NU SKIN GLOBAL PRIVACY NOTICE

LAST UPDATE: February 24, 2023

1. Table of Contents

1. Table of Contents
2. Overview
3. Who we are and how to contact us
4. What Personal Data do we collect?
5. How we use your Personal Data
6. Sharing and transferring your Personal Data
   1. We do not sell your Personal Data
   2. We do not disclose your Personal Data to third parties for their own direct marketing purposes
   3. If you are a Brand Affiliate, we may share your Personal Data with other Brand Affiliates and customers
   4. If you are a customer, we may share your Personal Data with certain Brand Affiliates
   5. We may share your Personal Data within the Nu Skin group
   6. We may share your Personal Data to our trusted third-party suppliers who may process it on our behalf
   7. We may also disclose your Personal Data to other third parties
7. International Transfers
   1. International data transfers
   2. EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield
8. How we protect your Personal Data
9. How long do we keep your Personal Data
10. What are your rights regarding your Personal Data
11. Your marketing choices
12. Your obligations
13. Children
14. Changes to the Privacy Notice

Annex 1 – List of Nu Skin entities responsible for processing your Personal Data

Annex 2 - List of personal data processing activities

2. Overview

At Nu Skin, we want to set the standard for the industry in data protection. To that end, Nu Skin is committed to respecting and protecting your privacy rights and your choices and to treating your Personal Data with the utmost care in all circumstances.

Our Privacy Notice is designed to provide transparency into our privacy practices and principles in a format that is easily understandable and readable.

This Privacy Notice explains how we process the Personal Data we collect about you

• when you buy and/or use our products, services and mobile applications,
• when you browse our Websites and social media content,
• when you participate in events organized by us,
• when you visit our premises, or
• when you apply for a job at Nu Skin.

Please ensure you read this Privacy Notice carefully before using our Websites or mobile applications and/or providing us with your Personal Data.

3. Who we are and how to contact us

Nu Skin Enterprises Inc. and its affiliates and subsidiaries (“Nu Skin”, “we”, “us” and “our”) are an international group of companies offering personal care products, nutritional supplements, devices and other goods or services through (i) the Nu Skin websites (whether local or global) (each a “Website”), (ii) Nu Skin mobile applications and tools (the “Apps”) and (iii) a network of independent distributors or sales people (“Brand Affiliates¹”).

Depending on who you are or how you interact with us, your Personal Data are processed by different entities of Nu Skin and/or for different purposes. You will find here (Annex 1) the list of the Nu Skin entities acting as data controllers responsible for processing your Personal Data. Please contact the Privacy Team if you have questions or concerns, want to update your Personal Data, or to exercise your rights as described below.

4. What Personal Data do we collect?

Personal Data, or Personal Information, means any information or pieces of information that could identify you directly (e.g. your name) or indirectly (e.g. through your email address or telephone number). Personal Data may include a name, an (email) address, a telephone number, credit card information, preferences, age, gender, or occupation, among other things.

The Personal Data that we collect, and how we collect it, depends on how you interact with us. For a complete overview of the Personal Data we process about you, as well as our interaction-specific data processing activities, and our processing purposes, please refer to our “List of Personal Data Processing Activities”, here.

We might collect or receive Personal Data from you via our Website, Apps, social media channels, call center or when you otherwise transfer Personal Data to us. Sometimes you give this Personal Data to us directly (e.g. when you create an account, when you contact us, when you purchase from our Website), and sometimes we collect it (e.g. using cookies to understand how you use our Website and Apps, or through our smart devices).

In some circumstances we may also receive Personal Data about you from:

• Brand Affiliates;
• individuals who provide us with your Personal Data (e.g. your family members);
• regulatory bodies;
• other companies providing services to us (e.g. social listening companies; past employers; recruitment agencies).

Some of these third-party sources may include publicly available sources of information. In particular, we may receive Personal Data from social networks when you engage with our content, reference our Website, or grant us permission to access information from these social networks.

In addition, where permitted by law, we may collect, either directly or through third party service providers, information that is publicly available on the Internet (e.g. from websites, blogs, social media).

5. How we use your Personal Data

We process your Personal Data based on the following legal grounds, as permitted by applicable law:

• to fulfill our obligations under a contract with you, or to take steps prior to entering into a contract with you (e.g. you ask us to create a customer account for you or you wish to purchase a product from us);
• to comply with a legal obligation (e.g. when you make a purchase we need to keep your transaction information to comply with our tax, financial reporting, and consumer protection obligations);
• when it is in our legitimate business interest to use your Personal Data (e.g. to operate, evaluate and improve our organization; to prevent and protect us and others against fraud, unauthorized transactions, claims and other liabilities; to ensure compliance with company policies and industry standards);
• based on your consent (e.g. when you opt-in to subscribe to our marketing newsletters).

Our use of your Personal Data depends on who you are and how you interact with us. Click here for a list of the ways that we use your Personal Data, and which of the reasons we rely on to do so.

We will only process special categories of Personal Data (e.g., race or ethnicity; health-related data) when you request us to do so (i.e. when we have your explicit consent) or in exceptional circumstances and where we have a legal basis to do so (e.g., to protect your vital interests).

Please contact the Privacy Team if you have any questions about how we collect and use your Personal Data.

6. Sharing and transferring your Personal Data

When we share your Personal Data as described below, we will take the necessary steps to ensure that any third- party recipients have implemented reasonable security mechanisms to protect your Personal Data.

a. We do not sell your Personal Data

First, we want to be clear that we do not and will not sell your Personal Data to third parties; and in the past 12 months, we have not sold your Personal Data to any third party.

b. We do not disclose your Personal Data to third parties for their own direct marketing purposes

Also, we do not disclose your Personal Data to third parties for their own direct marketing purposes. However, if you direct us to share your Personal Data with third-party sites or platforms, such as social networking sites, these third- party sites or platforms could potentially use your data for marketing reasons.

With your Downlines – If you are a Brand Affiliate, we may transfer your Personal Data to your personally sponsored customers and Brand Affiliates (“Downlines”) in order to enable them to reach out to you for support, training and product recommendations. The Personal Data we make available to your Downlines may include your name, profile picture, and contact details. If you do not want your Downlines to have access to your Personal Data, you can edit your privacy settings in V&G, your account or by contacting customer care.

With your Uplines – We may also transfer your Personal Data to your sponsor, upline Brand Affiliates and upline Brand Representative (“Uplines”) so that they can reach out to you and provide you with business and/or product support and training, . The Personal Data we make available to your Uplines may include your account information (name, photo, birthday, contact details), business information (market, overall purchase volume and volume generated by your ADR contract (auto-ship) and date it is scheduled to ship, pin title, activity dates) and your order information including your purchases (product name, quantity, volume, price, order tracking, ship to details), as well as auto-ship contract details (product name, quantity, price, ship to details). You can manage what Personal Data is shared with which Uplines by editing your privacy settings in V&G, your account, or by contacting customer care. In addition, we may inform your Uplines about your qualification to our incentive trips.

d. If you are a customer, we may share your Personal Data with certain Brand Affiliates

We may transfer your Personal Data to your sponsor, upline Brand Affiliates and upline Brand Representative (“Uplines”) so that they can reach out to you and provide you with product support and recommendations. The Personal Data we make available may include your account information (name, photo, birthday, contact details), and your order information including your purchases (product name, quantity, volume, price, order tracking, ship to details), as well as auto-ship contract details (product name, quantity, price, ship to details). You can manage what Personal Data is shared with your sponsor by editing your privacy settings in your account, or by contacting customer care.

e. We may share your Personal Data within the Nu Skin group

Your Personal Data may be accessed within Nu Skin. This means that we may share your Personal Data across the Nu Skin group of companies, which includes our ultimate parent company and its affiliates and subsidiaries. Access will always be controlled on a need-to-know basis, and only provided where it is necessary to provide you with requested services or to allow us to perform any necessary or legitimate functions (including for operational, management, administrative, supervisory or evaluative or educational purposes). You may consult the list of Nu Skin entities that may receive your data here (Annex 1) and a list of data processing purposes and categories here (Annex 2).

f. We may share your Personal Data to our trusted third-party suppliers who may process it on our behalf

We rely on trusted third parties to perform a range of business operations on our behalf. We always use our best efforts to ensure that all third parties we work with will keep your Personal Data secure. We only provide them with the information they need to perform the service, and we require that they do not use your Personal Data for any other purpose. For example, we may entrust services that require the processing of your Personal Data to:

• Third parties that assist and help us in providing digital and e-commerce services such as social listening, store locator, loyalty programs, identity management, ratings and reviews, CRM, web analytics and search engine, user generated content curation tools;
• Advertising, marketing, digital and social media agencies to help us deliver advertising, marketing, and campaigns, to analyze their effectiveness, and to manage your contact, questions and our relationship;
• Third parties required to deliver a product to you (e.g. postal/delivery services);
• Third parties that assist and help us in providing IT services, such as platform providers, hosting services, maintenance and support on our databases as well as on our software and applications;
• Third parties that assist in maintaining the security of our systems, Websites and Apps;
• Third parties that provide us with consulting services in the field of market research and analytics, collect feedback and conduct market surveys on our products, services and otherwise for customer relationship management purposes;
• Payment service providers and credit reference agencies for the purpose of assessing your credit score and verifying your details where this is a condition of entering into a contract with you;
• Third parties that assist us for customer care and cosmetovigilance and pharmacovigilance purposes;
• Third parties that assist us for the organization of events, incentive trips, meetings, etc. in which you may participate;
• Lawyers, auditors, financial advisors, and other third party service providers in connection with their services to Nu Skin.

g. We may also disclose your Personal Data to other third parties

If Nu Skin or a part of its assets are acquired by a third party, Personal Data we hold relating to those assets will be one of the transferred assets. In such cases, your Personal Data will be processed by the buyer acting as the new controller and its privacy policy will govern the processing of your Personal Data.

We may also disclose your Personal Data to any regulatory, statutory, governmental or other relevant authorities, agencies or bodies and industry regulators, and any other person to whom Nu Skin is compelled, required or permitted to do so by law, rules or regulations, legal process or litigation, or to any person pursuant to any order of a court of competent jurisdiction or comparable legal process.

In other circumstances if we have your consent or we are permitted to do so by law.

7. International Transfers

a. International data transfers

You understand and agree that we may transfer Personal Data to other jurisdictions as necessary for the purposes described in this Privacy Notice, including to jurisdictions that may not provide the same level of data protection as the jurisdiction in which your Personal Data was originally collected. For instance, we may transfer your data to the U.S. because our parent companies are located there.

When we transfer your Personal Data to other countries or jurisdictions, we will protect that data as described in this Privacy Notice and in accordance with applicable law. Where required under applicable law, we will put in place binding contractual obligations with the data recipient to safeguard your data protection rights. Furthermore, we will notify any data transfer and/or data transfer mechanisms to the competent Supervisory Authority where required under applicable law.

With respect to transfers originating from the European Economic Area ("EEA") to the United States and other non- EEA jurisdictions, we implement standard contractual clauses approved by the European Commission, and other appropriate solutions to address cross-border transfers as required or permitted by Articles 46 and 49 of the General Data Protection Regulation. Please contact the Privacy Team if you have any questions with respect to the safeguards we have put in place to protect your Personal Data when we transfer this (including how to obtain a copy of or consult these safeguards).

b. EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield

Nu Skin International Inc. (NSI) participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. Prior to July 16, 2020, Nu Skin relied on its EU-US Privacy Shield certification as one means of demonstrating adequacy and safeguarding transfers of data from the EU. In addition to Privacy Shield, Nu Skin also executed Standard Contractual Clauses with entities involved in such data transfers. As of July 16, 2020, Nu Skin has primarily relied on Standard Contractual Clauses for EU and UK transfers. For transfers occurring prior to July 16, 2020, Nu Skin will continue to be responsible for the processing of EU and UK Personal Information under the EU Privacy Shield Framework and will maintain full compliance with the requirements of that framework until further notice. Subsequent transfers of EU or UK Personal Information to any third-party acting as an agent on our behalf occurring after July 16, 2020, will be under the terms of the EU Commission’s Standard Contractual Clauses. To learn more about the Privacy Shield Frameworks, and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List at https://www.privacyshield.gov/list.

Nu Skin is responsible for both the processing of Personal Data it has received, under each Privacy Shield Framework, and the subsequent transfers to a third party acting as an agent on its behalf. Nu Skin complies with the Privacy Shield Principles for all onward transfers of Personal Data from the EU and Switzerland, including the onward transfer liability provisions.

With respect to Personal Data received or transferred pursuant to the Privacy Shield Frameworks, Nu Skin is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback- form.truste.com/watchdog/request.

Under certain conditions, more fully described on the Privacy Shield website at https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

8. How we protect your Personal Data

We protect your Personal Data and implement reasonable security measures including physical (e.g. secured filing cabinets), technical and organizational security measures appropriate to protect your Personal Data against unauthorized or unlawful processing and against any accidental loss, destruction, or damage.

In particular, we operate data networks protected by industry standard firewall and password protection systems. We also use transport layer security (TLS) to protect the transmission of your Personal Data. Access to this information will be provided only to authorized individuals for legitimate business purpose.

In addition, access to your Personal Data is restricted to staff and service providers on a need-to-know basis.

While we endeavor to always protect our systems, sites, operations and information against unauthorized access, use, modification and disclosure, due to the inherent nature of the Internet as an open global communications vehicle and other risk factors, we cannot guarantee that any information, during transmission or while stored on our systems, will be absolutely safe from intrusion by others.

Please contact the Privacy Team if you have any questions about how we protect your Personal Data.

9. How long do we keep your Personal Data

We hold on to your Personal Data for as long as necessary to achieve the processing purposes described in our “List of Personal Data Processing Activities”.

This means, for instance, that we no longer store your Personal Data when our (contractual) relationship with you comes to an end, unless further storage is permitted or required under applicable law.

Generally, and while this will depend on several factors as outlined below, we do not keep your data for longer than 10 years. To determine the retention period of your Personal Data, we consider several criteria, including:

• The purpose for which we hold your Personal Data;
• Our legal and regulatory obligations in relation to that Personal Data, for example any financial reporting obligations;
• Whether our relationship with you is ongoing, for example, you have an active account, you continue to receive marketing communications, or you regularly browse or purchase off our Website or Apps);
• Any specific requests from you in relation to the deletion of your Personal Data; and
• Our legitimate interests in relation to managing our own rights, for example the defense of any claims.

When we no longer need to use your Personal Data, it is removed from our systems and records, or anonymized so that you can no longer be identified from it.

10. What are your rights regarding your Personal Data

Nu Skin values your privacy rights and is committed to providing you control over your Personal Data. If you exercise any of these rights explained in this section of the Privacy Notice, we will not disadvantage you. You will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services.

Generally, you have the following rights:

• Information. You have the right to be provided with clear, transparent and easily understandable information about how we use your Personal Data, and your rights. This is why we are providing you with the information in this Privacy Notice;
• Rectification. You have the right to require that any incomplete or inaccurate Personal Data that we process about you is amended;
• Deletion. You have the right to request that we delete Personal Data that we process about you, subject to certain exceptions, for instance, where we need to keep your Personal Data to comply with a legal obligation;
• Withdrawing Consent. If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing that was based on your consent prior to withdrawal. This includes cases where you wish to opt out from marketing messages that you receive from us; and
• Access. Subject to certain exceptions, you have the right to access and request a copy of the Personal Data we are processing about you, which we will provide to you in electronic form and/or in writing, or verbally where allowed by applicable laws. Where permissible under applicable laws, we may charge you a reasonable fee for this access request.

In addition, if you are in the EEA or Thailand you have the following rights:

• Restriction. You have the right to request that we restrict our processing of your Personal Data under specific conditions (also applicable if you are in Macau; in Korea, this right is known as the right to request the suspension of the processing of your Personal Data);
• Portability. You have the right to request that we transmit the Personal Data we hold in respect of you to you or to another data controller under specific conditions; and
• Objection. Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defense of a legal claim.

Where we process your Personal Data for direct marketing purposes, you have the right to object at any time to such processing, including for profiling purposes to the extent that it is related to direct marketing. If you object to processing for direct marketing purposes, we will no longer process your Personal Data for such purposes.

You can exercise the above rights, where applicable by contacting the Privacy Team or by using our online tool in the markets where such tool is available. California residents can also call the following toll-free number: 800-211-5200. We will respond to any of your requests to exercise these above data subject rights within the period prescribed by applicable laws. At our discretion, we may require you to prove your identity before providing the requested information. This is to ensure that your Personal Data is disclosed only to you. We may not be able to appropriately handle your request if you decide not to provide us with the Personal Data that we need to handle your request. If you are a resident of the European Economic Area and are not satisfied with the way we handled your request, or for violations of applicable data protection laws, you may lodge a complaint or file a claim with a competent Supervisory Authority (for example, with the Supervisory Authority in your country or market of residence).

11. Your marketing choices

You can control whether to receive direct marketing from us (e.g., which we may send through electronic means, such as promotional emails). In certain markets, you will need to provide us with your consent before receiving marketing. For instance, we may ask you to tick a box indicating to “receive promotional emails” when you sign up as a new customer or Brand Affiliate. In all markets, you can choose not to receive such communications at any time. If you no longer wish to receive any marketing communications or remain on a mailing list to which you previously subscribed, please follow the unsubscribe link in the relevant communication or contact the Privacy Team.

12. Your obligations

We expect that you only communicate Personal Data about yourself to us. If you also communicate Personal Data about other people to us, then you must ensure that you comply with any legal obligations that may apply to your provision of the information to us, and to allow us, where necessary, to use, process and transfer that information. In particular, and subject to local applicable laws as well as Nu Skin Policies & Procedures, if you use a credit card not issued to you, you confirm that the credit card holder has consented to the use of their credit card in relation to your purchase and has agreed that Nu Skin may collect, use and disclose their Personal Data for the purpose of processing your purchase.

We also expect that the Personal Data that you communicate to us are correct and that, if your Personal Data requires updating, you will promptly inform us.

13. Children

Nu Skin does not direct the sale of its products or services to children, nor does it allow its Brand Affiliates to be underage (under 18 in most markets, under 20 in Japan, and under 19 in Korea).

Nu Skin children’s products can only be purchased by an adult. If you are a minor, you may use the Website only with the involvement of a parent or guardian.

Except in very limited circumstances (e.g. as part of our Corporate Social Responsibility activities), we do not knowingly collect or otherwise process any Personal Data from children under the age of 13 and do not direct our services, Website or Apps to children under the age of 18. If you think that a child for which you are responsible provided Personal Data to us, we strongly encourage you to contact us immediately and we will work with you to find a solution to remediate this.

We encourage you to participate in your child's experience on the Internet and to review important safety tips with each child before they explore the Internet.

If you register your child to a Nu Skin event or incentive trip, we process your child’s Personal Data for the purposes of attending the event or incentive trip. If the event requires processing of your child’s special category data, we will request your explicit consent.

14. Changes to the Privacy Notice

We may update this Privacy Notice from time to time. We will notify you of any significant changes by posting those changes here or by notifying you through other appropriate communication channels we generally use with you. Any changes to this Privacy Notice will be considered effective immediately after the changes are posted on this Website unless otherwise indicated.