PRIVACY POLICY

Last Updated: September 11, 2026

The Innate Life ("The Innate Life," "we," "us," or "our") respects your privacy and is committed to responsibly handling the personal information entrusted to us.

This Privacy Policy describes how we collect, use, disclose, retain and otherwise process personal information when you visit or use www.theinnatelife.com (the "Site"), purchase our products, create or use an account, communicate with us, subscribe to marketing communications, or otherwise interact with The Innate Life (collectively, the "Services").

This Privacy Policy should be read together with any additional privacy notices or consent requests that may be presented to you when personal information is collected.

1. WHO WE ARE

The Innate Life is a Canadian haircare and personal-care business based in Ontario, Canada.

For purposes of applicable privacy and data-protection laws, The Innate Life is responsible for the personal information under its control, except where another organization independently determines how and why your information is processed.

Privacy questions, requests or complaints may be directed to:

The Innate Life
Privacy Contact
Email: support@theinnatelife.co

INFORMATION WE COLLECT

2. INFORMATION YOU PROVIDE TO US

Depending on how you interact with us, we may collect:

Contact Information

Including your:

• Name
• Email address
• Telephone number
• Billing address
• Shipping address

Order and Transaction Information

Including:

• Products purchased
• Order number
• Order history
• Order value
• Discounts
• Returns and exchanges
• Refund information
• Shipping and delivery information
• Customs, tariff and import information

Payment Information

Payments are processed through Shopify and/or authorized payment providers.

The Innate Life generally does not directly receive or store your complete payment-card number.

Our payment providers may process payment-card details, billing information and other information necessary to authorize and complete transactions.

Account Information

If customer-account functionality is available and you create or use an account, we may process information associated with that account, including login and account-management information.

Communications With Us

When you contact customer service or otherwise communicate with us, we may collect:

• Your name and contact information
• Order information
• The contents of your communications
• Photographs or documents you provide
• Information relating to a complaint, return, damaged product or delivery issue
• Other information you voluntarily provide

Please do not send us sensitive personal information unless it is reasonably necessary for us to address your request.

Marketing Information

If you subscribe to marketing communications, we may collect:

• Your email address
• Telephone number, where applicable
• Marketing preferences
• Subscription and unsubscribe information
• Information regarding your interaction with our communications

INFORMATION COLLECTED AUTOMATICALLY

3. DEVICE, USAGE AND TECHNICAL INFORMATION

When you use our Site, we and our service providers may automatically collect certain information about your device and interaction with the Site.

Depending on your settings and applicable law, this may include:

• IP address
• Browser type
• Device type
• Operating system
• Referring URLs
• Pages viewed
• Products viewed
• Search activity
• Shopping-cart activity
• Checkout interactions
• Date and time of visits
• Approximate location derived from IP address
• Advertising identifiers
• Cookie identifiers
• Information regarding interaction with advertisements or marketing communications

We may collect this information through cookies, pixels, tags, software development tools and similar technologies.

INFORMATION FROM OTHER SOURCES

4. INFORMATION WE MAY RECEIVE FROM THIRD PARTIES

We may receive personal information from third parties that help us operate our business, including:

• Shopify
• Payment providers
• Shipping and fulfillment providers
• Advertising and analytics providers
• Marketing providers
• Fraud-prevention and security providers
• Social-media platforms
• Customer-service providers

For example, a shipping carrier may provide us with updated delivery information, or a payment provider may provide transaction-status or fraud-prevention information.

HOW WE USE PERSONAL INFORMATION

5. PURPOSES FOR PROCESSING

We may collect, use or otherwise process personal information to:

Provide Our Services

Including to:

• Process and fulfill orders
• Process payments
• Provide order confirmations
• Arrange shipping and delivery
• Calculate shipping charges
• Calculate applicable taxes, duties or tariffs
• Facilitate customs clearance
• Provide tracking information
• Process returns, exchanges and refunds
• Manage customer accounts

Provide Customer Service

Including to:

• Respond to questions
• Investigate delivery issues
• Resolve complaints
• Review damaged or defective product claims
• Locate orders
• Communicate regarding returns or refunds

Operate and Improve Our Business

Including to:

• Maintain and improve our Site
• Understand how customers use our Site
• Analyze business and Site performance
• Improve our products and customer experience
• Develop new products or services
• Perform internal reporting and analytics

Marketing and Advertising

Where permitted by applicable law, we may use personal information to:

• Send marketing communications
• Measure marketing performance
• Understand customer interests
• Display or measure advertising
• Create or use audiences for advertising
• Personalize marketing or Site experiences

Where consent is required by applicable law, we will seek appropriate consent.

Security and Fraud Prevention

We may process information to:

• Detect potentially fraudulent transactions
• Prevent abuse of our Services
• Protect customer accounts
• Protect our Site and systems
• Investigate suspicious activity
• Enforce our policies
• Protect our legal rights

Legal and Regulatory Purposes

We may process information to:

• Maintain tax and accounting records
• Respond to lawful requests
• Comply with court orders or legal processes
• Meet customs and import/export requirements
• Comply with applicable laws and regulations
• Establish, exercise or defend legal claims

LEGAL BASES FOR PROCESSING

6. EEA AND UK CUSTOMERS

Where the GDPR, UK GDPR or similar legislation requires us to identify a legal basis for processing, we may rely on one or more of the following, depending on the circumstances:

Performance of a contract — for example, processing your information to accept payment, fulfill an order and arrange delivery.

Consent — where you have provided consent for a particular activity and applicable law permits processing on this basis.

Legitimate interests — where processing is reasonably necessary for our legitimate business interests and those interests are not overridden by your applicable rights and freedoms. These interests may include operating and improving our business, preventing fraud, securing our Services and understanding Site performance.

Legal obligation — where processing is necessary to comply with a legal or regulatory requirement.

Where we rely on consent, you may withdraw that consent subject to applicable law. Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

COOKIES & TRACKING TECHNOLOGIES

7. COOKIES

Our Site and our service providers may use cookies and similar technologies to operate and improve the Site.

These technologies may support:

Strictly necessary functions, such as shopping-cart functionality, checkout, security and account authentication.

Functional features, such as remembering preferences.

Analytics, such as understanding Site traffic and how visitors interact with our Site.

Advertising and marketing, such as measuring advertising effectiveness and, where permitted, providing more relevant advertising.

Where required by applicable law, non-essential cookies or similar technologies will be used in accordance with the consent choices available to you.

You may also be able to control cookies through your browser. Blocking certain cookies may prevent some Site functionality from working properly.

SHOPIFY

8. OUR E-COMMERCE PLATFORM

Our online store is hosted by Shopify.

Shopify provides the technology that allows us to operate our storefront, process orders and provide e-commerce functionality.

As part of providing these services, Shopify may process information relating to your:

• Device and Site activity
• Customer account
• Shopping cart
• Checkout
• Orders
• Payments
• Fraud risk
• Interactions with our store

Shopify's handling of personal information is also governed by its applicable privacy terms and notices.

PAYMENTS

9. PAYMENT PROCESSING

Payments are processed through Shopify and/or other authorized payment providers.

These providers may process information necessary to complete and secure your transaction, including payment-card information, billing information and transaction details.

We do not intentionally store complete payment-card information on our own systems.

Payment providers process information in accordance with their own applicable privacy and security practices.

SHIPPING, CUSTOMS & TARIFFS

10. ORDER FULFILLMENT

When necessary to fulfill an order, we may disclose information to:

• Shipping partners
• Postal services
• Couriers
• Fulfillment providers
• Customs brokers
• Customs and border authorities
• Tariff or duty calculation providers
• Other logistics providers

Information disclosed may include:

• Your name
• Shipping address
• Telephone number
• Email address
• Order contents
• Product descriptions
• Product quantities
• Product values
• Country of origin
• Customs classifications
• Duties or tariff information

This information may be required to deliver your order and comply with applicable customs, import, export and tariff requirements.

MARKETING COMMUNICATIONS

11. EMAIL AND SMS

Where permitted, we may send you promotional communications regarding:

• Products
• Promotions
• Sales
• Product launches
• Restocks
• Company news
• Other marketing information

You can unsubscribe from marketing emails using the unsubscribe link contained in the message.

Where SMS marketing is offered, applicable messages will provide instructions for opting out.

Withdrawing from marketing does not prevent us from sending non-marketing communications necessary to service your account or transaction, including order confirmations, shipping notifications, tariff information, recalls, security messages or customer-service responses.

ADVERTISING & ANALYTICS

12. DIGITAL ADVERTISING

We may use advertising and analytics technologies provided by third parties to:

• Understand Site traffic
• Measure advertising performance
• Attribute purchases to marketing campaigns
• Understand customer interactions
• Improve our marketing
• Provide advertising where permitted

These services may process device identifiers, IP addresses, Site interactions, purchase-related information and cookie or advertising identifiers.

Depending on where you live, you may have the right to consent to, reject or opt out of certain uses of personal information for targeted advertising, cross-context behavioural advertising, sharing or similar activities as defined by applicable law.

HOW WE DISCLOSE PERSONAL INFORMATION

13. CATEGORIES OF RECIPIENTS

We may disclose personal information to organizations that assist us in operating our business, including:

• Shopify and e-commerce providers
• Payment processors
• Shipping and fulfillment providers
• Postal and courier services
• Customs and border authorities
• Tax, duty and tariff service providers
• Website hosting and technology providers
• Analytics providers
• Advertising providers
• Email and SMS providers
• Customer-service providers
• Fraud-prevention and security providers
• Professional advisers, such as accountants, lawyers or insurers
• Government or regulatory authorities where required

We seek to limit disclosures to information reasonably necessary for the relevant purpose.

We may also disclose information when required or permitted by law or when reasonably necessary to protect our rights, customers, business or Services.

SALE OR SHARING OF PERSONAL INFORMATION

14. ADVERTISING-RELATED DISCLOSURES

We do not sell personal information for money in the ordinary meaning of the word "sell."

However, certain privacy laws may define "sale," "sharing" or similar terms broadly enough to include some disclosures of identifiers or Internet activity to advertising or analytics partners.

Where applicable law gives you a right to opt out of these activities, we will provide an applicable method for exercising that right.

Cookie and privacy controls available through our Site may also allow you to manage certain advertising-related processing.

INTERNATIONAL TRANSFERS

15. WHERE INFORMATION MAY BE PROCESSED

The Innate Life is based in Canada.

Our service providers may process or store personal information in Canada, the United States and other countries.

As a result, your personal information may be transferred to and processed in a jurisdiction different from where you live.

Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may, where legally permitted, be accessible to courts, law-enforcement agencies or governmental authorities.

Where applicable law requires specific safeguards for international transfers, we will rely on an appropriate transfer mechanism or safeguard as required.

DATA RETENTION

16. HOW LONG WE KEEP INFORMATION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate business or legal requirements.

Retention periods depend on factors including:

• The nature of the information
• The purpose for which it was collected
• Whether an ongoing customer relationship exists
• Tax and accounting requirements
• Fraud-prevention needs
• Contractual requirements
• Applicable limitation periods
• Legal and regulatory obligations
• The need to resolve disputes or enforce agreements

When personal information is no longer reasonably required, we may delete, destroy or anonymize it, subject to applicable legal requirements and technical limitations.

SECURITY

17. HOW WE PROTECT INFORMATION

We use reasonable administrative, organizational and technical safeguards designed to protect personal information against loss, theft, misuse and unauthorized access, disclosure, alteration or destruction.

Access to personal information should be limited to individuals and service providers who reasonably require access for legitimate business purposes.

However, no electronic transmission or storage system can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.

PRIVACY INCIDENTS

18. DATA BREACHES

If we become aware of a privacy or security incident involving personal information, we will assess and respond to the incident in accordance with applicable law.

Where legally required, we will notify affected individuals and/or applicable privacy or regulatory authorities.

YOUR PRIVACY RIGHTS

19. ACCESS, CORRECTION AND OTHER REQUESTS

Depending on where you live, you may have rights concerning your personal information.

Subject to applicable law and exceptions, these may include rights to:

• Know whether we hold personal information about you
• Request access to your personal information
• Request correction of inaccurate or incomplete information
• Request deletion of eligible information
• Withdraw consent where processing is based on consent
• Object to certain processing
• Restrict certain processing
• Obtain certain information in a portable format
• Opt out of certain advertising-related uses or disclosures
• Request information regarding certain disclosures
• Lodge a complaint with an applicable privacy authority

Not all rights apply in every jurisdiction or circumstance.

We will not discriminate against you for exercising a privacy right protected by applicable law.

HOW TO MAKE A PRIVACY REQUEST

20. REQUESTS & IDENTITY VERIFICATION

To submit a privacy request, contact:

support@theinnatelife.co

Please indicate that your request concerns privacy and describe the request sufficiently for us to understand and respond to it.

We may need to verify your identity before granting access, deleting information or fulfilling certain other requests.

We will only request information reasonably necessary to verify your identity and process the request.

Where permitted by applicable law, an authorized agent may submit certain requests on your behalf. We may require evidence that the agent is authorized to act for you.

CANADIAN PRIVACY RIGHTS

21. CANADA

The Innate Life is based in Ontario, Canada and handles personal information in accordance with applicable Canadian privacy requirements.

Subject to applicable law, individuals may request access to personal information under our control and request correction where information is inaccurate or incomplete.

You may also contact us regarding our privacy practices or make a privacy-related complaint.

We will review privacy complaints and respond as appropriate.

Nothing in this Privacy Policy limits rights available under applicable Canadian privacy law.

EEA & UK PRIVACY RIGHTS

22. EUROPEAN ECONOMIC AREA AND UNITED KINGDOM

If you are located in the European Economic Area or United Kingdom, applicable data-protection law may provide rights including:

• Access
• Rectification
• Erasure
• Restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent

These rights are subject to applicable requirements and exceptions.

You may also have the right to lodge a complaint with the data-protection authority responsible for your jurisdiction.

Where processing is based on our legitimate interests, you may have the right to object to that processing in certain circumstances.

Where personal information is used for direct marketing, you may object to such processing as provided by applicable law.

UNITED STATES PRIVACY RIGHTS

23. UNITED STATES

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws.

Depending on your state and the applicability of the relevant law, these may include rights to:

• Confirm whether we process your personal information
• Access certain personal information
• Correct inaccurate information
• Delete eligible information
• Obtain a portable copy of certain information
• Opt out of certain targeted advertising
• Opt out of certain sales or sharing of personal information
• Appeal certain decisions regarding a privacy request

Applicable rights vary by jurisdiction and are subject to statutory exceptions.

Where required, appropriate privacy choices or opt-out mechanisms will be made available through our Site.

MARKETING PREFERENCES

24. WITHDRAWING CONSENT

You may withdraw consent to optional marketing communications at any time using the unsubscribe or opt-out mechanism provided.

Where we rely on consent for another processing activity, you may withdraw that consent subject to applicable legal or contractual restrictions and reasonable notice.

Withdrawal of consent does not affect processing that was lawful before withdrawal.

Certain information is necessary for us to provide products or services. If you do not provide or permit us to process information necessary to fulfill an order, we may be unable to complete the requested transaction.

CHILDREN'S PRIVACY

25. CHILDREN

Our Services are intended for a general adult consumer audience and are not designed or directed toward children.

We do not knowingly collect personal information from children contrary to applicable law.

If you are a parent or guardian and believe a child has provided personal information to us inappropriately, please contact support@theinnatelife.co so that we can review the matter and take appropriate action.

AUTOMATED PROCESSING & FRAUD SCREENING

26. AUTOMATED TOOLS

Our e-commerce, payment, security and fraud-prevention providers may use automated technologies to identify potentially fraudulent, abusive or unauthorized transactions.

This may involve analyzing transaction, device, payment and account information.

Where applicable law provides rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, those rights will apply.

BUSINESS TRANSACTIONS

27. CORPORATE CHANGES

If The Innate Life is involved in a merger, acquisition, financing, restructuring, insolvency, sale of assets or similar corporate transaction, personal information may be disclosed or transferred as part of that transaction where permitted by applicable law.

Any recipient will be subject to applicable legal requirements concerning the personal information it receives.

LEGAL DISCLOSURES

28. COMPLIANCE WITH LAW

We may disclose personal information where we reasonably believe disclosure is required or permitted to:

• Comply with applicable law or legal process
• Respond to lawful requests from government authorities
• Enforce our agreements and policies
• Investigate suspected fraud or unlawful activity
• Protect the rights, property or safety of The Innate Life, our customers or others
• Establish, exercise or defend legal claims

THIRD-PARTY WEBSITES

29. EXTERNAL LINKS

Our Site may contain links to websites, social-media platforms or services operated by third parties.

The privacy practices of those third parties are governed by their own policies.

The Innate Life is not responsible for the privacy practices, security or content of third-party websites or services.

We encourage you to review the applicable privacy policy before providing personal information to a third party.

CHANGES TO THIS PRIVACY POLICY

30. POLICY UPDATES

We may update this Privacy Policy periodically to reflect changes in:

• Our business practices
• Our Services
• Technology
• Service providers
• Legal or regulatory requirements

When we update this Privacy Policy, we will revise the Last Updated date displayed at the beginning of the policy.

Where required by applicable law, we may provide additional notice or obtain consent regarding material changes.

We encourage you to review this Privacy Policy periodically.

QUESTIONS, REQUESTS & COMPLAINTS

31. CONTACT US

If you have questions about this Privacy Policy or our handling of personal information, wish to exercise an applicable privacy right, or would like to make a privacy complaint, please contact:

The Innate Life
Privacy Contact
Ontario, Canada
Email: support@theinnatelife.co

Please include "Privacy Request" in the subject line where possible.

We will review privacy questions, requests and complaints and respond in accordance with applicable law.