EU/UK PRIVACY SUPPLEMENT
Last updated: October 14th, 2026
This U EU/UK Privacy Supplement applies when you use our e.l.f. Cosmetics, e.l.f. SKIN, or Well People websites, mobile apps, or services. It is designed for residents of the EEA and UK.
This EU/UK Privacy Supplement should be read together with our Privacy Notice, which explains how we collect, use, and share your personal information.
Some terms used in this EU/UK Privacy Supplement have specific meanings under EU or UK privacy laws or are defined in our Privacy Notice.
WHO WE ARE
WHO WE ARE
For purposes of European Economic Area (the “EEA”) and United Kingdom data protection laws, e.l.f. Cosmetics, Inc., a corporation registered in the state of Delaware, USA, and e.l.f. Beauty UK, LTD, a corporation registered in England and Wales, are each a controller of the personal information you provide to us, or that is collected or processed by or for us with respect to the e.l.f. Beauty brands subject to the Privacy Notice.
The address and contact information for e.l.f. Cosmetics, Inc. is:
e.l.f. Cosmetics, Inc.
601 12th Street, 14th Floor
Oakland, CA 94607
e.l.f. Beauty UK, LTD.
2 Upper Street
2nd & 3rd Floor
London, N1 0PQ
You may contact e.l.f. Cosmetics, Inc. and e.l.f. Beauty UK, LTD using this form.
Our representative for purposes of Article 27 of the General Data Protection Regulation is Thilo Noack at SBS Data Protect GmbH. The address and contact information for SBS Data Protect GmbH is:
SBS Data Protect GmbH
Attention: Thilo Noack Hans-Henny-Jahnn-Weg 49
22085 Hamburg, Germany
+49 40 7344086-0
+49 177 6422164
International Orders
International Orders
If you purchase products through a co-branded checkout service or other transaction-related service operated by one of our third-party cross-border commerce, shipping, seller-of-record, payment, logistics, or other fulfillment partners, that partner may also be considered a controller of the personal information you provide through that service. Please note that not all products or brands may be available for purchase or shipment internationally.
INTERNATIONAL OPERATIONS AND DATA TRANSFERS OUT OF EUROPEAN COUNTRIES
INTERNATIONAL OPERATIONS AND DATA TRANSFERS OUT OF EUROPEAN COUNTRIES
Important: Your personal information will be processed in the United States and possibly other countries.
Our websites are hosted in the United States. If you are visiting one of our websites from outside the United States, your personal information will be stored and/or processed in the United States and stored and/or processed in additional countries where our third-party service providers maintain facilities or operations. These countries include the United Kingdom, Ireland, the Netherlands, and Germany.
Where we store or process your personal information outside of the EEA or the United Kingdom we rely on the following to ensure an adequate level of data protection:
- Adequacy Decisions: Some of our third-party service providers are based in countries that the European Commission and competent authorities in the United Kingdom have determined to have adequate levels of protection for personal information; or
- Standard Contractual Clauses: We rely on the European Commission’s standard contractual contracts for the transfer of personal information to or within third countries, and equivalent contracts issued by the relevant competent authority of the United Kingdom, when transferring personal information to our third-party service providers or other parties who are located in countries that the European Commission and the relevant competent authority of the United Kingdom (as applicable) have not determined to have adequate levels of protection for personal information.
You can request a copy of the cross-border data transfer instruments we use by contacting us using the contact details provided in the “Contact Us” section of this EU/UK Privacy Supplement.
Please note that the data protection and other applicable laws of the United States or other countries may not be as comprehensive as those laws or regulations in your country or may otherwise differ from the data protection laws in your country.
PURPOSES AND LEGAL BASIS FOR PROCESSING
PURPOSES AND LEGAL BASIS FOR PROCESSING
We collect and use your personal information as described in the “What Information Do We Collect, How Do We Collect It, and How Do We Use It?” section of our Privacy Notice.
In many cases, we use your information to support our legitimate business interests, including to:
- provide, operate, and improve our websites, mobile apps, products, and services;
- create, manage, personalize, and secure your account;
- help keep our platforms safe and secure, including detecting and preventing fraud or technical issues; and
- provide customer support and respond to your questions or concerns.
We may also use your personal information as part of business transactions, such as a merger, sale, or reorganization, where needed to complete and manage those activities.
We use your personal information to fulfill our contracts with you (such as to process payments, deliver products you purchase, and handle returns).
Where required, we rely on your consent to use your information for certain activities, such as using cookies or similar technologies to personalize your experience or provide targeted advertising and marketing.
HOW DO WE SHARE YOUR PERSONAL INFORMATION?
HOW DO WE SHARE YOUR PERSONAL INFORMATION?
We share your personal information with the types of third parties described in the “How Do We Share Your Personal Information?” section of the Privacy Notice.
HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
How long we retain your personal information depends on why and how we collected it and how we use it. We keep your personal information only for as long as needed to fulfill the purposes described in this Privacy Notice and to meet our legal obligations.
When deciding how long to keep your personal information, we consider things like:
- why we collected and use your information;
- our legal and regulatory requirements (for example, certain records may need to be kept for several years, such as for tax or accounting purposes);
- whether you still have an ongoing relationship with us;
- any requests you’ve made to delete your information; and
- our legitimate business needs, such as resolving disputes or enforcing our agreements.
When we no longer need your personal information, we will delete it or anonymize it so it can no longer be linked to you.
COOKIES AND TRAFFIC DATA
COOKIES AND TRAFFIC DATA
Please refer to the “Cookies and Traffic Data” section of the Privacy Notice for information about our use of cookies and other automated technologies. You can adjust your cookie settings at any time by following the instructions set forth in the “Withdrawing Your Consent for (Opting Out of) Cookies and Other Automated Technologies” section of the Privacy Notice.
PRIVACY RIGHTS AND HOW TO EXERCISE THEM
PRIVACY RIGHTS AND HOW TO EXERCISE THEM
Subject to certain limitations and exceptions, you have the right to request to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete personal information.
- Delete your personal information in certain circumstances.
- Restrict or object to our processing of your personal information.
- Data portability, allowing you to obtain and reuse your personal information for your own purposes.
- Withdraw consent at any time where processing is based on your consent.
- Lodge a complaint with your local data protection authority.
To exercise your privacy rights, please refer to the “How to Exercise Your Privacy Rights” section of the Privacy Notice.
Withdrawing Consent
Withdrawing Consent
If you have previously given us permission to use your personal information—such as for marketing—you can withdraw that consent at any time. This will not affect how we used your information before you withdrew your consent.
To withdraw consent for specific activities (like cookies, location data, or marketing), please follow the steps in the “Withdrawing Consent” section of our Privacy Notice. You can also email us at privacyrequests@elfbeauty.com with the subject line “Withdrawing Consent.” In your message, please tell us what consent you would like to withdraw and which e.l.f. Beauty brand your request relates to.
COMPLAINTS
COMPLAINTS
We aim to be transparent about how we collect and use your personal information, and we welcome your questions. If you have a concern or complaint about how we handle your information, please contact us using the details in the “Contact Us” section of our Privacy Notice.
If you believe we have not handled your personal information in accordance with applicable law, you may also have the right to file a complaint with your local data protection authority.
CONTACT US
CONTACT US
If you have questions or concerns about this EU/UK Privacy Supplement, please contact us using the contact information detailed in the “Contact Us” section in the Privacy Notice.
