Privacy Policy

Last Updated: March 3, 2026

Trilogy Spa Holdings, LLC, an Arizona limited liability company (“TSH”, “Company”, “we,” or “us”) has implemented this Privacy Policy (“Privacy Policy”) for its thesisleyspa.com website (including all areas of the site) (the “Website”), and its applications and software provided online and made available offline through or in connection with the service, including through a mobile device (collectively, the “Service”) to provide our users and visitors (collectively “Users” or “you”) information regarding the collection and use of your information on the Service, so that you can make an informed decision about your use of the Service. Capitalized terms that are not defined in this Privacy Policy have the meaning ascribed to them in our Terms of Use.

The Service provides information concerning the operations of, and spa treatments and wellness offerings available at our Sisley branded spa locations in the United States and United States territories (each a “Spa” and collectively the “Spas”). The Spas currently include the following locations, as detailed on the Service and in our Terms of Use: Marina Del Rey, California; Scottsdale, Arizona; and New York, New York.

This Privacy Policy is organized as follows:

• General privacy practices applicable to all users

• State-specific privacy notices (located at the end of this policy)

• Contact information

If you are a resident of Arizona, California, Colorado, Connecticut, Nevada, Texas, Virginia or Washington, please review both the general Privacy Policy and your state-specific notice. Your privacy rights are based on your state of residence, regardless of which Spa location you visit.

When using the Service, there are general elements of our Service that you should know. We will not use or share your Personally Identifiable Information (as defined below) with anyone except as described in this Privacy Policy. TSH does not own your user generated content. For further details on using the Service please refer to our Terms of Use Agreement available here.

This Privacy Policy applies to information collected by TSH and does not apply to information collected by any third-party sites to which the Service may link to or interface with or to information provided to, or collected by, third-parties through third-party cookies, web beacons, or other third-party technologies served during your visit to the Service.

Please see the Do Not Track section of this Privacy Policy for how the Service responds to “Do Not Track Mechanisms”.

Note that you can withdraw the consent you have given us to process your information at any time by going to the Settings in your account. Please see the Your Choices section of this Privacy Policy for additional detail.

If you have questions or concerns regarding this Privacy Policy, you should contact us via email to contact@thesisleyspa.com, or send mail to Privacy, Sisley, c/o Trilogy Spa Holdings, 5141 N. 40^th Street, Suite 300, Phoenix, AZ 85018.

As we update and expand our Service, this Privacy Policy may change, so please check this web page for updates to our Privacy Policy. In the event we make material changes to this Privacy Policy, we will provide notice through our Service, or by other means, to provide you with an opportunity to review the changes before they become effective. If you object to any changes, you may close your account and stop using the Website and Service.

By using the Service, you agree to the terms and conditions of this Privacy Policy.

You acknowledge that your continued use of our Service after we publish or send a notice about changes to our Privacy Policy means that the collection, use and sharing of your personal data is subject to this Privacy Policy.

Multi-State Privacy Rights

TSH operates Sisley branded Spas in multiple U.S. states. Our spa locations are currently in Arizona (Scottsdale), California (Marina Del Rey), and New York (New York). Many of our guests are residents of neighboring states such as well as visitors from across the country including Texas and Washington. Depending on your jurisdiction of residence, you may have specific privacy rights under applicable state or territorial privacy laws.

This Privacy Policy provides a general overview of our information practices applicable to all users. However, depending on your state or territory of residence, you may have specific privacy rights under applicable privacy laws regardless of where our physical spa locations are situated. For state-specific information, including your rights as a resident of Arizona, California, Colorado, Connecticut, Nevada, Texas, Virginia or Washington, please see the State-Specific Privacy Notices at the end of this Privacy Policy.

If you are a resident of multiple states or move between states, your rights will be determined based on your state of residence at the time you exercise such rights. For example, if you are a California resident who books a treatment at our Scottsdale, Arizona location, you retain your California privacy rights with respect to the personal information we collect from you.

The Information We Collect

When you visit our Service we may collect information regarding your visit from your computer or mobile device. Such information helps us to determine information about how you found our Service, the date that you visited our Service and search engines and websites that may have led you to our Service. We collect this information in order to continually improve and enhance the functionality of the Service.

Generally, you may provide us with two types of information, User Content, which may include Personally Identifiable Information, and Website Usage Information, both of which are discussed in greater detail below.

1. Personal Information You Choose to Provide.

a. Sign-up Information and Profile; Communications with Us. We will ask you to provide certain information if you choose to contact us or apply for employment at TSH via our Service, including your full name, email address, physical address, telephone number, and other information which identifies you (collectively “Personally Identifiable Information”) for the purposes of fulfilling your employment application. Do not supply to us or disclose on the Service any Personally Identifiable Information of any person under 13 years of age, as we do not intend to collect information from anyone under 13 or invite to them to participate in the Service. If you are over 13 years of age but under 18 years of age, you are only able to utilize the Service under the supervision of a parent or legal guardian, and we may require the collection of Personally Identifiable Information from your parent or guardian (including their full name, email address, mailing address, and credit card billing information) for you to utilize certain aspects of the Service. If you are over 13 years of age but under 18 years of age, the Service does not condition your participation in an online activity on you providing more information than is reasonably necessary for that activity.

b. User Content. Our Service may offer its users to the opportunity to post User Content, comments, reviews, and tag messages via bulletin boards, blogs, articles, and chat rooms. If you choose to use these features, you should be aware that any Personally Identifiable Information you submit through these public Service features can be read, collected, or used by other viewers and could be used to send you unsolicited messages. We are not responsible for the Personally Identifiable Information you choose to submit in these public forums of the Service.

c. Questionnaires and Surveys. We may occasionally ask users of our Service to complete online surveys, questionnaires, and opinion polls about the Service and their activities, attitudes, and interests. These surveys help us to better serve you and improve the usefulness and features of the Service. In requesting your participation in these surveys, we may ask you to provide your name and email address to us.

d. Contact Us. If you email us through the contact us link on our Service, we may ask you for information such as your name and email address so we can respond to your questions and comments. If you choose to correspond with us via email, we may retain the content of your email messages, your email address and our responses to you. In certain cases, and with your permission, we may post content on the Service from your emails to us.

e. Health and Wellness Information. In connection with providing spa treatments and wellness services, we require you to complete health-related intake forms and consultations as detailed in our Terms of Use. This may include information such as allergies, medical conditions, medical history, medications, treatment preferences, physical limitations, prior injuries, and wellness goals through intake forms or consultation sessions. In some cases, we may require written medical clearance from your physician before providing certain treatments. This information is used solely to provide safe and effective treatments and is subject to enhanced protection measures. While our wellness services are not medical services covered by HIPAA, we treat health-related information with comparable care and confidentiality.

2. Website Usage Information.

a. Cookies. The Service may use cookies to collect information for record keeping purposes and make it easier to navigate the Service. Cookies are small text files that are stored on users’ hard drives, which often include an anonymous unique identifier. The Service uses both “session ID cookies” and “persistent cookies.” Session ID cookies are used to store information while a user is logged into the site and expire when the user closes their browser. Persistent cookies are used to make tasks like visiting the site easier for returning users, and may be used by your browser on subsequent visits to the Website. Persistent cookies stay on a user’s hard drive from one session to the next and are not stored on or accessed by the Service. Persistent cookies may be removed from your hard drive by following the instructions in your web browser’s “help” file. A session cookie is temporary and disappears after you close your browser.

When you visit our Website, our computer may ask your computer for permission to employ the use of a session cookie or persistent cookie. Our Website will then send a cookie to your browser if your browser’s preferences allow it.

Most web browsers can be adjusted to inform you when a cookie has been sent to you and provide you with the opportunity to refuse that cookie. However, refusing a cookie may, in some cases, preclude you from using, or negatively impact the display or function of, our Website or certain areas or features of our Website. You may choose not to receive cookies from the Service by following instructions in your web browser’s “help” file, but this may make certain features of the Services inaccessible to you.

b. Clear GIFs/Beacons. When visiting our Website, we may also use “Clear GIFs” (aka “web beacons” or “pixel tags”) or similar technologies in our Website and/or in our communications with you. A Clear GIF is typically a one-pixel, transparent image located on a web page or in an e-mail or other type of message, which helps us to verify an individual’s viewing or receipt of a web page or message. Clear GIFs allow us to know whether you have viewed a web page prior to visiting our Website and may enable us to relate such information to other information, including your Personally Identifiable Information. We use information provided from Clear GIFs to enable more accurate reporting, improve the effectiveness of our marketing, and make our Service better for our Users.

c. IP Address and Clickstream Data. Our servers automatically collect data about your Internet Protocol address when you visit us. When you request pages from our Website, our servers may log your IP address and sometimes your domain name. Our server may also record the referring page that linked you to us (e.g., another website or a search engine); the pages you visit on this Website; the website you visit after this Website; other information about the type of web browser, computer, platform, related software and settings you are using; any search terms you have entered on this Website or a referral website; and other web usage activity and data logged by our web servers. We use this information for internal system administration, to help diagnose problems with our servers, to analyze general usage patterns, and to administer our Website. Such information may also be used to gather broad demographic information, such as country of origin, web browser and Internet Service Provider. We may aggregate user information in a non-personally identifiable manner to share with advertisers, to enhance the Website with new features, and for our general business purposes.

Any or all of these activities with regard to the above-described Website Usage Information may be performed on our behalf by our third-party service providers.

How We Use Your Information

1. Personal Information. If you submit information to us through the Service, then we use this information to operate, maintain, and provide the features and functionality of the Service.

1. Service-Related Notices: By providing your email address to TSH, you consent to our using the email address to send you Service-related notices, including among other things notices required by law, in lieu of postal mail. You may not opt out of Service-related e-mails.

2. Communications and Marketing:

• Email Marketing: We may use your email address to send you promotional messages, including changes to Service features, special offers, and information about our spa treatments and wellness offerings. You can opt out of promotional emails at any time by clicking “unsubscribe” in any marketing email or by contacting us at privacy@thesisleyspa.com.

• SMS/Text Messaging: If you provide us with your mobile phone number and affirmatively opt in to receive text messages from us, you consent to receive promotional and transactional text messages at that number. Consent to receive marketing texts is not a condition of purchasing goods or services. Standard message and data rates may apply. Message frequency varies based on your interactions with us and promotional campaigns.

To opt out of text messages, reply STOP to any message or contact us at privacy@thesisleyspa.com. After texting STOP, you will receive one final confirmation message. For assistance, reply HELP or contact us at privacy@thesisleyspa.com.

By opting in to receive text messages, you represent that you are the mobile account holder or have the account holder’s permission to opt in, and you agree to notify us of any changes to your mobile number.

Please note: Carriers are not liable for delayed or undelivered messages.

2. Usage Information. We use non-Personally Identifiable Information, such as anonymous Website use data and IP addresses, to improve the quality and design of the Service and to create new features and services by storing, tracking, and analyzing your preferences and trends. We may use such information to: (a) remember information so that you will not have to re-enter it during your current or subsequent visits to the Service; (b) provide customized content and information; (c) monitor the effectiveness of our marketing campaigns and aggregate metrics such as total number of visitors and traffic; (d) diagnose or fix technology problems; (e) access your information after you sign in; (f) market our Service to advertisers and other third parties; (g) aggregate general usage statistics including demographic and geographic information, and aggregated search searches including but not limited to by accident type, size, geography, aircraft, and volume; and (h) other purposes for which your personal identity is not revealed.

3. Location-Based Services. We collect location-based information in order to provide the specific location-based services which you request. You understand that certain location-based services require a location to function properly and your use of our Service on your mobile device with such features enabled signifies your agreement to use your location for the purposes of the Service.

4. Billing Information. We do not directly collect or store your payment card information. If you elect to purchase Spa Activities, you provide payment information directly to our third party booking and payment providers:

• Our Scottsdale location uses Book4Time with Shift4 Payments, Inc. for payment processing. Book4Time may receive your name, contact information, treatment preferences, and transaction history to facilitate bookings and service delivery.

• Our New York and California locations use Booker with Vantiv for payment processing. Booker may receive your name, contact information, treatment preferences, and transaction history to facilitate bookings and service delivery.

These providers collect and process such payment information in accordance with their respective privacy policies: Book4Time (https://book4time.com/privacy-policy/), the Booking Engine utilized at our Scottsdale location, utilizes Shift4 Payments, Inc., a Delaware corporation. Booker (https://www.mindbodyonline.com/company/legal/privacy-policy), the booking engine utilized at our New York and California locations, utilizes Vantiv. You can contact these providers directly to access, correct, or delete personal information they maintain about you. We receive confirmation of completed transactions in order to schedule Spa Activities at each location but do not have access to your full payment card details.

When We Share Information

TSH will not share your email address with advertisers or unaffiliated third parties without first obtaining your express permission.

We may provide information, including Personally Identifiable Information, to our subsidiaries, affiliated companies, or subcontractors, including but not limited to:

• Hosting and technical service providers (such as New Dream Network, LLC d/b/a Dreamhost, a California limited liability company) for content delivery and managed hosting services;
• Booking and payment processors (Book4Time, Booker, Shift4Payments, Vantiv) for Spa Activities appointments scheduling and payments as applicable to the particular Spa location as set forth above;
• Marketing and analytics providers (Google Analytics, Google Ads, Meta/Facebook, HubSpot)
• Customer service platforms
• Security and fraud prevention services

These providers may receive information necessary to: (a) perform services and/or process such information on our behalf (including processing payments on our behalf), (b) gain feedback from you on our product offerings and services, (c) use the information to offer greater functionality and enhanced services through the Service and provide you with additional product and service opportunities, and (d) communicate these opportunities to you. When we do this, the recipients of your information are bound by the terms of this Privacy Policy and are prohibited from using your information for their own marketing purposes unless you have separately consented to such use with that provider.

We may share non-Personally Identifiable Information (such as anonymous Website and/or mobile application use data) with third-parties to assist them in understanding our Service, including Users’ use of our Service and the services we provide and the success of advertisements and promotions.

We may share non-personally identifiable aggregated user data, such as aggregated gender, age, geographic, and usage data (without the inclusion of a user’s name or other identifying information) to advertisers and other third parties for their marketing and promotional purposes.

We may use analytics services provided by third parties, including Google Analytics, that use cookies and other similar technologies to collect information about the Service without identifying individual visitors. The third parties that provide us with these services may also collect information about your use of third-party websites and applications.

We may share location-based information with third parties for their marketing and promotional purposes if you have allowed location-based services as described above.

We may release your User Content and Website Usage Information if required to do so by law, or in the good-faith belief that such action is necessary to comply with state or federal laws or respond to a court order, subpoena, law enforcement or regulatory request, or search warrant. We reserve the right to collect and share any information: (i) in order to investigate, prevent, or take action regarding suspected or actual illegal activities; (ii) as appropriate or necessary to enforce our Terms of Use or investigate potential or actual violations of the Terms of Use or Privacy Policy; (iii) take precautions against liability; (iv) to protect the security or integrity of our Service; (v) to exercise or protect our rights and property, the Service, or the rights and personal safety of TSH affiliates, Users or others; or (vi) for other legitimate purposes.

We may assign or transfer the information we collect to a third party in the event that TSH is acquired by or merged with a third party entity, or due to our bankruptcy, insolvency, reorganization, receivership, or similar situation. We reserve the right to transfer any information we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use User Content you have provided through our Service in a manner that is consistent with this Privacy Policy.

Rights to Opt-In / Opt-out

You have the right to “opt in” and/or “opt out” of certain of our uses of your Personally Identifiable Information. For example, you may have the opportunity to elect whether you would like to receive correspondence from us and/or third party service providers. Your personal information will not be shared with third party service providers unless consent is given by you. You will have the opportunity to opt out of our promotional e-mails by clicking the “opt out” or “unsubscribe” link in the e-mail you receive. You can also request this by sending an e-mail to privacy@thesisleyspa.com specifying whether: (i) you would like to opt out of receiving promotional correspondence from TSH in general, or just via e-mail, postal mail and/or by phone, and/or whether (ii) you would only like to opt out of certain of our e-newsletters or correspondence. Please understand that if you opt out of receiving promotional correspondence from us, we may still contact you in connection with your relationship, activities, transactions and communications with us.

Our Commitment to Children’s Privacy

Protecting the privacy of young children is especially important and is mandated by U.S. law. For these reasons, TSH does not knowingly collect Personally Identifiable Information on the Service from persons under 13 years of age, and no part of our Service is directed to persons under 18. If you are under 13 years of age, then you must not use or access the Service at any time or in any manner or provide any information to the Service. If we become aware that we have inadvertently received personal information from a visitor under the age of 13 on our Service, we will delete the information from our records.

YOU AFFIRM THAT YOU ARE OVER THE AGE OF 13, AS THE WEBSITE IS NOT INTENDED FOR USERS UNDER 13. IF YOU ARE OVER THE AGE OF 13 BUT UNDER THE AGE OF 18, YOU AFFIRM YOU ARE EITHER AN EMANCIPATED MINOR, OR HAVE OBTAINED THE CONSENT OF A PARENT OR LEGAL GUARDIAN TO USE THE SERVICE. We may require age verification for certain spa services or account features, and parents or guardians may be required to provide consent and identification for minors seeking spa treatments.

Parents and guardians should be aware that while this Privacy Policy will govern our use of Personally Identifiable Information, information posted on bulletin boards, online forums or the like (“User Content”) may be used by other parties to generate unsolicited communications. Please reference our Terms of Use for additional details regarding User Content. TSH encourages all parents and legal guardians to instruct their children in the safe and responsible use of their Personally Identifiable Information while using the Internet.

Rights to Access and Control Your Data

You can access or delete your personal data. You have many choices about how your data is collected, used and shared. We offer you settings within your Account to control and manage the personal data we have about you.

For personal data that we have about you, you can:

∙ Delete Data: You can ask us to erase or delete all or some of your personal data (e.g., if it is no longer necessary to provide services to you).

∙ Change or Correct Data: You can edit some or your personal data through your account. You can also ask us to change, update or fix your data in certain cases, particularly if it’s inaccurate.

∙ Object to, or Limit or Restrict, Use of Data: you can ask us to stop using all or some of your personal data (e.g., if TSH has no legal right to keep using it) or to limit our use of it (e.g., if your data is inaccurate or unlawfully held).

∙ Right to Access and/or Take Your Data: You can ask us for a copy of your personal data and can ask for a copy of the personal data you provided in machine readable form.

You may contact us at privacy@thesisleyspa.com, and we will consider your requests in accordance with applicable laws.

Data Retention

TSH has a variety of obligations to retain the data that you provide to us, both to ensure that transactions can be appropriately processed, and also to comply with laws applicable to us and to our banking providers and credit card processors. Accordingly, even if you close your account we will retain certain information as necessary to meet our legal obligations and fulfill the purposes outlined in this Privacy Policy.

We retain your Personally Identifiable Information even after you have closed your account if reasonably necessary to comply with our legal obligations (including law enforcement requests), meet regulatory requirements, resolve disputes, maintain security, prevent fraud and abuse, enforce our Terms of Use, or fulfill your request to “unsubscribe” from us. We will retain de-personalized information after your account has been closed.

Generally, we retain personal information for the following periods:

• Account information: 7 years after account closure

• Transaction records: 7 years after transaction date

• Marketing communications: Until you unsubscribe plus 3 years

• Website usage data: 2 years from collection

• Health and treatment information: 5 years after last service date

• Employment application data: 2 years after application date

• Employee personnel records: Varies by state law, ranging from 3-7 years after employment termination depending on record type and jurisdiction

Information you have shared with others (e.g. comments, posted reviews, group posts) will remain visible after you closed your account or deleted the information from your own profile, and we do not control the data that other Account holders copied out of our Service. User Content associated with closed accounts will show an unknown user as the source.

International Users

The Service is hosted in the United States and is intended for and directed to Users in the United States. The Service is void where prohibited. If you are accessing the Service from outside the United States, your use of the Service is governed by U.S. law, you are transferring your Personally Identifiable Information to the United States, and you consent to that transfer.

By providing Personally Identifiable Information to us through this Service, you agree that it may be used by us and our affiliates for the purposes described herein and you further understand and consent to the collection, maintenance, processing and transfer of such information in and to the United States and other countries and territories, which may have different privacy laws from your country of residence and which may afford varying levels of protection for your Personally Identifiable Information. Regardless of the laws in place in these countries, we will treat the privacy of your information in accordance with this Privacy Policy.  By providing your Personally Identifiable Information to this Service, you consent to our transmission to, and processing of your information in, any jurisdiction, in accordance with this Privacy Policy.

Employee Privacy Rights

This Privacy Policy primarily addresses customer and website visitor information. TSH maintains separate privacy practices for employee personal information collected through employment applications, HR systems, payroll processing, and workplace activities. Current and former employees should refer to our Employee Privacy Notice available through Human Resources or contact privacy@trilogyspa.com for information about employee data practices, rights, and procedures.

Your Choices

We have lawful bases to collect, use and share data about you. You have choices about the use of your data. We will only collect and process Personally Identifiable Information about you where we have lawful bases. Lawful bases include consent (where you have given consent), contract (where processing is necessary for the performance of a contract with you (e.g. to deliver TSH services you have requested)) and our legitimate interests, provided that such processing shall not outweigh your rights and freedoms. TSH will seek to obtain your additional consent where required by applicable law. At any time, you can withdraw the consent you have provided by going to settings.

You may, of course, decline to submit Personally Identifiable Information to the Service, in which case you may not be able to register or TSH may not be able to provide certain services to you.

You may access, update or correct your Personally Identifiable Information by contacting us to edit, delete, update, or change the Personally Identifiable Information you have provided to this Service. You may also request that we correct, update, or remove your information from the current Service by contacting us at privacy@thesisleyspa.com. We will respond to your request within 30 days. However, before we are able to provide you with any information or correct any inaccuracies, we may ask you to verify your identity and provide other details to help us to respond to your request.

To protect your privacy and security, we take reasonable steps to verify your identity before granting making corrections to your information.

You may decline to utilize location-based services on your mobile device. If you do not want us to use location-based information, please refrain from using a location-based service or click “Don’t Allow” when your mobile device requests your location-based information.

Online Tracking Disclosures — “Do Not Track” Settings

You may be accessing the Service via a browser that has a “Do Not Track” setting. Under Section 22575 of the California Business and Professions Code (commonly known as the California Online Privacy Protections Act or “CalOPPA”), we are required to disclose our response to a browser’s “do not track” signal. If you have turned this setting in your browser on, or if you are using a browser with the default setting of “Do Not Track”, please be advised that all features of the Service may not function in such setting. As detailed above, we collect a variety of functional and analytic cookies in order for you to completely engage with our services.

If you wish to opt-out of the collection of tracking information you may do so according to your browser settings; however, please be advised that such an election may limit the functionality of the Website available to you.

Our Commitment To Data Security

We have implemented commercially reasonable technical and organizational measures designed to secure your Personally Identifiable Information from accidental loss and from unauthorized access, use, alteration or disclosure. Such measures include, but are not limited to, the utilization of Secure Sockets Layer (SSL) encryption to transmit sensitive information through the Service. However, we cannot guarantee that unauthorized third parties will never be able to defeat those measures or use your personal information for improper purposes. You acknowledge that you provide your Personally Identifiable Information at your own risk.

While TSH strives to protect the security and integrity of Personally Identifiable Information on its Service, due to the inherent nature of the Internet as an open global communications vehicle, we cannot guarantee that your information, during transmission through the Internet or while otherwise in our care, will be safe from intrusion of others. You should also be aware that if you contact us by email or a “contact us” or similar feature on the Service, your transmission might not be secure. An unaffiliated third party could view information you send by these methods in transit. You should also be aware that if you are accessing the Service via a mobile device, your transmissions may not be secure due to the inherent nature of mobile data carrier networks. We will have no liability for disclosure of your information due to errors or unauthorized acts of third parties during or after transmission.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account with us has been compromised), please immediately notify us of the problem by contacting us in accordance with the information provided in the Introduction to this Privacy Policy.

Compromise of Personal Information

In the event that personal information is compromised as a result of a breach of security, TSH will promptly notify those persons whose personal information has been compromised, in accordance with the notification procedures set forth in this Privacy Policy, or as otherwise required by applicable law.  You consent to our use of e-mail as a means of such notification. If you would prefer us to use another method to notify you in this situation, please e-mail us at privacy@thesisleyspa.com with the alternative and/or additional contact information you would like us to use.

Notification Procedures

It is our policy to provide notifications, whether such notifications are required by law or are for marketing or other business related purposes, to Users via email notice, written or hard copy notice, or through conspicuous posting of such notice on our Service, as determined by TSH in its sole discretion. TSH reserves the right to determine the form and means of providing notifications to our Users, provided that you may opt out of certain means of notification as described in this Privacy Policy.

Changes to This Privacy Policy

This Privacy Policy may be revised periodically and without prior notice to you to reflect changes in our online information practices. We will post a prominent notice on this Service to notify you of any significant changes to our Privacy Policy and indicate at the top of the statement when it was most recently updated. Your use of the Service indicates your acceptance of this Privacy Policy and any then-current revisions.

Contact Information

Please contact us with any questions or comments about this Privacy Policy or the Service, the ways in which TSH collects and uses your information, your choices and rights regarding such use, as follows:

• Via our Service https://thesisleyspa.com
• Write to us by physical mail at:
  Attn: Privacy
  Sisley
  c/o Trilogy Spa Holdings
  5141 N. 40^th Street, Suite 300
  Phoenix, AZ 85018
• Write to us by email at: privacy@thesisleyspa.com
• Call us at: 1-800-966-3451

STATE-SPECIFIC PRIVACY NOTICES

If you are a resident of one of the following states, click below to jump to additional privacy information for your state:

• California Residents – Click here

• Arizona Residents – Click here

• Colorado Residents – Click here

• Connecticut Residents – Click here

• Nevada Residents – Click here

• Texas Residents – Click here

• Virginia Residents – Click here

• Washington Residents – Click here

These state-specific notices supplement the information in this Privacy Policy and provide details about your rights under your state’s privacy laws.

California Privacy Rights: Privacy Notice for California Residents

The following Privacy Notice for California Residents supplements the information contained in our privacy policy above and applies solely to all visitors, users, and others who reside in the State of California (“Consumers”). We adopt this notice to comply with the California Consumer Privacy Act of 2018, Cal. Civil Code §1798.100, et. seq. (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”). Any defined terms in the CCPA as amended have the same meaning when used in this notice.

Information We Collect

Our Service collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”). In particular, our website has collected the following categories of Personal Information from its Consumers within the last twelve (12) months:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, first initial and last name, signature, Social Security number, address, telephone number, driver’s license or state identification card number, a user name or email address in combination with a password or security question and answer that would permit access to an online account. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information.	Records products or services purchased, obtained, or considered.	YES
E. Biometric information.	Genetic (DNA), physiological, behavioral, and biological characteristics, or activity patterns that can be used singly or in combination with each other or with other identifying information to establish identity; activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, handprints, vein patterns, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns; and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or physical movements.	YES
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information to any of the foregoing.	NO
I. Professional or employment-related information.	Current job history, past job history or performance evaluations.	NO
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO
L. Information from Children under the age of 16	Information from minors under 13 years of age, Information from minors between 13 and 16 years of age	YES if over 13; NO if under 13

**Clarification Regarding Information from Children**

TSH does not knowingly collect Personal Information from children under 13 years of age. Any collection of information from individuals under 13 would be unintentional, and we delete such information promptly upon discovery.

For individuals ages 13-17, we may collect Personal Information only with verifiable parental or legal guardian consent, as required by our Terms of Use Section 1(b) (Eligibility). Parents and legal guardians who provide consent for their teen’s use of the Service are bound by our Terms of Use and this Privacy Policy with respect to such use.

If you are a parent or guardian and believe we have inadvertently collected information from your child under 13, please contact us immediately at privacy@thesisleyspa.com so we can delete it.

Personal Information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA’s scope due to the primacy of other federal regulations:
  • Health Information: Protected or health information that is collected by a covered entity governed by the privacy, security, and breach notification rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Availability Act of 1996 (“HIPAA”).
  • Personal information reported in, or used to generate, a consumer report as defined by subdivision (d) of Section 1681a of Title 15 of the United States Code, where use of that information is limited by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).
  • Personal information collected, processed, sold or disclosed pursuant to the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations.
  • Personal information collected, processed, sold or disclosed pursuant to the federal Driver’s Privacy Protection Act of 1994 (18 U.S.C. Sec. 2721 et. seq.).
• Information excluded from the CCPA’s and CPRA’s scope due to other California regulations which may supersede the CCPA and CPRA:
  • Health Information: Protected or health information that is collected by a covered entity governed by the California Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56 of Division 1)).
  • Personal financial information governed by the California Financial Information Privacy Act (FIPA).

How we collect Personal Information

We obtain the categories of Personal Information listed above from the following categories of sources:

• Directly from you or your agents. For example, from forms you complete on our Service, and transactions you complete on our Service.
• Indirectly from you. For example, from observing your actions on our Service or interactions with our advertisers.

Use of Personal Information

We may use, or disclose the Personal Information we collect for one or more of the following business purposes:

• To fulfill or meet the reason you provided the information. For example, we collect information to verify eligibility to utilize our Service.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA as amended.
• We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing, Selling, and Disclosure of Personal Information

Sharing of Personal Information

TSH shares certain aspects of your information with third parties for advertising purposes, in controlled circumstances as discussed below.

We may display contextual advertising on our Service, which is dependent on your activity on the Service. If we do display such contextual advertising, we may customize such advertisements using data processed based on your current interaction with the Service (e.g., time, general location). We may also document and audit ad impressions and related data relating to the delivery and display of contextual advertisements. Currently, contextual advertising on our Service occurs solely after you complete a purchase of a product on the Service. In the event you do not engage in purchase transactions, or you engage in but not complete a purchase transaction (e.g., you begin to buy a spa treatment but do not complete all of the steps necessary to conclude the purchase) you will not receive contextual advertising and your information will not be shared.

Your personal information is not used to build a profile about you or otherwise alter your experience outside the current interaction with our Service. In the event you elect to interact with such advertisements, it will be your choice as to what information you choose to provide to such parties, if any, and all such collection, processing, control, storage and use of your information by them will be subject to their policies.

Under the CPRA, “sharing” is defined as “sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged. We share limited transaction data (such as that you completed a product purchase with us), in order for such providers to furnish you with post-transaction offers from unrelated parties. The information we share is not Sensitive Personal Information, as such term is defined in the CPRA.

Disclosures of Personal Information for a Business Purpose

In the preceding twelve (12) months, TSH has disclosed Personal Information for a business purpose.

Sales of Personal Information

In the preceding twelve (12) months, TSH has not sold Personal Information.

Categories of Personal Information Shared, Sold, and or Disclosed:

For purposes of the CPRA, we have shared, sold, or disclosed to Service Providers in the preceding 12 months the following categories of Personal Information, to the following categories of recipients:

CATEGORY OF PERSONAL INFORMATION	RECIPIENTS
Identifiers	Affiliates (current or future affiliated entities, subsidiaries, and parent companies); Service Providers (entities who provide certain services or process data on our behalf in connection with our general business operations, product/service fulfillment and improvements, to enable certain features); Advertisers/Ad Networks (third party services which operate on our Service to provide offers to you following completion of transactions on our Service; these parties have their own policies and their processing of your Personal Information is not subject to this Privacy Policy); and as required by law.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Commercial Information
Internet Activity
User Content

Your Rights and Choices as a California Resident

The CCPA provides Consumers (California residents) with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights.

1. Right to Know

You have the right to request, up to two (2) times in any 12-month period, that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you.
• Our business or commercial purpose for collecting, selling, or sharing that Personal Information.
• The categories of third parties with whom we disclose that Personal Information.
• The categories of Personal Information, if any, that we sold or shared, and, for each such category of Personal Information, the categories of third parties to whom such information was sold or shared.
• If we disclosed your Personal Information for a business purpose, a separate list identifying the Personal Information categories that each category of recipient obtained.

2. Right to Access

You have the right to request, up to two (2) times in any 12-month period, that TSH provide access to, or disclosure of, the specific pieces of Personal Information we collected about you in the past 12 months (also called a data portability request).

3. Right to Delete

You have the right to request, up to two (2) times in any 12-month period, that TSH delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

4. Right to Correct

As a California resident, you have the right to request that we correct inaccurate Personal Information about you. For example, if you move your physical address, you can submit a request to correct your physical address.

5. The Right to Opt-Out

You have the right to request to opt-out of the Sale or Sharing of your Personal Information, and/or Sensitive Personal Information if you are 16 years of age or older. If you are under 16 years of age, you also have additional opt-in rights.

1. Opt-Out (Sales, Sharing) – Right to opt-out of the following:

• If we engage in sales (as defined by applicable law) of Personal Information, you may direct us to stop selling Personal Information.
• If we engage in sharing (as defined by applicable law) of Personal Information, i.e., making your Personal Information available for cross-context behavioral advertising, you may opt-out of such processing.

2. Opt-Out of Processing of Sensitive Personal Information – Right to opt-out of the processing of Sensitive Personal Information, provided that this right does not apply in cases where we only use Sensitive Personal Information where necessary, or for certain business purposes as required by applicable law. You also have the right to limit or restrict access to Sensitive Personal Information as discussed below.

3. Minors’ Opt-In Rights – To the extent we have actual knowledge that we collect or maintain Personal Information of a minor under age 16 in California, those minors must opt-in to any sales/sharing of personal information (as defined under CCPA), and minors under the age of 13 must have a parent consent to sales/sharing of personal information. All minors have the right to opt-out later at any time.

6. The Right to Restrict Sensitive Personal Information

“Sensitive Personal Information” is a subset of Personal Information under the CPRA consisting of: Government identifiers (social security, driver’s license, state identification card, or passport number); Racial or ethnic origin; Religious or philosophical beliefs; Health, sex life, or sexual orientation information; Precise geolocation; Union membership; and Citizenship and immigration status.

What Sensitive Personal Information Does TSH Collect?

TSH does not intentionally collect Sensitive Personal Information. However, we do collect date of birth, which under California law could be used to infer age (a protected characteristic). We collect date of birth solely to:

• Verify you meet minimum age requirements (13+)

• Allow or restrict access to certain areas of our facilities such as steam rooms, saunas, and thermal pools and such activities may not be suitable for users under 16 or 18.

We do not use date of birth for any other purpose, and we do not use or disclose this information in ways that would trigger the CPRA’s restrictions on Sensitive Personal Information.

You have the right to request that we limit the use and disclosure of your Sensitive Personal Information to exempted purposes under the CPRA, namely for: (a) security; (b) quality control; (c) short-term transient use; (d) performing services on behalf of the business; (e) uses necessary to provide goods or services reasonably expected by a California resident who requests those goods and services; and (f) purposes added by the CPRA’s regulations.

Exercising Your Rights: Submitting a Verifiable Consumer Request

Who Can Submit a Verifiable Consumer Request: Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child.

How to Submit a Verifiable Consumer Request: To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by:

• Sending us a message on our Service; or
• By contacting us via the toll-free telephone number listed on our Service.

What Your Verifiable Consumer Request Must Contain: The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

To verify your identity, we may request information such as:

• For account holders: Email address and password, or security questions
• For non-account holders: Name, email address, phone number, and/or physical address that matches information in our records
• For sensitive requests: Additional verification such as government-issued ID or signed declaration under penalty of perjury

The verification information we request will be proportional to the sensitivity of the Personal Information you are requesting and the risk of harm from unauthorized disclosure.

We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Frequency of Submitting a Verifiable Consumer Request: You may only make a verifiable consumer request regarding your right to know, access, or delete twice within a 12-month period. You may make a request to correct inaccurate Personal Information, opt-out, or restrict Sensitive Personal Information at any time.

Response Timing and Format

We endeavor to respond to a verifiable consumer request regarding the right to know, access, delete, or correct within forty-five (45) days of its receipt. If we require more time (up to a total of 90 days), we will inform you of the reason and extension period in writing.

For verifiable consumer requests regarding opt-outs, or the right to restrict Sensitive Personal Information, we will respond within fifteen (15) business days of its receipt.

We will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the date of our receipt of the verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, specifically by electronic mail communication.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that your request is manifestly unfounded or excessive, we may either: (a) tell you why we made that decision and refuse to respond to your request, or (b) provide you with a cost estimate of reasonable fees reflecting administrative costs involved before completing your request, and if you still wish to proceed, collect such fees from you prior to carrying out such request.

Appeals

If we deny your request in whole or in part, you have the right to appeal our decision. To appeal, contact us at privacy@thesisleyspa.com with “California Privacy Appeal” in the subject line within a reasonable time after receiving our denial. In your appeal, please explain why you believe our denial was incorrect. We will respond to your appeal within 45 days of receipt. Our response will include our decision on the appeal and, if we uphold our denial, an explanation of the reasons. If we deny your appeal, you may contact the California Privacy Protection Agency to submit a complaint at privacyprotection.ca.gov or by calling (916) 217-3369.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Financial Incentives

We do not offer brand-wide financial incentives, rewards programs, price differences, or different levels of service in exchange for the retention, sale, or sharing of your personal information. Some individual Sisley spa locations may offer location-specific membership programs with benefits such as discounted services or priority booking. These membership programs are managed independently at each location and are not tied to the collection or sharing of personal information beyond what is necessary to administer the membership benefits.

If you participate in a location-specific membership program, the spa location will provide you with the terms and conditions of that program. The value of any membership benefits is reasonably related to the value provided to you and does not constitute a financial incentive under the CCPA/CPRA because we do not offer differentiated services in exchange for allowing the sale or sharing of your personal information.

If we implement a brand-wide financial incentive or rewards program in the future, we will provide you with notice of the material terms, including how we value your personal information, and obtain your opt-in consent before enrolling you.

Shine the Light

Under California’s “Shine the Light” law (California Civil Code §1798.83), California residents who provide personal information in obtaining products or services for personal, family or household use are entitled once per calendar year to request and obtain from us information about the customer information we shared, if any, with other businesses for their own direct marketing uses. If applicable, this information would include the categories of customer information and the names and addresses of those businesses with which we shared customer information for the immediately prior calendar year (e.g. requests made in 2019 will receive details concerning 2018 sharing activities).

To obtain this information, please send an email message to contact@thesisleyspa.com with “Request for California Privacy Information – Shine the Light” on the subject line and in the body of your message. We will in turn provide the requested information on covered sharing to you at your e-mail address.

Contact Us: California-Specific Inquires

If you are a California resident with questions about our privacy practices, please contact us at:

• Email: contact@thesisleyspa.com with “California Privacy Request” in the subject line
• Mail: Privacy/California, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Arizona Residents

This Arizona Privacy Notice supplements the information in our Privacy Policy and applies to Arizona residents.

Your Arizona Privacy Rights

While Arizona does not currently have a comprehensive consumer privacy law, Arizona residents have rights under other applicable laws:

DATA BREACH NOTIFICATION: If we experience a data breach that compromises your personal information, we will notify you in accordance with Arizona Revised Statutes § 44-7501, which requires notification without unreasonable delay.

SECURITY FREEZE RIGHTS: Under Arizona law, you have the right to place a security freeze on your credit report. While Sisley does not report to credit bureaus, if you have concerns about identity theft, you may contact credit reporting agencies directly.

DO NOT CALL REGISTRY: If you do not wish to receive telemarketing calls from us, you may add your phone number to the National Do Not Call Registry at www.donotcall.gov or call 1-888-382-1222.

DESTRUCTION OF RECORDS: We securely destroy or dispose of records containing personal information in accordance with Arizona Revised Statutes § 44-7601.

Information for Arizona Minors

If you are under 18 years of age and a resident of Arizona, you (or your parent/guardian) may request removal of content or information you posted on our Service. To make such a request, please contact us at privacy@thesisleyspa.com. Please note that removal does not ensure complete deletion of the content, as it may remain on our backup systems or may have been shared by others.

Contact Us: Arizona-Specific Inquiries

If you are an Arizona resident with questions about our privacy practices, please contact us at:

• Email: privacy@thesisleyspa.com with “Arizona Privacy Request” in the subject line
• Mail: Privacy/Arizona, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Colorado Residents

Colorado Privacy Notice

This Colorado Privacy Notice supplements the information in our Privacy Policy and applies to Colorado residents. This notice is provided in compliance with the Colorado Privacy Act (CPA), effective July 1, 2023.

Personal Data We Collect

We collect the categories of personal data described in our Privacy Policy. For Colorado residents specifically, this includes:

• Identifiers: Name, email address, postal address, phone number, IP address, account username
• Commercial Information: Purchase history, transaction records, spa treatment bookings, product purchases
• Internet Activity: Website usage data, browsing history on our Service, interaction with our Service
• Geolocation Data: General location information (city/state level) derived from IP address; precise geolocation only if you enable location services
• Inferences: Preferences and interests inferred from your interactions with our Service

Sensitive Data

Under Colorado law, “Sensitive Data” includes: personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sex life, sexual orientation, citizenship or immigration status; genetic or biometric data processed for the purpose of uniquely identifying an individual; personal data from a known child; and precise geolocation data.

We do not intentionally collect Sensitive Data as defined under Colorado law. However, we do collect date of birth solely to verify you meet minimum age requirements (13+) and to restrict access to certain spa facilities that may not be suitable for minors. We do not use date of birth for any other purpose.

If you enable precise location services, we use that information only to provide you with nearby spa locations and available appointments, not to infer your health status or track your movements.

How We Use Personal Data

We process personal data for the following purposes:

• To provide the services you request
• To process your transactions and fulfill your orders
• To maintain and service your account
• To communicate with you about your account and purchases
• To send marketing communications (with your consent)
• To personalize your experience on our Service
• To prevent fraud and enhance security
• To comply with legal obligations
• To improve our Service and develop new features

How We Share Personal Data

We disclose personal data to the categories of third parties described in our Privacy Policy, including:

• Service providers who perform services on our behalf (hosting, booking, payment processing, customer service, analytics)
• Advertising partners for targeted advertising (subject to your opt-out rights)
• Affiliates and subsidiaries
• Legal and safety recipients as required by law
• Business transaction recipients in connection with mergers, acquisitions, or sales

Sale of Personal Data: We may sell personal data as defined under Colorado law. Specifically, we exchange transaction data with third-party advertising partners for valuable consideration.

Targeted Advertising: We process personal data for targeted advertising by displaying post-transaction offers based on your purchase activity.

Your Colorado Privacy Rights

Colorado residents have the following rights under the CPA:

1. Right to Confirm and Access: You have the right to confirm whether we are processing your personal data and to access such personal data.
2. Right to Correct: You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of processing.
3. Right to Delete: You have the right to delete personal data you provided to us, subject to certain exceptions.
4. Right to Data Portability: You have the right to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.
5. Right to Opt Out: You have the right to opt out of:
   • The sale of your personal data
   • Targeted advertising
   • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you.

6. Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge different prices, or provide a different level or quality of goods or services.

Exercising Your Rights

To exercise your rights under Colorado law:

Methods of Submission:

• Email: privacy@thesisleyspa.com with “Colorado Privacy Request” in the subject line
• Toll-Free Phone: 1-800-966-3451
• Mail: Privacy/Colorado, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Information to Include:

• Your full name
• Email address associated with your account
• Colorado mailing address
• Description of your request
• Sufficient information to verify your identity

Opt-Out Preference Signals: We honor opt-out preference signals, including Global Privacy Control (GPC), as valid requests to opt out of the sale of personal data and targeted advertising.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The authorized agent must provide proof of authorization, and we may require you to verify your identity directly with us.

Response Time: We will respond to verified requests within 45 days of receipt. If we need additional time (up to 90 days total), we will notify you of the extension and the reason.

Appeals: If we deny your request, you may appeal by contacting us at privacy@thesisleyspa.com with “Colorado Privacy Appeal” in the subject line within a reasonable time. We will respond to your appeal within 45 days. In our response, we will explain our decision and inform you of your right to contact the Colorado Attorney General to submit a complaint:

• Website: coag.gov
• Phone: (720) 508-6000
• Address: Colorado Department of Law, Consumer Protection Section, Ralph L. Carr Colorado Judicial Center, 1300 Broadway, 7th Floor, Denver, CO 80203

Data Retention Periods

We retain personal data as described in the Data Retention section of our Privacy Policy, generally retaining information as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

Children’s Privacy

We do not knowingly collect personal data from children under 13 without parental consent. If we learn we have collected personal data from a child under 13, we will delete it promptly. Teens ages 13-17 may use our Service only with parental consent.

Contact Us – Colorado-Specific Inquiries

For Colorado-specific privacy questions:

• Email: privacy@thesisleyspa.com with “Colorado Privacy Request” in the subject line
• Mail: Privacy/Colorado, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018
• Phone: 1-800-966-3451

Connecticut Residents

Connecticut Privacy Notice

This Connecticut Privacy Notice supplements the information in our Privacy Policy and applies to Connecticut residents. This notice is provided in compliance with the Connecticut Data Privacy Act (CTDPA), effective July 1, 2023.

Personal Data We Collect

We collect the categories of personal data described in our Privacy Policy. For Connecticut residents specifically, this includes:

• Identifiers: Name, email address, postal address, phone number, IP address, account username
• Commercial Information: Purchase history, transaction records, spa treatment bookings, product purchases
• Internet Activity: Website usage data, browsing history on our Service, interaction with our Service
• Geolocation Data: General location information (city/state level) derived from IP address; precise geolocation only if you enable location services
• Inferences: Preferences and interests inferred from your interactions with our Service

Sensitive Data

Under Connecticut law, “Sensitive Data” includes: personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data processed for the purpose of uniquely identifying an individual; personal data from a known child; and precise geolocation data.

We do not intentionally collect Sensitive Data as defined under Connecticut law. However, we do collect date of birth solely to verify you meet minimum age requirements (13+) and to restrict access to certain spa facilities that may not be suitable for minors. We do not use date of birth for any other purpose.

If you enable precise location services, we use that information only to provide you with nearby spa locations and available appointments, not to infer your health status or track your movements.

How We Use Personal Data

We process personal data for the following purposes:

• To provide the services you request
• To process your transactions and fulfill your orders
• To maintain and service your account
• To communicate with you about your account and purchases
• To send marketing communications (with your consent)
• To personalize your experience on our Service
• To prevent fraud and enhance security
• To comply with legal obligations
• To improve our Service and develop new features

How We Share Personal Data

We disclose personal data to the categories of third parties described in our Privacy Policy, including:

• Service providers who perform services on our behalf (hosting, booking, payment processing, customer service, analytics)
• Advertising partners for targeted advertising (subject to your opt-out rights)
• Affiliates and subsidiaries
• Legal and safety recipients as required by law
• Business transaction recipients in connection with mergers, acquisitions, or sales

Sale of Personal Data: We may sell personal data as defined under Connecticut law. Specifically, we exchange transaction data with third-party advertising partners for valuable consideration.

Targeted Advertising: We process personal data for targeted advertising by displaying post-transaction offers based on your purchase activity.

Your Connecticut Privacy Rights

Connecticut residents have the following rights under the CTDPA:

1. Right to Confirm and Access: You have the right to confirm whether we are processing your personal data and to access such personal data.
2. Right to Correct: You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of processing.
3. Right to Delete: You have the right to delete personal data you provided to us, subject to certain exceptions.
4. Right to Data Portability: You have the right to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.
5. Right to Opt Out: You have the right to opt out of:
   • The sale of your personal data
   • Targeted advertising
   • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you.

6. Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge different prices, or provide a different level or quality of goods or services.

Exercising Your Rights

To exercise your rights under Connecticut law:

Methods of Submission:

• Email: privacy@thesisleyspa.com with “Connecticut Privacy Request” in the subject line
• Toll-Free Phone: 1-800-966-3451
• Mail: Privacy/Connecticut, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Information to Include:

• Your full name
• Email address associated with your account
• Connecticut mailing address
• Description of your request
• Sufficient information to verify your identity

Opt-Out Preference Signals: We honor opt-out preference signals, including Global Privacy Control (GPC), as valid requests to opt out of the sale of personal data and targeted advertising.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The authorized agent must provide proof of authorization, and we may require you to verify your identity directly with us.

Response Time: We will respond to verified requests within 45 days of receipt. If we need additional time (up to 90 days total), we will notify you of the extension and the reason.

Appeals: If we deny your request, you may appeal by contacting us at privacy@thesisleyspa.com with “Connecticut Privacy Appeal” in the subject line within a reasonable time. We will respond to your appeal within 60 days. In our response, we will explain our decision and inform you of your right to contact the Connecticut Attorney General to submit a complaint:

• Website: portal.ct.gov/AG
• Phone: (860) 808-5318
• Address: Connecticut Attorney General’s Office, 165 Capitol Avenue, Hartford, CT 06106

Data Retention Periods

We retain personal data as described in the Data Retention section of our Privacy Policy, generally retaining information as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

Children’s Privacy

We do not knowingly collect personal data from children under 13 without parental consent. If we learn we have collected personal data from a child under 13, we will delete it promptly. Connecticut law provides heightened protections for children ages 13-15, requiring consent for processing Sensitive Data from known children in this age range. Teens ages 13-17 may use our Service only with parental consent.

Contact Us – Connecticut-Specific Inquiries

For Connecticut-specific privacy questions:

• Email: privacy@thesisleyspa.com with “Connecticut Privacy Request” in the subject line
• Mail: Privacy/Connecticut, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018
• Phone: 1-800-966-3451

Nevada Residents

This Nevada Privacy Notice supplements the information in our Privacy Policy and applies to Nevada residents.

Your Nevada Privacy Rights

SALE OF PERSONAL INFORMATION (Nevada Revised Statutes § 603A):

Nevada law gives consumers the right to opt out of the “sale” of certain “covered information” that a business has collected or will collect.

Nevada’s Definition of “Sale”: Under Nevada law, “sale” means the exchange of covered information for monetary consideration to a person for that person to license or sell the covered information to additional persons.

Our Practices: We may exchange certain personal information for valuable consideration with third-party advertising partners. While we do not believe this constitutes a “sale” under the narrow Nevada definition (as our partners do not license or resell your information to additional parties), out of an abundance of caution we provide you with the ability to opt out.

How to Opt Out: Nevada residents may opt out of the sale of covered information by:

• Emailing us at privacy@thesisleyspa.com with “Nevada Opt-Out” in the subject line
• Calling us at 1-800-966-3451
• Submitting a request through the “Do Not Sell or Share My Personal Information” link on our website

Your opt-out request must include:

• Your full name
• Email address associated with your account (if applicable)
• Confirmation that you are a Nevada resident
• Clear statement that you wish to opt out of the sale of your covered information

We will respond to your verified request within 60 days.

Verification: We may require reasonable verification of your identity and Nevada residency before processing your opt-out request.

Nevada Data Security

We implement and maintain reasonable security measures to protect the security, confidentiality, and integrity of personal information as required by Nevada Revised Statutes § 603A.

Nevada Data Breach Notification

If we experience a security breach that compromises your personal information, we will provide notification in accordance with Nevada Revised Statutes § 603A.220.

Contact Us: Nevada-Specific Inquiries

If you are a Nevada resident with questions about our privacy practices, please contact us at:

• Email: privacy@thesisleyspa.com with “Nevada Privacy Request” in the subject line
• Mail: Privacy/Nevada, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Texas Residents

This Texas Privacy Notice supplements the information in our Privacy Policy and applies to Texas residents. This notice is provided in compliance with the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024.

Personal Data We Collect

We collect the categories of personal data described in our Privacy Policy. For Texas residents specifically, this includes:

Identifiers: Name, email address, postal address, phone number, IP address, account username

Commercial Information: Purchase history, transaction records, treatment purchases, product purchases

Internet Activity: Website usage data, browsing history on our Service, interaction with our Service

Geolocation Data: General location information (city/state level) derived from IP address; precise geolocation only if you enable location services

Inferences: Preferences and interests inferred from your interactions with our Service

Sensitive Data

We do not collect Sensitive Data as defined under the TDPSA, including:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data for identification purposes
• Personal data from a known child (under 13)

If we collect precise geolocation data (with your consent), we do not use it in ways that would characterize it as Sensitive Data under Texas law.

How We Use Personal Data

We process personal data for the following purposes:

• To provide the services you request
• To process your transactions and fulfill your orders
• To maintain and service your account
• To communicate with you about your account and purchases
• To send marketing communications (with your consent)
• To personalize your experience on our Service
• To prevent fraud and enhance security
• To comply with legal obligations
• To improve our Service and develop new features

How We Share Personal Data

We disclose personal data to the categories of third parties described in our Privacy Policy, including:

• Service providers who perform services on our behalf
• Advertising partners (for targeted advertising, subject to your opt-out rights)
• Affiliates and subsidiaries
• Legal and safety recipients as required by law
• Business transaction recipients (in connection with mergers, acquisitions, or sales)

Sale of Personal Data: We may sell personal data as defined under Texas law. Specifically, we exchange transaction data with third-party advertising partners for valuable consideration.

Targeted Advertising: We process personal data for targeted advertising by displaying post-transaction offers based on your purchase activity.

Profiling: We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you without your consent.

Your Texas Privacy Rights

Texas residents have the following rights under the TDPSA:

1. Right to Confirm and Access: You have the right to confirm whether we are processing your personal data and to access such personal data.

2. Right to Correct: You have the right to correct inaccuracies in your personal data.

3. Right to Delete: You have the right to delete personal data you provided to us, subject to certain exceptions.

4. Right to Data Portability: You have the right to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

5. Right to Opt Out: You have the right to opt out of:

• The sale of your personal data
• Targeted advertising
• Profiling in furtherance of decisions that produce legal or similarly significant effects

6. Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights, including by:

• Denying goods or services
• Charging different prices or rates
• Providing a different level or quality of goods or services

Exercising Your Rights

To exercise your rights under Texas law:

Methods of Submission:

• Email: privacy@thesisleyspa.com with “Texas Privacy Request” in the subject line
• Toll-Free Phone: 1-800-966-3451
• Mail: Privacy/Texas, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Information to Include:

• Your full name
• Email address associated with your account
• Texas mailing address
• Description of your request
• Sufficient information to verify your identity

Opt-Out Preference Signals: We honor opt-out preference signals, including Global Privacy Control (GPC), as valid requests to opt out of the sale of personal data and targeted advertising.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The authorized agent must provide proof of authorization, and we may require you to verify your identity directly with us.

Response Time: We will respond to verified requests within 45 days of receipt. If we need additional time (up to 90 days total), we will notify you of the extension and the reason.

Appeals: If we deny your request, you may appeal by contacting us at privacy@thesisleyspa.com with “Texas Privacy Appeal” in the subject line within 30 days of our denial. We will respond to your appeal within 60 days. If we deny your appeal, you may submit a complaint to the Texas Attorney General at:

• Website: texasattorneygeneral.gov
• Consumer Protection Division: (800) 621-0508
• Mailing: Office of the Attorney General, Consumer Protection Division, P.O. Box 12548, Austin, TX 78711-2548

Data Retention Periods

We retain personal data as described in the Data Retention section of our Privacy Policy, generally retaining information as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

Children’s Privacy

We do not knowingly collect personal data from children under 13 without parental consent. If we learn we have collected personal data from a child under 13, we will delete it promptly. Teens ages 13-17 may use our Service only with parental consent.

Biometric Data

We do not collect biometric identifiers or biometric information as defined under Texas Business and Commerce Code Chapter 503. If we implement biometric data collection in the future, we will:

• Provide clear notice before collection
• Obtain your informed written consent
• Disclose the purpose and retention period
• Comply with all requirements of Texas biometric privacy law

Contact Us – Texas-Specific Inquiries

For Texas-specific privacy questions:

• Email: privacy@thesisleyspa.com with “Texas Privacy Request” in the subject line
• Mail: Privacy/Texas, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018
• Phone: 1-800-966-3451

Virginia Residents

Virginia Privacy Notice

This Virginia Privacy Notice supplements the information in our Privacy Policy and applies to Virginia residents. This notice is provided in compliance with the Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023.

Personal Data We Collect

We collect the categories of personal data described in our Privacy Policy. For Virginia residents specifically, this includes:

• Identifiers: Name, email address, postal address, phone number, IP address, account username
• Commercial Information: Purchase history, transaction records, spa treatment bookings, product purchases
• Internet Activity: Website usage data, browsing history on our Service, interaction with our Service
• Geolocation Data: General location information (city/state level) derived from IP address; precise geolocation only if you enable location services
• Inferences: Preferences and interests inferred from your interactions with our Service

Sensitive Data

Under Virginia law, “Sensitive Data” includes: personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data processed for the purpose of uniquely identifying an individual; personal data from a known child; and precise geolocation data.

We do not intentionally collect Sensitive Data as defined under Virginia law. However, we do collect date of birth solely to verify you meet minimum age requirements (13+) and to restrict access to certain spa facilities that may not be suitable for minors. We do not use date of birth for any other purpose.

If you enable precise location services, we use that information only to provide you with nearby spa locations and available appointments, not to infer your health status or track your movements.

How We Use Personal Data

We process personal data for the following purposes:

• To provide the services you request
• To process your transactions and fulfill your orders
• To maintain and service your account
• To communicate with you about your account and purchases
• To send marketing communications (with your consent)
• To personalize your experience on our Service
• To prevent fraud and enhance security
• To comply with legal obligations
• To improve our Service and develop new features

How We Share Personal Data

We disclose personal data to the categories of third parties described in our Privacy Policy, including:

• Service providers (processors) who perform services on our behalf (hosting, booking, payment processing, customer service, analytics)
• Advertising partners for targeted advertising (subject to your opt-out rights)
• Affiliates and subsidiaries
• Legal and safety recipients as required by law
• Business transaction recipients in connection with mergers, acquisitions, or sales

Sale of Personal Data: We may sell personal data as defined under Virginia law. Specifically, we exchange transaction data with third-party advertising partners for valuable consideration.

Targeted Advertising: We process personal data for targeted advertising by displaying post-transaction offers based on your purchase activity.

Your Virginia Privacy Rights

Virginia residents have the following rights under the VCDPA:

1. Right to Confirm and Access: You have the right to confirm whether we are processing your personal data and to access such personal data.
2. Right to Correct: You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of processing.
3. Right to Delete: You have the right to delete personal data you provided to us, subject to certain exceptions.
4. Right to Data Portability: You have the right to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.
5. Right to Opt Out: You have the right to opt out of:
   • The sale of your personal data
   • Targeted advertising
   • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you.

6. Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge different prices, or provide a different level or quality of goods or services.

Exercising Your Rights

To exercise your rights under Virginia law:

Methods of Submission:

• Email: privacy@thesisleyspa.com with “Virginia Privacy Request” in the subject line
• Toll-Free Phone: 1-800-966-3451
• Mail: Privacy/Virginia, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Information to Include:

• Your full name
• Email address associated with your account
• Virginia mailing address
• Description of your request
• Sufficient information to verify your identity

Opt-Out Preference Signals: We honor opt-out preference signals, including Global Privacy Control (GPC), as valid requests to opt out of the sale of personal data and targeted advertising.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The authorized agent must provide proof of authorization, and we may require you to verify your identity directly with us.

Response Time: We will respond to verified requests within 45 days of receipt. If we need additional time (up to 90 days total), we will notify you of the extension and the reason.

Appeals: If we deny your request, you may appeal by contacting us at privacy@thesisleyspa.com with “Virginia Privacy Appeal” in the subject line within a reasonable time. We will respond to your appeal within 60 days. In our response, we will explain our decision and inform you of your right to contact the Virginia Attorney General to submit a complaint:

• Website: oag.state.va.us
• Phone: (804) 786-2071
• Address: Office of the Attorney General, Consumer Protection Section, 202 North 9th Street, Richmond, VA 23219

Data Retention Periods

We retain personal data as described in the Data Retention section of our Privacy Policy, generally retaining information as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

Children’s Privacy

We do not knowingly collect personal data from children under 13 without parental consent. If we learn we have collected personal data from a child under 13, we will delete it promptly. Teens ages 13-17 may use our Service only with parental consent.

Contact Us – Virginia-Specific Inquiries

For Virginia-specific privacy questions:

• Email: privacy@thesisleyspa.com with “Virginia Privacy Request” in the subject line
• Mail: Privacy/Virginia, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Phone: 1-800-966-3451

Washington Residents

This Washington Privacy Notice supplements the information in our Privacy Policy and applies to Washington residents. This notice is provided in compliance with the Washington My Health My Data Act (MHMDA) and other applicable Washington privacy laws.

Washington My Health My Data Act (MHMDA)

The MHMDA provides special protections for “consumer health data”, which includes personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.

Sisley does not collect, use, or disclose consumer health data as defined by the MHMDA. Specifically:

• We do not use your location information to infer health status or track visits to health-related locations

• We do not collect biometric data

If our practices change and we begin collecting consumer health data, we will obtain your affirmative consent before collection, provide clear notice of what data we collect and how it will be used, obtain separate consent before sharing it with third parties, and comply with all MHMDA requirements. You will have the right to withdraw consent and opt out at any time.

MHMDA Consumer Rights

If we were to collect consumer health data in the future, Washington residents would have the following rights under MHMDA:

1. Right to Confirm and Access: You have the right to confirm whether we are collecting, sharing, or selling your consumer health data and to access such data.

2. Right to Delete: You have the right to have your consumer health data deleted.

3. Right to Withdraw Consent: If we collected your consumer health data with your consent, you have the right to withdraw that consent at any time.

4. Right to Opt Out: You have the right to opt out of the collection and sharing of your consumer health data, to the extent technically feasible.

5. Right to Non-Discrimination: We will not discriminate or retaliate against you for exercising your rights under the MHMDA, including by denying goods or services, charging different prices, or providing a different level or quality of services.

MHMDA Consent Requirements

The MHMDA requires that we obtain your consent before collecting or sharing consumer health data. Because we do not intentionally collect consumer health data, we have not implemented MHMDA-specific consent mechanisms. If our practices change, we will:

• Provide clear notice of what consumer health data we collect

• Obtain your affirmative consent before collection

• Obtain separate consent before sharing consumer health data with third parties

• Allow you to withdraw consent at any time

• Honor all opt-out requests

General Washington Privacy Rights

Beyond the MHMDA, Washington residents have rights under general Washington consumer protection and data privacy laws:

Data Security: We implement reasonable security measures to protect your personal information in accordance with Washington data breach notification laws (RCW 19.255.010).

Breach Notification: If we experience a data breach that compromises your personal information, we will notify you in accordance with Washington law, which requires notification in the most expedient time possible and without unreasonable delay.

Biometric Privacy: Washington law (RCW 19.375) regulates the collection and use of biometric identifiers. As stated above, we do not currently collect biometric information. If we implement biometric data collection in the future, we will:

• Provide clear notice before collection

• Obtain your informed written consent

• Disclose the purpose and retention period

• Implement heightened security measures

• Provide you the ability to opt out

• Comply with all Washington biometric privacy requirements

Children’s Privacy: Washington has heightened protections for children’s data. We do not knowingly collect information from children under 13 without verified parental consent. For information about teens ages 13-17, see our Children’s and Teen Privacy section in the main Privacy Policy.

Sale and Sharing of Personal Information

Sales: We may sell personal information as defined under applicable privacy laws. Specifically, we share transaction data with third-party advertising partners in exchange for valuable consideration.

Sharing/Targeted Advertising: We share limited information with third-party advertising partners who deliver post-transaction offers to you. This occurs only after you complete a purchase on our Service.

Your Opt-Out Rights: You have the right to opt out of the sale of your personal information and targeted advertising. See “Exercising Your Rights” below.

Sensitive Personal Information

We do not collect or process Sensitive Personal Information as defined under Washington law, including:

• Precise geolocation data used to infer health status

• Health diagnoses or treatments

• Biometric data

• Genetic data

• Personal information from known children under 13

• Sexual orientation or behaviors

• Immigration or citizenship status

If you enable precise location services, we use that information only to provide you with nearby Spa locations and available appointments, not to infer your health status or track your movements to health-related facilities.

Exercising Your Rights

To exercise your rights under Washington law, including MHMDA rights:

Methods of Submission:

• Email: privacy@thesisleyspa.com with “Washington Privacy Request” in the subject line

• Toll-Free Phone: 1-800-966-3451

• Mail: Privacy/Washington, Sisley, 5141 N. 40th Street, Suite 300, Phoenix, AZ 85018

Information to Include in Your Request:

• Your full name

• Email address associated with your account (if applicable)

• Washington mailing address or confirmation of Washington residency

• Description of your request (access, delete, opt out, etc.)

• Sufficient information to verify your identity

Opt-Out Preference Signals: We honor opt-out preference signals, including Global Privacy Control (GPC), as valid requests to opt out of the sale of personal information and targeted advertising.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The authorized agent must:

• Provide written proof of authorization signed by you

• Verify their own identity

• We may require you to verify your identity directly with us or confirm you authorized the agent

Response Time:

• For access and deletion requests: We will respond within 45 days of receipt. If we need additional time (up to 90 days total), we will notify you of the extension and the reason.

• For opt-out requests: We will process your request within 15 business days.

• For MHMDA requests regarding consumer health data: We will respond as expeditiously as possible and without unreasonable delay.

Verification: We may require reasonable verification of your identity and Washington residency before processing requests. The information we request for verification will be proportional to the sensitivity of the data and the risk of harm from unauthorized access.

Appeals: If we deny your request in whole or in part, we will provide you with an explanation. You may appeal our decision by contacting us at privacy@thesisleyspa.com with “Washington Privacy Appeal” in the subject line within 30 days of our response. We will respond to your appeal within 45 days.

Data Retention Periods

We retain personal information as described in the Data Retention section of our Privacy Policy. For Washington residents specifically:

• We retain consumer health data (if any) only for as long as necessary to provide requested services or as required by law

• Upon request, we will delete your personal information subject to legal exceptions

• Deleted information may persist in backup systems for a limited period but will not be available for active use

Contact Us – Washington-Specific Inquiries

For Washington-specific privacy questions or to exercise your rights:

Email: privacy@thesisleyspa.com with “Washington Privacy Request” in the subject line

Phone: 1-800-966-3451

Mail:
Privacy Department – Washington Inquiries
Sisley
5141 N. 40th Street, Suite 300
Phoenix, AZ 85018

MHMDA-Specific Inquiries:
If you have questions specifically about consumer health data under the Washington My Health My Data Act, please clearly indicate “MHMDA Inquiry” in your communication.

Washington Attorney General:
If you believe we have violated your rights under Washington privacy laws, you may file a complaint with the Washington Attorney General’s Office:

• Website: www.atg.wa.gov
• Phone: 1-800-551-4636
• Consumer Protection Division, 800 5th Avenue, Suite 2000, Seattle, WA 98104