Privacy and Cookie Policy

The privacy of visitors to our website

The privacy of visitors to our website _____________ is of utmost importance to us.
This Privacy and Cookie Policy (the “Policy”) describes how _____ (Company number _____), hereinafter referred to as “COMPANY”, “we”, “us”, “our” or the “Data Controller”, collects, uses, stores, and protects your personal information when you access or use our website and services (“Website”).

We are committed to protecting your personal data and processing it in accordance with the UK Data Protection Act, the General Data Protection Regulation (GDPR), and other applicable laws of England and Wales.

This Policy applies solely to information collected on our Website. We are not responsible for privacy policies or practices of third-party websites, platforms, or services that may be linked to from our Website.

1. Terms and Definitions

1.1. Website – an Internet resource operated by COMPANY and available at ____________, containing content, services, AI-based analysis tools, and other resources accessible online.
1.2. COMPANY / Data Controller – the legal entity that owns and manages the Website, determines the purposes and means of processing personal data, and is responsible for data protection compliance.
1.3. User / Data Subject – any natural person who has accessed the Website and has reached the age of at least 18 years, who voluntarily provides their personal data and agrees to this Policy.
1.4. Personal Data – any information relating to an identified or identifiable natural person, including but not limited to: name, contact information, identification numbers, online identifiers, and technical data.
1.5. Processing of Personal Data – any action or series of actions performed on personal data, whether automated or not, including collection, recording, storage, structuring, alteration, use, dissemination, erasure, or destruction.
1.6. Cookies – small text files stored on a user’s device to enhance Website functionality, improve user experience, and support analytics.

2. Principles of Data Processing

2.1. We process your personal data in accordance with the principles of legality, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, confidentiality, and accountability.
2.2. We ensure that the processing of data is proportionate to the services provided and does not exceed what is necessary for the stated purposes.

3. Data We Collect

3.1. Data provided directly by you:

• Full name, email address, phone number, billing and payment information.
• Product names, ingredients, or images submitted for analysis.
• Information entered into feedback forms, registration forms, or support requests.
• Correspondence sent to us via email or through the Website.

3.2. Automatically collected technical data:

• IP address, browser type and version, operating system, device identifiers.
• Date and time of visits, pages viewed, actions performed, and time spent.
• Access logs, session information, and referral sources.

3.3. Cookies and similar technologies:

• Session cookies for navigation and secure login.
• Persistent cookies for analytics and personalization.
• Advertising pixels and trackers for marketing purposes.

3.4. Sensitive data:
We do not intentionally collect special categories of personal data (health, ethnicity, religion, political opinions, biometrics, etc.) unless explicitly submitted by you for analysis purposes. Any sensitive data is processed strictly for delivering services.

4. Purposes of Data Collection and Processing

We may process your personal data for:

1. Identifying users and managing accounts.
2. Providing AI-driven cosmetic product analysis, compatibility assessments, and skincare recommendations.
3. Processing orders, issuing invoices, and completing transactions.
4. Delivering purchased services and making reports available electronically.
5. Responding to customer inquiries, support requests, and feedback.
6. Performing marketing communications and sending updates (with your consent).
7. Monitoring website security, detecting fraud, and ensuring service stability.
8. Performing internal analytics and business optimization.
9. Complying with legal and regulatory obligations.

5. Legal Basis for Processing

We process data based on:

• Your consent – when required by law (e.g., newsletters or cookies).
• Contractual necessity – to deliver services purchased on our Website.
• Legal obligations – compliance with applicable legislation and tax requirements.
• Legitimate interests – fraud prevention, service improvement, analytics, and website security.

6. Data Storage and Retention

6.1. Personal data is stored on secure servers located in the UK or European Economic Area (EEA).
6.2. We retain your data only as long as needed for the purposes outlined in this Policy or as required by applicable laws.
6.3. Anonymized data used for analytics may be stored indefinitely.

7. Cookies and Tracking Technologies

7.1. We use cookies and tracking technologies to:

• Improve functionality and navigation of the Website.
• Provide secure authentication and fraud prevention.
• Analyze performance and traffic statistics.
• Deliver targeted advertising and marketing campaigns.

7.2. You can disable cookies through your browser settings; however, some functions may not operate properly.
7.3. Third-party analytics services (e.g., Google Analytics, Meta Pixel) may also set cookies. These providers act as data processors and are contractually obligated to protect your data.

8. Disclosure of Data to Third Parties

8.1. We may share personal data with:

• Payment processors and banking institutions for order processing.
• IT service providers, hosting companies, and software tools.
• Auditors, consultants, and professional service providers bound by confidentiality agreements.
• Government authorities, regulators, or law enforcement upon lawful request.

8.2. We do not sell or rent personal data to third parties for marketing purposes.

9. International Data Transfers

If data is transferred outside the UK/EEA, we ensure adequate safeguards, such as:

• Standard Contractual Clauses (SCCs);
• Adequacy decisions issued by regulatory authorities;
• Binding corporate rules or equivalent safeguards.

10. Security Measures

10.1. We use encryption, multi-factor authentication, secure servers, firewalls, and restricted access policies to protect personal data.
10.2. Although we take all reasonable measures, no system is completely secure. By using the Website, you acknowledge this risk.

11. User Rights Under GDPR

Users have the right to:

1. Access their personal data.
2. Rectify inaccurate or incomplete information.
3. Request data erasure (“right to be forgotten”).
4. Restrict or object to processing.
5. Withdraw consent at any time.
6. Request data portability.
7. Lodge a complaint with the UK Information Commissioner’s Office (ICO).

Requests can be sent to email@example.com.

12. Age Restrictions

12.1. Our services are intended for individuals aged 18 or older.
12.2. If we become aware that we have collected data from a minor, such data will be promptly deleted.

13. Third-Party Links and Integrations

13.1. Our Website may contain links or integrations with external services. This Policy does not apply to those third-party services.
13.2. We recommend reviewing third-party privacy policies before providing data.

14. Updates to This Policy

14.1. We may update this Policy from time to time.
14.2. All changes will be published on this page with the updated Effective Date.
14.3. Continued use of the Website constitutes acceptance of changes.

15. Contact Information

For questions or to exercise your privacy rights, please contact:
Email: _______