Privacy Policy

The Aesthetic Meet 2026 — Hermès Cape Cod Sweepstakes & Symplast Rewards

Effective Date: May 1, 2026 · Last Updated: May 1, 2026

DRAFT — FOR LEGAL REVIEW. This Privacy Policy is a working boilerplate based on industry-standard practice and the live system's data flows. Symplast in-house counsel and outside privacy counsel will finalize and conform the language before publication. Bracketed items (e.g., [CONTACT EMAIL]) are placeholders pending finalization.

1. Introduction

Symplast Acquisition Inc. (“Symplast,” “we,” “us,” or “our”) provides this Privacy Policy to explain how we collect, use, share, and protect personal information in connection with (a) the Hermès Cape Cod Sweepstakes (the “Sweepstakes”) and (b) the Symplast Rewards loyalty program (“Symplast Rewards” or the “Program”) offered at The Aesthetic Meet 2026. This Privacy Policy applies to information collected through the Sweepstakes entry form, the Symplast Rewards member experience, the AMOE postcard mail-in path, the Symplast booth (Booth #1019), and related communications.

By submitting an entry to the Sweepstakes or enrolling in Symplast Rewards, you acknowledge that you have read this Privacy Policy. The Sweepstakes is governed separately by its Official Rules; Symplast Rewards is governed separately by its Program Terms.

2. Information We Collect

2.1 Information you provide directly

• Sweepstakes entry: first name, last name, email address, phone number, practice or business name, US state, and your self-attestation that you are engaged in the medical aesthetics industry. AMOE entrants additionally provide a complete mailing address and date of birth on the postcard.
• Symplast Rewards profile:if you enroll in Symplast Rewards and choose to complete profile fields, you may provide your professional role, practice type, current EHR/practice management system, practice website URL, practice mailing address, number of providers, number of locations, and your practice's social media URLs (LinkedIn, Facebook, Instagram, TikTok, YouTube, Google Business).
• Engagement activity: records of activities you complete in the Program (e.g., quiz responses, social-follow claims, uploaded booth selfies, scans of Symplast staff badges at the booth).
• Marketing preferences: if you choose to opt in to receive marketing communications by email and/or SMS, your opt-in selection per channel.
• Winner verification: if you are selected as the potential Sweepstakes winner, additional information you provide on the affidavit of eligibility, publicity release, IRS Form W-9, and industry-affiliation documentation.

2.2 Information collected automatically

• Device and connection data: IP address, browser type, operating system, device identifiers, and approximate location (derived from IP).
• Usage data: pages visited, links clicked, features used, timestamps, and similar interaction data within the entry flow, the rewards member experience, and our marketing emails.
• Cookies and similar technologies: small data files stored on your device. We use a strictly necessary session cookie (rewards_session) to keep you signed in to Symplast Rewards, a referral-attribution cookie (ref_token) to credit referrers, analytics cookies, and a bot-protection challenge token. See Section 6 for details and your choices.
• Referral attribution: if you arrive via a referral link from another participant, we record the referrer to credit their account, and we record whether the referee subsequently verified their email.

2.3 Information from third parties

• Bot-protection and abuse-signal providers (e.g., Cloudflare Turnstile) — outcome of the challenge associated with your form submission.
• Email-delivery infrastructure — bounce, complaint, and engagement events for the verification and notification emails we send you.
• HubSpot CRM — if you are an existing Symplast contact or your organization is an existing Symplast company in our CRM, we may associate your Sweepstakes or Rewards data with your existing contact and company records.

3. How We Use Your Information

We use the information we collect to:

• Administer the Sweepstakes (eligibility verification, winner selection, prize fulfillment, recordkeeping required by 940 CMR 30 and other applicable law);
• Operate Symplast Rewards (track Points, unlock tiers, deliver redemption QR codes, fulfill on-site redemptions);
• Send transactional communications you have requested (e.g., entry confirmation, email-verification link, redemption confirmations);
• Send marketing communications, but only via channels you have separately opted in to (email and/or SMS);
• Detect and prevent fraud, abuse, and misuse of the Sweepstakes or the Program;
• Operate, maintain, debug, secure, and improve the Sweepstakes and the Program;
• Comply with legal obligations (tax reporting under IRS rules; recordkeeping under MA 940 CMR 30 and similar state requirements; responding to lawful requests from authorities);
• Establish, exercise, or defend legal claims.

4. Legal Bases (Where Applicable)

Where applicable law (including the EU/UK GDPR) requires us to identify a legal basis for processing your personal information, we rely on: (a) your consent (e.g., for marketing communications you opted in to); (b) the necessity of processing to perform a contract with you (e.g., delivering a prize you were selected to receive); (c) compliance with our legal obligations (e.g., tax reporting, regulatory recordkeeping); and (d) our legitimate interests in operating the Sweepstakes and the Program securely and effectively, provided those interests are not overridden by your rights.

5. How We Share Your Information

We share personal information only as described below.

• Service providers and processors who operate components of the Sweepstakes and the Program on our behalf, including: cloud-application hosting; database and storage; queue and cache infrastructure; email delivery; SMS delivery (if you have opted in); customer-relationship-management (CRM); analytics and product-analytics; error monitoring; uptime monitoring and incident response; and bot-protection. These providers are contractually bound to use personal information only to provide their services to us. The current list of categories of providers is summarized above; the specific provider list is available on request via the contact information in Section 13.
• Legal compliance and protection of rights: we may disclose personal information to comply with applicable law, regulation, legal process, or governmental request; to enforce our terms; to protect the rights, property, or safety of Symplast, our users, or others; or in connection with an investigation of suspected or actual unlawful activity.
• Business transfers: if Symplast undergoes a merger, acquisition, financing, reorganization, sale of assets, or other corporate transaction, personal information may be transferred to the successor entity, subject to appropriate confidentiality protections.
• With your direction or consent: we may share personal information with third parties when you direct us to or have otherwise consented.
• Aggregated or de-identified information: we may share aggregated or de-identified information that cannot reasonably be used to identify you for any purpose.

We do not sell your personal informationfor monetary consideration. As described in Section 9.2 below, certain CCPA “sharing” or “sale” concepts may apply to cross-context behavioral advertising or analytics; please review that section for details.

6. Cookies and Similar Technologies

We and our service providers use cookies, web beacons, pixels, local storage, and similar technologies. The categories we use are:

• Strictly necessary — required for the site to function (session cookie for Symplast Rewards sign-in, bot-challenge token, referral-attribution cookie). These cannot be disabled without breaking the experience.
• Analytics — measure traffic, feature usage, and performance of the Sweepstakes and the Program.
• Session replay / heatmap (where used) — record aggregate, redacted views of how members interact with the rewards interface to identify usability issues.

You can control non-essential cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using features of the Sweepstakes or the Program.

7. Marketing Communications

We send marketing communications (email and/or SMS) only to members who have separately opted in to each channel within Symplast Rewards. Each opt-in is unchecked by default and is recorded with a timestamp. You may withdraw consent at any time by following the unsubscribe link in any marketing email, replying STOP to any marketing SMS, or contacting us at the address in Section 13. Withdrawing marketing consent does not affect your Sweepstakes entry, your existing Points balance, or your eligibility to continue earning Points through other activities.

8. Retention

We retain personal information for as long as needed to administer the Sweepstakes and the Program, comply with our legal obligations, resolve disputes, and enforce our agreements. In particular, records of Sweepstakes entries, the winner-selection process, audit logs, and related compliance artifacts are retained for at least four (4) years after the close of the Sweepstakes, consistent with the recordkeeping expectations of Massachusetts 940 CMR 30 and applicable IRS reporting requirements. After applicable retention periods expire, we delete or de-identify personal information.

9. Your Rights and Choices

9.1 General rights

Depending on your jurisdiction, you may have the right to: (a) request access to the personal information we hold about you; (b) request correction of inaccurate personal information; (c) request deletion of your personal information, subject to legal exceptions (including the 4-year recordkeeping requirement noted above); (d) object to or restrict certain processing; (e) request portability of personal information you provided to us; and (f) withdraw consent where processing is based on consent. Requests should be sent to the contact in Section 13. We will respond within the timeframes required by applicable law.

9.2 California privacy notice (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). The categories of personal information we collect, the sources of that information, the business and commercial purposes for collection, and the categories of third parties with whom we share information are described above in Sections 2, 3, and 5.

California residents may have the right to: (a) know what personal information we collect, use, disclose, and (where applicable) sell or share; (b) request deletion or correction; (c) opt out of any “sale” or “sharing” (including for cross-context behavioral advertising) of their personal information; (d) limit the use or disclosure of sensitive personal information; and (e) be free from retaliation for exercising any CCPA right.

Notice of Financial Incentive (Symplast Rewards). Symplast Rewards is a voluntary loyalty program that offers Points and tier unlocks in exchange for engagement activities, some of which involve providing personal information (for example, profile completion and marketing opt-ins). Participation is entirely optional, requires affirmative opt-in, and may be withdrawn at any time without penalty. We have estimated that the value of the personal information collected through the Program, taken as a whole, does not exceed the aggregate retail value of the rewards offered to members; the Program is reasonably related to the value of that information based on the costs of operating the Program and the customary reward values offered by comparable B2B loyalty programs in our industry.

To exercise California rights, contact us using the information in Section 13. Authorized agents may submit requests on your behalf with documentation establishing the agent's authority. We will not discriminate against you for exercising any CCPA right.

9.3 EU/UK residents

Although the Sweepstakes is open only to legal US residents, if EU or UK residents otherwise engage with our information practices, they have rights under the GDPR/UK GDPR, including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with their supervisory authority. Where we process personal information based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

9.4 Other US states

Residents of other US states with comprehensive consumer privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Florida, and Delaware, as those laws come into effect) may have rights similar to those described above. To exercise those rights, contact us using the information in Section 13.

10. Data Security

We use commercially reasonable administrative, technical, and organizational safeguards to protect personal information from unauthorized access, disclosure, alteration, and destruction, including transport-layer encryption in transit, encryption at rest for sensitive fields where applicable, role-based access controls, audit logging of administrative actions, and Symplast's written information security program (WISP) as required by Massachusetts 201 CMR 17. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

11. Children's Privacy

The Sweepstakes and Symplast Rewards are intended for individuals 18 years of age or older (or the age of majority in their state of residence) and are not directed to children. We do not knowingly collect personal information from individuals under 13 years of age. If you believe a child has provided personal information to us, please contact us at the address in Section 13 and we will take appropriate action.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Effective Date” and “Last Updated” date at the top of this page indicate when this Policy was last revised. Material changes will be notified through the Sweepstakes and Program interfaces and, where required by law, by direct communication. Continued participation after a change becomes effective constitutes acceptance of the updated Policy.

13. Contact Us

Questions, requests, complaints, or rights-exercise communications regarding this Privacy Policy or our information practices should be directed to:

14. Sponsor Identity and Trademarks

The Sweepstakes and Symplast Rewards are operated by Symplast Acquisition Inc. HERMÈS® and CAPE COD™ are trademarks of Hermès International. The Sweepstakes and the Program are not sponsored, endorsed, administered by, or associated with Hermès International, The Aesthetic Society, The Aesthetic Meet, the venue at which The Aesthetic Meet 2026 is held, or any social media or technology platform used to promote or administer the Sweepstakes or the Program.

— DRAFT — FOR LEGAL REVIEW —