This Privacy Policy describes the privacy practices of Mora Ata and our subsidiaries and affiliates (collectively, "Mora Ata", "we", "us", or "our") in connection with the moraata.com website, the Mora Ata mobile application, and any other online services that we control and which post or link to this Privacy Policy (the "Service"), and the choices available to you with respect to your personal information.

For purposes of this Privacy Policy, unless otherwise stated, "personal information" means information relating to an identified or identifiable individual, and does not include aggregate information or information that does not identify you.

This Privacy Policy does not apply to the processing of personal information by third parties or personal information collected in the context of your employment with us.

Personal Information We Collect

We collect personal information about you in a variety of contexts, as described below.

Information you provide through the Service

When you use the Service, you may be asked to provide personal information to us, such as when you register an account, make a purchase, sign up for our marketing materials, participate in a promotion, respond to our surveys, or contact support. The categories of personal information we collect include:

• Contact identifiers — your first and last name, email address, postal address, and phone number.
• Characteristics of demographics — such as your age, date of birth, gender, and country.
• Commercial or transaction data — records of products or services you purchased, obtained, or considered, including your order history and order details.
• Profile data — your interests and preferences.
• Account credentials — your password, password hints, and other information for authentication or account access.
• Payment information — your payment instrument number (such as a credit or debit card number), expiration date, and security code as necessary to process your payments. This information is processed by our payment processors.
• Communications — any content you provide when you contact us with questions, feedback, survey responses, or otherwise correspond with us.
• User-generated content — any content you provide when you publicly post (including product reviews).
• Contact identifiers for other individuals — first and last name, email address, and postal address about others for whom you purchase an item or gift.

Please do not provide any personal information that we do not request.

Automatic collection from your browser or device

When you use the Service, we and the third parties we work with may automatically collect personal information from your browser or device. The categories of personal information we automatically collect include:

• Device identifiers — your device's IP address and Ad ID.
• Device data — your device's operating system type and version number, manufacturer and model, browser type, screen resolution, and regional and language settings.
• Internet activity data — your browsing history and interactions, pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, items placed in your shopping cart and items abandoned, access times, and duration of access.
• Non-precise location data — general location derived from an IP address that indicates city or postal code level.
• Precise location data — such as latitude/longitude, collected with your consent.

This automatic data collection is facilitated by cookies and similar technologies incorporated into our Service. See our Cookie Policy for details.

Information from business relationships

Through our business relationships with you, we collect personal information about you, such as your contact information. This information is not subject to this Privacy Policy except as required by applicable law.

Information from other sources

We also collect personal information about you from other sources, including:

• Business partners — such as those engaged in joint marketing or promotional activities.
• Data providers — such as data licensors of private and public databases.
• Public sources — such as blogs, forums, or where data is in the public domain.
• Third-party vendors and advertising partners.
• Social media platforms — with which you interact. For example, when you engage with our content on social media (such as through our brand page or direct message), we may collect personal information such as your contact identifiers and any comments you provide. If you publicly reference our Service on social media, we may use your reference on or in connection with our Service.

Information we infer

We infer new personal information from other information we collect, including by generating information about your likely preferences or other characteristics.

Sensitive personal information

To the extent any of the categories of personal information we collect are sensitive categories under applicable law, we process such personal information only for the limited purposes permitted by applicable law. We do not sell or use sensitive categories of personal information for purposes of targeted advertising or to make inferences.

How We Use Your Personal Information

We collect and use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

Service delivery

We use your personal information to:

• Provide and operate the Service, including enabling you to make purchases of skincare and beauty products listed on the Service;
• Establish and maintain your account on the Service;
• Communicate with you about the Service, including by sending you announcements, updates, security alerts, and support and administrative messages;
• Provide customer support and maintenance for the Service; and
• Enable security features of the Service, such as sending you security codes via email or SMS (if you have opted in), and remembering devices from which you have previously logged in.

Direct marketing

We use your personal information to send Mora Ata-related marketing communications as permitted by law. You will have the ability to opt out of our marketing and promotional communications as described in the Your Privacy Choices section below.

Research and development

We utilize your personal information for research and development purposes, which include analyzing and improving the Service and our business through methods such as surveys, cookies, and other technologies. You may have the ability to limit some analytics through cookies and other technologies as described in the Your Privacy Choices section below.

Promotions

When you voluntarily enter a promotion, we use information as set out in the official rules that govern the promotion, as well as for administrative purposes and as required by law. By entering a promotion, you agree to the official rules that govern that promotion, and that, except where prohibited by applicable law, we, the sponsor, and related entities may use your name, voice, and/or likeness in advertising or marketing materials.

Advertising

We work with agencies, ad networks, technology providers, and other third-party advertising companies to display ads on our Service and other websites and services. We incorporate cookies and similar technologies to automatically collect personal information about you over time across our Service and other non-affiliated sites, and use that personal information to serve ads that we think may interest you ("targeted advertising"). You can learn more about your choices regarding targeted advertising in the Your Privacy Choices section below and our Cookie Policy. We also use audience matching services to reach people who have visited our Service or are identified in one or more of our databases, by providing a list of hashed email addresses to a third party or incorporating a pixel from a third party into our own Service.

For compliance, fraud prevention, and safety

We use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to protect our rights, your rights, or the rights of others, and to comply with applicable law.

How We Disclose Your Personal Information

We disclose your personal information to the following categories of persons for the purposes described in this Privacy Policy or at the time of collection:

Affiliates

Our subsidiaries and affiliates, for purposes consistent with this Privacy Policy.

Service providers

Companies and individuals that process personal information to provide services on our behalf (such as order fulfillment, shipping, payment processing, customer support, hosting, analytics, email delivery, marketing, database management services, returns processing, and risk and fraud mitigation). To the extent required by law, we contractually prohibit our service providers from retaining, using, or disclosing information about you for any purpose other than performing the services for us.

Third-party vendors

Some of the third-party vendors we work with independently control the purposes and means of processing your personal information. For example, specific analytics, security, and fraud prevention vendors.

Advertising partners

Third-party agencies, ad networks, technology providers, and other advertising partners receive personal information from us for advertising purposes, including targeted advertising. You can learn more about your choices regarding targeted advertising in the Your Privacy Choices section below and our Cookie Policy.

Business partners

Business partners in connection with offering co-branded services, selling or distributing our products, or engaging in joint marketing or promotional activities.

The public

Other users of the Service and the public, when you disclose personal information for public use. For instance, you can review a product that you purchased, and we will display your name along with the content you submit. We do not control how other users or third parties use any personal information that you make available to them.

Professional advisors

Professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others for security and enforcement

Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate to comply with law or for compliance, fraud prevention, and safety purposes.

Business transferees

We may disclose some or all of your personal information in connection with or during negotiation of any merger, financing, acquisition, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets, or in the event of an insolvency, bankruptcy, or receivership.

Recipients at your direction or with your consent

We disclose personal information where you direct us to or with notice to you and your consent. Please note that we do not control the third party's use of your personal information.

Sometimes we aggregate or de-identify information so it is no longer considered personal information. We may disclose non-personal information for any purpose to the extent permitted by law.

Your Privacy Choices

We provide a variety of ways for you to exercise choice, as described below.

Region-specific rights

Some regions provide additional rights by law, as described in our region-specific terms below.

• Data Subject Requests. To access, correct, delete, or exercise similar rights available to you in your region with respect to your personal information, please submit a request at privacy@moraata.com.
• Opt out of sales, shares, and targeted advertising. To opt out of sales or shares (as those terms are defined by applicable law), or the processing of personal information for targeted advertising purposes, manage your settings through the "Your Privacy Choices" link in the footer of our website or turn on a recognized opt-out preference signal, such as Global Privacy Control, in your browser or extension. If you want the opt-out to apply to personal information we have about you in our systems, please also submit a request at privacy@moraata.com.

Communications

• Email. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions located at the bottom of the email. You may continue to receive service-related and other non-marketing emails.
• Text. If you opt in to receive text messages from us, you may opt out of receiving further text messages from us by replying STOP in response to a message.
• Push notifications. You may opt out of push notifications by adjusting your device settings or uninstalling our apps.

Accounts

If you have registered an account with us, you may review and update certain personal information in your account profile or delete your account in its entirety through your account settings.

Controls for cookies and pixels

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for targeted advertising. To do this, follow the instructions in your browser settings. For more information, visit www.allaboutcookies.org.
• Preference signals. Your browser or extension may allow you to automatically transmit Do Not Track and other preference signals. Except as required by law, we do not respond to preference signals.
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used for targeted advertising by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin.
• Third-party opt-out tools. Some of the third parties we work with offer their own opt-out features:
  • Google Analytics Opt-out and Google Ad Settings
  • Facebook Ad Preferences
  • Criteo Opt-out
• Advertising industry opt-out tools. To opt out of receiving targeted advertising from participating companies, please visit:
  • Digital Advertising Alliance
  • Network Advertising Initiative
  • For European users: youronlinechoices.eu

Controls for app technologies

• Resetting advertising ID. Your device settings may provide functionality to reset the advertising ID associated with your device. You can also stop all collection of information via an app by uninstalling the app.
• Advertising industry opt-out tools. The Digital Advertising Alliance gives users the ability to opt out of receiving targeted advertising from participating members in mobile apps. To opt out, please install the AppChoices mobile app, available at youradchoices.com/appchoices.
• Precise-location technologies. Users of our app can disable our access to their device's precise location data in their device settings or by uninstalling the app.

Matched Ads

To opt out of us disclosing your hashed email address to third parties for Matched Ads purposes, please submit a request at privacy@moraata.com. To the extent required by law, we will remove your email address from any subsequent lists disclosed to third parties for Matched Ads purposes.

Third Parties

The Service may contain links to other websites and online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party websites or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use, and sharing of your personal information. We encourage you to read the privacy policies of the other websites and online services you use.

Security Practices

We employ organizational, technical, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

Retention

We retain information for the length of time that is reasonably necessary for the purpose for which it was collected, and as required to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

International Data Transfers

Mora Ata is headquartered in the United States and may have service providers in other countries. Your personal information may be transferred to the United States or other locations outside of your state, province, country, or other governmental jurisdiction where privacy laws may not be as protective as those in your jurisdiction. Where required by applicable law, we will provide appropriate safeguards for data transfers, such as through the use of standard contractual clauses.

Children

The Service is not intended for use by children under 13 years of age, and we do not knowingly collect personal information (as that term is defined by the U.S. Children's Privacy Protection Act, or "COPPA") from children under age 13. If you are a parent or guardian and believe we have collected personal information from children, please contact us as set out in the Contact Us section. We will delete the personal information in accordance with COPPA.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service. If required by law, we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email or another manner through the Service. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your continued use of the Service after the posting of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

Contact Us

If you have any questions, or have trouble accessing this Privacy Policy, please contact us:

To exercise choice, use the methods described in the Your Privacy Choices section above or your region-specific terms below.

Notice to California Residents

We are required by the California Privacy Rights Act ("CPRA") to provide to California residents an explanation of how we collect, use, and disclose their personal information, and of the rights we offer to California residents with respect to that personal information. For purposes of this section, "personal information" has the meaning given in the CPRA.

The following sections describe our practices with respect to personal information subject to the CPRA:

• For the categories of personal information we have collected in the past 12 months, see the Personal Information We Collect section above.
• For the categories of sources from which personal information is collected, see the Personal Information We Collect section above.
• For the specific business and commercial purposes for collecting and using personal information, see the How We Use Your Personal Information section above.
• For the categories of third parties to whom information is disclosed, see the How We Disclose Your Personal Information section above.
• For the criteria used to determine the period of time personal information will be retained, see the Retention section above.
• We do not sell personal information as that term is traditionally understood. However, some of our disclosures of personal information may be considered a "sale" or "share" as those terms are defined under the CPRA. We collect, sell, or share the following categories of personal information for commercial purposes: contact identifiers, characteristics or demographics, commercial or transactions data, profile data, device identifiers, device data, internet activity data, non-precise location data, and inferences drawn from any of the above. We do not knowingly sell or share the personal information of minors under 16 years old who are California residents.

Some of the personal information we collect may be considered sensitive personal information under CPRA — for example, account credentials. We collect, use, and disclose such sensitive personal information only for the permissible business purposes for sensitive personal information under the CPRA. We do not sell or share sensitive personal information.

Rights to Know, Correct, and Delete

The CPRA grants California residents the following rights. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

• Right to Know. You have the right to know what personal information we have collected about you, including the categories of personal information, the categories of sources, the business or commercial purposes for collecting it, the categories of personal information that we sold or disclosed for a business purpose, the categories of third parties to whom we disclosed personal information, and the specific pieces of personal information we have collected about you.
• Correction. You have the right to correct inaccurate personal information we have collected from you.
• Deletion. You have the right to delete the personal information that we have collected from you.

You are entitled to exercise the rights described herein free from discrimination.

To exercise any of these rights, please follow the instructions for data subject requests in the Your Privacy Choices section above. We will confirm receipt of your request within 10 business days and respond to your request within 45 days. We reserve the right to confirm your California residence to process your requests and will need to verify your identity to process your requests. If we are unable to verify your identity, we may deny your request in accordance with the CPRA.

Right to Opt-Out of Sales and Sharing

To the extent we "sell" or "share" your personal information as those terms are defined under the CPRA, you have the right to opt out. To exercise this right, please follow the instructions for opting out of sales, shares, and targeted advertising in the Your Privacy Choices section above.

Authorized Agent

Consistent with California law, you may designate an authorized agent to request on your behalf. Except for requests made by opt-out preference signal, we will require written and signed proof of the agent's permission to do so and may verify your identity directly with you. Requests must be submitted through the designated methods listed above.

Shine the Light

California's "Shine the Light" law (California Civil Code § 1798.83) allows California residents to ask companies with whom they have formed a business relationship primarily for personal, family, or household purposes to provide certain information about the companies' sharing of certain personal information with third parties for their direct marketing purposes during the preceding year (if any). You can submit such a request by contacting us as set out in the Contact Us section with "Shine the Light" in the subject line. The request must include your current name, street address, city, state, and zip code, and attest to the fact that you are a California resident.

Notice to Colorado, Connecticut, Utah, and Virginia Residents

These additional rights and disclosures apply only to residents of Colorado, Connecticut, Utah, and Virginia. Terms have the meaning ascribed to them in the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), and the Virginia Consumer Data Protection Act ("VCDPA"), as applicable.

In your region, you have the following rights under applicable law:

• To confirm whether or not we are processing your personal data
• To access your personal data
• To correct inaccuracies in your personal data
• To delete your personal data
• To obtain a copy of your personal data that you previously provided to us in a portable and readily usable format

To exercise any of these rights, please follow the instructions for data subject requests in the Your Privacy Choices section above. We will respond to your request within 45 days. We do not process personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.

You also have the right to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data. To exercise this right, please follow the instructions for opting out of sales, shares, and targeted advertising in the Your Privacy Choices section above.

You can designate an authorized agent to submit requests on your behalf. Except for requests made by opt-out preference signal, we will require written and signed proof of the agent's permission to do so. Requests must be submitted through the designated methods listed above.

If we refuse to take action on a request, you may appeal our decision within a reasonable period of time by contacting us at privacy@moraata.com and specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal. If the appeal is denied, you may submit a complaint as follows:

• Colorado residents — Colorado Attorney General
• Connecticut residents — Connecticut Attorney General
• Virginia residents — Virginia Attorney General

Notice to Nevada Residents

We do not sell and will not sell your covered information as those terms are defined by Nevada privacy law.

Notice to European Users

The disclosures provided in this section apply only to individuals in the European Economic Area, Switzerland, or the United Kingdom (collectively, "Europe").

Personal data

Except as otherwise specified, references to "personal information" in this Privacy Policy are equivalent to "personal data" governed by European data protection legislation.

Controller

The controller of your personal data covered by this Privacy Policy for purposes of European data protection legislation is Mora Ata, 4747 Research Forest Dr, Suite 180-573, The Woodlands, TX 77381, United States of America.

Legal bases for processing

The legal bases of our processing of your personal data will depend on the type of personal data and the specific context in which we process it. The legal bases we typically rely on are:

• Service delivery — Processing is necessary to perform the contract governing our operation of the Service or to take steps that you request prior to engaging our services.
• Marketing & interest-based advertising — Processing is based on your consent where required by applicable law, or otherwise on our legitimate interests in promoting our business and showing you tailored relevant content.
• Research and development / compliance / fraud prevention and safety — These activities constitute our legitimate interests.
• To comply with laws and regulations — Processing is necessary to comply with our legal obligations.
• With your consent — Where we rely on your consent, you have the right to withdraw it at any time in the manner indicated when you consent or in the Service.

Use for new purposes

We may use your personal data for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and explain the applicable legal basis.

Sensitive personal data

Unless we specifically request it, we ask that you not provide us with any sensitive personal data (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership) on or through the Service, or otherwise to us.

Retention

We retain personal data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize it or, if this is not possible, securely store it and isolate it from any further processing until deletion is possible.

Your rights

European data protection laws give you certain rights regarding your personal data. You may ask us to take the following actions:

• Access — Provide you with information about our processing of your personal data and give you access to your personal data.
• Correct — Update or correct inaccuracies in your personal data.
• Delete — Delete your personal data.
• Transfer — Transfer a machine-readable copy of your personal data to you or a third party of your choice.
• Restrict — Restrict the processing of your personal data.
• Object — Object to our reliance on our legitimate interests as the basis of our processing of your personal data that impacts your rights.

To exercise any of these rights, please follow the instructions for data subject requests in the Your Privacy Choices section above. If you would like to submit a complaint about our use of your personal data, you may Contact Us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

Cross-border data transfer

If we transfer your personal data out of Europe to a country outside of Europe such that we are required to apply additional safeguards under European data protection laws, we will do so.

Cookie Policy

This Cookie Policy explains how Mora Ata uses cookies and similar technologies in connection with the Service. By using the Service, you are consenting to us transmitting information as set out in this Privacy Policy through cookies and similar technologies to third parties.

What are cookies?

Cookies are small data files that are placed on your browser when you visit a website, open or click on an email, or interact with an advertisement. Cookies serve different purposes, like helping us understand how a site is being used, letting you navigate between pages efficiently, remembering your preferences, personalizing your browsing experience, preventing fraud and helping secure the website, performing measurement and analytics, and providing advertising.

Our Service may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your device until they expire on a set expiration date or you delete them). We use two broad categories of cookies: (1) first-party cookies, served directly by us to your device, and (2) third-party cookies, which are served by service providers and third parties we work with.

What are pixels?

Pixels (also known as web beacons) are code embedded within a service. There are various types of pixels, including image pixels (which are one-pixel transparent images) and JavaScript pixels (which contain JavaScript code). Pixels are often associated with cookies and provide similar functionality. When you access a service that contains a pixel, the pixel may permit us or a third party to drop or read cookies on your browser or collect other information about your browser or device.

What types of cookies and pixels does Mora Ata use?

• Strictly necessary. These cookies and pixels are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms.
• Performance. These cookies and pixels allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site.
• Functional. These cookies and pixels enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages.
• Advertising. These cookies and pixels may be set through our site by us or our advertising partners. They may be used to build a profile of your interests and show you relevant ads on our site and other sites. They also may be used to prompt you with messaging such as cart abandonment messages.
• Social media. These cookies and pixels are set by a range of social media services that we have added to the site. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit.

App technologies

We use technologies included in our apps that are not browser-based like cookies and cannot be controlled by browser settings. For example, our apps may include Software Development Kits (SDKs), which are pieces of code provided by third parties to collect information about your browser or device. SDKs may enable third parties to collect information directly via our apps.

Precise location technologies

With your consent, we may get access to the precise location technologies on your device (such as GPS or Bluetooth) and collect precise location data from your browser or device. Precise location data may be used for purposes such as verifying your device's location and delivering or restricting relevant content and advertising based on that location.

For details on your choices with respect to cookies and similar technologies, including for analytics and targeted advertising, please see the Your Privacy Choices section.