HAIR ANTI AGING RESEARCH

The data controller responsible for your personal data is:

Pardaco Cosmeceuticals Pte. Ltd. (Pardacos)

5022 Ang Mo Kio Ind Park 2, #04-37, Singapore 569525

UEN: 198205084M

Email: enquiries@haar.com.sg

If you have any questions or concerns about how we handle your personal data, please contact us at the above email address.

We collect personal data that you provide to us directly, as well as data collected automatically when you use our website. This may include:

We use your personal data only for purposes that are reasonable and appropriate in the context in which it was collected. Specifically, we use it to:

• Process and fulfil your orders, including payment processing and delivery coordination;
• Create and manage your customer account and loyalty programme membership;
• Send you order confirmations, shipping updates, and customer service communications;
• Send you email marketing communications, including promotions, product launches, and brand updates, where you have opted in or where permitted under applicable law;
• Personalise your experience on our website and tailor product recommendations;
• Analyse website usage and performance through analytics tools to improve our website and services;
• Detect, prevent, and investigate fraudulent, unauthorised, or illegal activity;
• Comply with our legal obligations under Singapore law and any applicable regulations.

Under the PDPA, we process your personal data on the following bases:

• Contractual necessity: to process your orders and manage your account;
• Legitimate interests: to improve our website, prevent fraud, and provide customer support;
• Consent: for email marketing communications and non-essential cookies. You may withdraw consent at any time (see Section 8).

We do not sell, rent, or trade your personal data to third parties. We may share your personal data only in the following limited circumstances:

As we ship to selected countries within Southeast Asia, some of your personal data (such as delivery address and contact details) may be transferred to and processed in countries outside Singapore in connection with order fulfilment.

We will only transfer your personal data to third parties in other countries where we are satisfied that adequate levels of protection are in place, consistent with the requirements of the PDPA. Where required, we will put in place appropriate safeguards, such as contractual data protection clauses, to protect your information.

If you are located outside Singapore, please note that the data protection laws of your country may differ from Singapore's PDPA. Where applicable, we will endeavour to comply with the applicable data protection legislation in your country of residence. By using our website and providing us with your personal data, you acknowledge and consent to the transfer and processing of your data as described in this Policy.

We use cookies and similar tracking technologies on our website to enhance your browsing experience, understand how visitors interact with our site, and support our marketing activities. Cookies are small text files stored on your device. We use the following types of cookies:

• Essential cookies: necessary for the website to function correctly, including shopping cart and checkout functionality. These cannot be disabled.
• Analytics cookies: tools such as Google Analytics to collect anonymised data on website traffic and user behaviour, helping us improve our website and services.
• Marketing cookies: used to track the effectiveness of our marketing campaigns and personalise content where applicable.

You can control or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of our website. For more information on how Google Analytics handles your data, please refer to Google's Privacy Policy.

Under the PDPA, you have the right to:

• Access: request a copy of the personal data we hold about you;
• Correction: request that we correct any inaccurate or incomplete personal data;
• Withdrawal of consent: withdraw your consent to the collection, use, or disclosure of your personal data at any time, subject to legal or contractual restrictions;
• Erasure: request deletion of your personal data where we no longer have a lawful basis to retain it;
• Opt-out of marketing: unsubscribe from our email marketing at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us directly.

To exercise any of the above rights, please contact us at enquiries@haar.com.sg. We will respond to your request within 30 days. Please note that withdrawal of consent may affect our ability to provide certain services to you.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. In general:

• Order and transaction data is retained for a minimum of 5 years for accounting and legal compliance purposes;
• Customer account data is retained for as long as your account remains active, and for a reasonable period thereafter;
• Marketing preference data is retained until you withdraw consent or unsubscribe;
• Analytics data is retained in aggregated or anonymised form and does not identify individual users.

When you participate in our loyalty programme, we collect and use your data — including purchase history, points earned and redeemed, and tier status — for the following purposes:

• To administer and track your loyalty membership and points balance;
• To personalise offers, rewards, and communications relevant to your membership tier;
• To analyse programme engagement and improve our loyalty offering.

Your loyalty programme data is not sold or shared with third parties for their independent marketing purposes. It may be processed by our loyalty platform provider, who is bound by appropriate data protection obligations. If you close your account or request deletion of your data, your loyalty points balance will be forfeited and cannot be reinstated. Residual transaction data required for accounting or legal compliance will be retained for the period specified in Section 9, even following account closure.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include secure HTTPS encryption on our website, restricted internal access to personal data, and the use of reputable third-party payment processors that comply with PCI-DSS standards.

While we take reasonable steps to safeguard your data, no method of transmission over the internet is completely secure. We cannot guarantee absolute security, and you provide your personal data at your own risk.

In the event of a data breach that is notifiable under the PDPA, we will notify the Personal Data Protection Commission (PDPC) within 3 calendar days of assessing that the breach is notifiable. Where the breach is likely to result in significant harm to affected individuals, we will also notify those individuals as soon as reasonably practicable. Notifications will include the nature of the breach, the data affected, and the steps we are taking to address it.

Our website and products are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at enquiries@haar.com.sg and we will take steps to delete such data promptly.

Our website may contain links to third-party websites, including social media platforms and partner sites. This Privacy Policy applies only to our website. We are not responsible for the privacy practices or content of any third-party websites, and we encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated Policy will be posted on this page with a revised effective date. We encourage you to review this page periodically. Your continued use of our website following any update constitutes acceptance of the revised Policy.

Where changes are material, we will make reasonable efforts to notify you, such as by displaying a notice on our website or sending an email to registered account holders.

If you have any questions, concerns, or complaints about this Privacy Policy or our personal data practices, please contact our Data Protection Officer at:

Pardaco Cosmeceuticals Pte. Ltd. (Pardacos)

Attn: Data Protection Officer (enquiries@haar.com.sg is our designated DPO contact)

5022 Ang Mo Kio Ind Park 2, #04-37, Singapore 569525

Email: enquiries@haar.com.sg

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.