BeautyCreations™ Formulation Studio Privacy Notice

1. Who We Are
This Privacy Notice explains how Nouryon Specialty Chemicals B.V. (“Nouryon,” “we,” “us,” or “our”), with registered offices at Haaksbergweg 88, 1101 BZ Amsterdam, the Netherlands, collects, uses, and protects your personal information when you register for and use the BeautyCreations™ Formulation Studio at beautycreations.nouryon.com  (the “Portal”).

The Portal is operated on Nouryon’s behalf by Albert Invent Corp. (“Albert Invent”), located at 492 9th Street, Suite 310, Oakland, CA 94607, United States. Albert Invent processes your personal information as a processor acting on Nouryon’s instructions under a data processing agreement. Nouryon is the controller of your personal information collected through the Portal.

For questions about this Privacy Notice or your personal information, contact:

Global Privacy Officer
Email: nouryoncompliance@nouryon.com

Mail: Nouryon, 100 Matsonford Road, Building 1, Suite 500, Radnor, PA 19087, USA

For our full corporate Privacy Statement, including jurisdiction-specific data protection officer contacts, visit www.nouryon.com/privacy-statement.

2. Information We Collect
We collect the following categories of personal information through the Portal:

Registration Information (collected at account creation):
• First and last name
• Email address
• Company name
• Job title
• Country

Usage and Behavioral Information (collected automatically during your use of the Portal):

• Search queries, prompts, and conversations with the AI formulation assistant (“Ask Albert”)
• Formulations viewed, downloaded, or saved
• Products and ingredients browsed
• Navigation patterns, page views, and session duration
• Summary of your user journey on the Portal

Technical Information (collected automatically):

• IP address and approximate geographic location
• Device type, operating system, and browser type
• Access logs and timestamps
• Session identifiers

3. How We Use Your Information

We use your personal information for the following purposes:

(a) Providing the Portal and Formulation Services We use your registration and technical information to create and manage your account, authenticate your access, and deliver the AI-powered formulation discovery experience.

Legal basis (GDPR): Performance of contract (Art. 6(1)(b))

(b) Internal Business Analytics and Market Intelligence We analyze your usage and behavioral information to understand formulation trends, ingredient demand, and user engagement patterns. This analysis is performed internally by Nouryon’s Home and Personal Care marketing and sales teams through a restricted-access analytics dashboard. The analytics are used to:

• Identify trends in formulation, ingredient, and claims searches by application and region
• Measure Portal performance and user engagement
• Understand how user behavior on the Portal relates to market demand
• Support product development and marketing strategy decisions

Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)). Nouryon’s legitimate interest is in understanding how its customers and prospects use the Portal to improve its products, services, and commercial strategy. We have conducted a balancing assessment to ensure this interest does not override your rights and freedoms.

(c) Predictive Analytics and Profiling We use machine learning and statistical models to analyze patterns in Portal usage data, including search trends, formulation downloads, and prompt history, to forecast demand trends and identify potential market opportunities. This processing constitutes profiling as defined under applicable data protection laws.

The profiling is used to generate aggregated insights and trend forecasts for Nouryon’s internal teams. It is not used to make automated decisions that produce legal effects concerning you or that similarly significantly affect you. All commercial decisions informed by this analysis involve human review.

Legal basis (GDPR): Legitimate interest (Art. 6(1)(f))

(d) Portal Improvement and Security We use technical and usage information to maintain, secure, and improve the Portal, diagnose technical issues, and protect against unauthorized access.

Legal basis (GDPR): Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))

(e) Communications With your consent where required, we may send you updates about the Portal, new features, or related Nouryon products and services.

Legal basis (GDPR): Consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)), depending on jurisdiction.

4. AI-Powered Features

The Portal uses artificial intelligence, including large language models, to power the formulation discovery and “Ask Albert” conversational features. When you use these features, you are interacting with an AI system, not a human.

Your prompts, queries, and interactions with the AI features are processed to generate responses and are also used as described in Sections 3(b) and 3(c) above. AI-generated formulation suggestions and responses are not verified by Nouryon or Albert Invent for accuracy and should be independently evaluated before use.

Nouryon and Albert Invent do not use your personal information or Portal interactions to train, improve, or develop AI models without your prior written consent.

5. Profiling: How It Works and Your Choices

What profiling means in this context: We analyze your Portal usage patterns (what you search for, which formulations you view or download, and how you navigate the Portal) to generate insights about formulation and ingredient demand trends. This analysis uses machine learning and statistical models to identify patterns across our user base.

What profiling does not do in this context: The profiling does not produce decisions that have legal effects on you or similarly significantly affect you. It does not determine pricing, restrict your access to the Portal, or affect your ability to purchase Nouryon products. Commercial decisions informed by the analytics are made by Nouryon personnel with human review.

Your choices:

• Opt out of profiling for analytics purposes: You may request that your behavioral data not be included in our predictive analytics and trend analysis by contacting nouryoncompliance@nouryon.com. If you opt out, your registration data and ability to use the Portal will not be affected.
• Quebec residents: Profiling functions are deactivated by default for users located in Quebec. You will be asked to opt in to analytics profiling during registration. You may deactivate profiling at any time by contacting us.
• China residents: You may refuse to receive personalized content generated through automated decision-making by contacting us. You may also request an explanation of any automated decision that has a major influence on your rights and interests.

6. Who We Share Your Information With

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

7. International Data Transfers

Your personal information is transferred from your country of residence to the United States (where Albert Invent’s infrastructure is hosted) and to the Netherlands and United States (where Nouryon operates).

For transfers from the European Economic Area (EEA) or United Kingdom to the United States, we rely on the EU Standard Contractual Clauses (Module 2: Controller to Processor) as approved by European Commission Decision (EU) 2021/914, entered into between Nouryon and Albert Invent.

For transfers from China, we comply with PIPL cross-border transfer requirements, including conducting Personal Information Protection Impact Assessments and implementing standard contracts filed with the Cyberspace Administration of China where required.

For transfers from Brazil, we implement standard contractual clauses or other mechanisms approved by the ANPD.

For transfers from Quebec, we conduct privacy impact assessments before transferring personal information outside the province.

You may obtain a copy of the transfer safeguards by contacting nouryoncompliance@nouryon.com.

8. How Long We Keep Your Information

When personal information is no longer needed, we securely delete or anonymize it.

9. Your Rights

Depending on your location, you may have the following rights:

To exercise your rights, contact: nouryoncompliance@nouryon.com

We will respond within the timeframe required by applicable law (generally 30 days, or as specified in the applicable jurisdiction’s law). We may verify your identity before processing your request.

For a full list of supervisory authorities and jurisdiction-specific contacts, see Nouryon’s Privacy Statement.

10-. Cookies and Tracking Technologies

The Portal uses the following tracking technologies:

Non-essential cookies and tracking technologies are activated only after you provide consent through the Portal’s cookie consent mechanism. You may withdraw consent or adjust your preferences at any time through the cookie settings on the Portal, or by adjusting your browser settings.

FullStory may record mouse movements, clicks, scrolling, and certain keystrokes (excluding passwords) during your sessions. You may opt out of FullStory session replay by navigating to Settings within the Portal.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption of data in transit and at rest, access controls, multi-factor authentication, regular security assessments, and incident response procedures. Albert Invent maintains an information security program that includes ISO 27001 certification and annual ISAE 3402 Type II audits.

No system is completely secure. If you believe your account or data has been compromised, contact us immediately at nouryoncompliance@nouryon.com.

12. Children

The Portal is intended for business professionals and is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has registered for the Portal, contact us at nouryoncompliance@nouryon.com and we will delete the account.

13. Changes to This Notice

We may update this Privacy Notice to reflect changes in our practices, the Portal’s features, or applicable law. If we make material changes, we will notify you by email or through the Portal before the changes take effect. We encourage you to review this notice periodically.

14. Additional Jurisdiction-Specific Information

California residents (CCPA/CPRA): We do not sell your personal information or share it for cross-context behavioral advertising. You have the right to know the categories and specific pieces of personal information we collect, the right to delete, the right to correct, and the right to non-discrimination. For the categories of personal information collected and the business purposes for which they are used, see Sections 2 and 3 above.

South Korea residents (PIPA): Nouryon processes your personal information in accordance with the Personal Information Protection Act. You may exercise your rights to access, correction, deletion, and suspension of processing by contacting us. We will respond within 10 days.

Singapore residents (PDPA): Your personal information is processed in accordance with the Personal Data Protection Act 2012. You may exercise your rights to access and correction by contacting us. We will respond within 30 days.

UAE residents (PDPL): Your personal information is processed in accordance with Federal Decree-Law No. 45 of 2021. You may exercise your rights to access, rectification, erasure, restriction, portability, and objection by contacting us. We will respond within 14 days, which may be extended by an additional 14 days for complex requests.