals, such as Global Privacy Control, which we will honor where required by applicable law.

Our Sites may also use Google Analytics and Google advertising cookies together to collect data for advertising purposes; you can opt out using Google's Ad Settings. Advertising technologies may allow other parties to collect information about your activity over time and across websites. See the state privacy disclosures and available privacy choices described below.

We use cookies to record user-specific information on what pages users access or visit. A “cookie” is a small piece of data sent by a web server to your computer and stored by your browser. Cookies allow us to recognize your computer while you are on the Site and help customize your online experience, enable more efficient log-in, track transaction histories, and preserve information between sessions.

Most web browsers let you block or be notified of cookies; if you disable cookies, you may not be able to use certain personalized functions of this website.

Cookie types we may use include:

• Strictly necessary cookies — essential for features like account registration
• Performance cookies — to see which pages are visited most, which may process device or online identifiers
• Functionality cookies — to remember your preferences, such as text size or language
• Targeting cookies — to deliver advertisements and promotions relevant to your interests, linked to third-party services

For ARRIA orders and customer inquiries, we disclose relevant order, contact, shipping and return information to our affiliate operating as IVY Beauty (ivyusa.com), which supports order fulfillment, warehousing, shipping and customer service. We also disclose information to providers supporting site hosting, payment processing, delivery, customer support and returns, as needed for those services and subject to applicable law. Affiliate access for these operational purposes is separate from a merger or business transfer.

We reserve the right to disclose and transfer all information related to the Sites, including personal information, to a subsequent owner, co-owner, or operator of one or more of the Sites, or in connection with a corporate merger, consolidation, or restructuring or other corporate change, including during the course of any due diligence process.

KISS is a global company, subject to applicable laws, so your personal information may be stored and processed in a country other than your country of residence, including the United States. When we transfer personal information from the European Economic Area (EEA), the United Kingdom (UK) or Switzerland to non-EEA and UK countries, we rely on approved data transfer mechanisms, which may be requested by contacting hello@arriausa.com.

Under California Civil Code Section 1798.83, eligible California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes, subject to statutory exceptions. You may also ask us not to disclose your information for those purposes.

To opt out, email hello@arriausa.com or write to: Customer Service, 25 Harbor Park Drive, Port Washington, NY 11050 USA.

California residents under the age of 18 who are registered users of any Site may request removal of content they have publicly posted by sending a description of the information to hello@arriausa.com (removal is not guaranteed in all cases).

Depending on your residence and the laws applicable to our processing, you may have rights to access or know, obtain a portable copy of, correct or delete personal information, and opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling. Where applicable, you may also limit specified uses of sensitive personal information, use an authorized agent, and appeal a denied request. We will not unlawfully discriminate against you for exercising your rights.

You can send privacy requests to hello@arriausa.com. We may verify identity and an authorized agent's authority where permitted, and will respond within the time required by applicable law. You do not need to create an account to make a request.

Where an appeal right applies, email the same address with “Privacy Appeal” and identify the decision you wish to appeal; we will explain the outcome and applicable regulator complaint options.

This section applies where the GDPR governs our processing of your personal data. KISS is generally the “data controller” for personal data provided by you, and will always have a legitimate legal basis for processing (e.g., your consent, fulfilling your request, a legal obligation, or KISS's legitimate business interests).

We retain personal information only as long as needed for the purposes described in this Policy, including fulfilling orders, maintaining accounts, responding to inquiries, meeting legal and tax obligations, fraud prevention, and resolving disputes. Retention periods vary by category of data and applicable legal requirements. When information is no longer needed, we delete or de-identify it, subject to legal holds and backup systems.

You have certain rights regarding the personal data we maintain about you, which in some cases you can exercise directly:

• Request a copy of your personal data (in a structured, machine-readable format where applicable)
• Request correction, amendment, or deletion
• Request that we restrict use of your data
• Withdraw consent at any time where consent is our legal basis
• Object to processing based on our legitimate interests in certain circumstances

For requests governed by the GDPR, we will respond without undue delay and within one month. Where permitted because of complexity or number of requests, we may extend by two further months and will notify you within the first month, explaining the reason. Requests under other privacy laws are handled within their applicable deadlines. Access and correction requests are free unless repetitive, excessive, or unfounded.

If you are dissatisfied or have concerns about how we have handled your personal data, please contact us so we can try to resolve the issue. You also have the right to lodge a complaint with the applicable supervisory authority.

Please contact us with any questions or comments about our privacy practices or this Privacy Policy.

Email: hello@arriausa.com

Mailing address: KISS Products Customer Service, 25 Harbor Park Drive, Port Washington, NY 11050.