Privacy policy

CONFIDENTIALITY DECLARATION

---

ARTICLE 1 - PERSONAL INFORMATION COLLECTED

When you make a purchase on our store, as part of our purchase and sale process, we collect personal information that you provide to us, such as your name, address, and email address.

When you browse our store, we also automatically receive the Internet Protocol (IP) address of your computer, which allows us to gather more details about the browser and operating system you are using.

Email marketing (if applicable): With your permission, we may send you emails about our shop, new products, and other updates.

We value your privacy and the information you consent to share regarding our SMS marketing service. We use this information to send you text notifications (for your order, including abandoned checkout reminders), text marketing offers, and transactional texts, including requests for reviews from us.

Our website uses cookies to keep track of items you put into your shopping cart, including when you have abandoned your checkout. This information is used to determine when to send cart reminder messages via SMS.

ARTICLE 2 - CONSENT

How do you get my consent?

When you provide us with your personal information to complete a transaction, verify your credit card, place an order, schedule a delivery, or return a purchase, we assume that you consent to us collecting your information and using it solely for these purposes.

If we ask you to provide us with your personal information for any other reason, such as marketing purposes, we will ask for your explicit consent or provide you with the opportunity to opt out.

How can I withdraw my consent?

If you change your mind and no longer wish to consent to us contacting you, collecting your information, or disclosing it, you may notify us by contacting us at contact@dermalea.com

ARTICLE 3 - DISCLOSURE

We may disclose your personal information if required by law or if you violate our Terms and Conditions of Sale and Use.

ARTICLE 4 - SHOPIFY

Our shop is hosted on Shopify Inc. They provide us with the online e-commerce platform that allows us to sell our services and products.

Your data is stored in Shopify's data storage system and databases, as well as Shopify's general application. Your data is stored on a secure server protected by a firewall.

Payment:

If you make a purchase through a direct payment gateway, Shopify will store your credit card information. This information is encrypted in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). Details of your purchase transaction are retained for as long as necessary to fulfill your order. Once your order is completed, the purchase transaction details are deleted.

All direct payment gateways comply with PCI-DSS, which is managed by the PCI Security Standards Board and is the result of joint efforts by companies such as Visa, MasterCard, American Express, and Discover.

PCI-DSS requirements ensure the secure processing of credit card data by our store and service providers.

For more information, please refer to the Shopify Terms of Use here or the Privacy Policy here.

ARTICLE 5 - SERVICES PROVIDED BY THIRD PARTIES

In general, the third-party providers we use will only collect, use, and disclose your information to the extent necessary to perform the services they provide to us.

However, some third-party service providers, such as payment gateways and other payment transaction processors, may have their own privacy policies regarding the information we are required to provide to them for your purchase transactions.

For these providers, we recommend that you carefully read their privacy policies to understand how they will handle your personal information.

Please note that some providers may be located in a different jurisdiction than you or us. If you choose to proceed with a transaction that involves the services of a third-party service provider, then your information may be subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.

For example, if you are located in Canada and your transaction is processed by a payment gateway located in the United States, your personal information used in completing that transaction may be subject to disclosure under United States legislation, including the Patriot Act.

Once you leave our store's website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or our Terms and Conditions of Sale.

Links:

You may encounter links on our site that direct you to external websites. We are not responsible for the privacy practices of these other sites and recommend that you read their privacy policies carefully.

Text Marketing and Notifications: By subscribing to text notifications, you agree to receive recurring automated marketing messages at the phone number provided. Consent is not a condition of purchase. Reply STOP to unsubscribe. HELP for help. Msg & Data rates may apply. For more information, please view the Privacy Policy and Terms of Service.

ARTICLE 6 - SECURITY

To protect your personal information, we take reasonable precautions and follow industry best practices to ensure it is not lost, misused, accessed, disclosed, altered, or destroyed inappropriately.

If you provide us with your credit card information, it will be encrypted using Secure Socket Layer (SSL) technology and stored with AES-256 encryption. Although no method of Internet transmission or electronic storage is 100% secure, we follow all PCI-DSS requirements and implement additional generally accepted industry standards.

COOKIES

Here is a list of cookies that we use. We provide this list to give you the option to choose whether you want to allow them or not.

_session_id: session unique identifier; allows Shopify to store information about your session (referrer, landing page, etc.).

_shopify_visit: no data retained; persists for 30 minutes since the last visit. Used by the internal statistics tracking system of our website provider to record the number of visits.

_shopify_uniq: no data retained; expires at midnight (depending on the visitor's location) the next day. Calculates the number of visits to a store per single customer.

cart: unique identifier; persists for 2 weeks, stores information about your shopping cart.

_secure_session_id: unique session identifier.

storefront_digest: unique identifier; undefined if the shop has a password. It is used to determine if the current visitor has access.

ARTICLE 7 - AGE OF CONSENT

By using this site, you represent that you are at least the age of majority in your state or province of residence, and that you have given us your consent to allow any dependent minor to use this website.

ARTICLE 8 - AMENDMENTS TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon posting on the website. If we make material changes to this policy, we will notify you here that it has been updated, so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it.

If our store is acquired or merged with another company, your information may be transferred to the new owners so that we may continue to sell products to you.

ARTICLE 9 — DATA CONTROLLER

The data controller responsible for processing your personal data is:

Veltry Ecom Sàrl

c/o FIDUloc Sàrl, Route de Gouillon 14, 1898 St-Gingolph, Switzerland

Company number: CHE-433.850.935

Email: contact@dermalea.com

EU Representative (Art. 27 GDPR): Basil Herbaut, 255 chemin de bovet, 73800, France

ARTICLE 10 — LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases

Purpose	Legal basis
Processing and delivering your order	Performance of a contract (Art. 6(1)(b) GDPR)
Payment processing and fraud prevention	Contract performance / legitimate interest (Art. 6(1)(b), (f))
Email and SMS marketing	Your consent (Art. 6(1)(a) GDPR)
Analytics and advertising cookies	Your consent (Art. 6(1)(a) GDPR)
Responding to customer service requests	Contract performance / legitimate interest
Compliance with legal and accounting obligations	Legal obligation (Art. 6(1)(c) GDPR)

 

Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

ARTICLE 11 — RETENTION PERIODS

We retain your personal data only for as long as necessary:

• Order and transaction data: 10 years, in accordance with statutory accounting retention obligations

• Customer account data: for the duration of the account, then deleted [X months] after closure

• Marketing data (email/SMS): until you withdraw your consent or unsubscribe, then deleted within 12 months

• Cookie and analytics data: as stated in our cookie section, maximum 12 months

• Customer service correspondence: 3 years from the last contact

Once these periods expire, your data is deleted or irreversibly anonymised.

ARTICLE 12 — YOUR RIGHTS

Under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP/nLPD), you have the following rights:

• Right of access (Art. 15 GDPR) — obtain confirmation of whether we process your data and receive a copy

• Right to rectification (Art. 16) — correct inaccurate or incomplete data

• Right to erasure (Art. 17) — request deletion of your data

• Right to restriction of processing (Art. 18)

• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format

• Right to object (Art. 21) — object to processing based on legitimate interest, including profiling

• Right to withdraw consent at any time

• Right not to be subject to automated decision-making (Art. 22)

To exercise any of these rights, contact us at contact@dermalea.com. We will respond within one month. We may ask you to verify your identity before acting on your request.

Exercising these rights is free of charge.

ARTICLE 13 — RIGHT TO LODGE A COMPLAINT

If you believe our processing of your data infringes applicable law, you have the right to lodge a complaint with a supervisory authority.

In Germany: the data protection authority of your federal state (Landesdatenschutzbehörde). A full list is available at bfdi.bund.de

In other EU/EEA countries: the supervisory authority of your country of residence, place of work, or the place of the alleged infringement

In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern — edoeb.admin.ch

ARTICLE 14 — RECIPIENTS AND PROCESSORS

We share your personal data only with the following categories of recipients, each bound by a data processing agreement:

• Shopify Inc. — e-commerce platform and hosting

• Payment providers — Stripe, PayPal

• Klaviyo

We do not sell your personal data.

ARTICLE 15 — INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to and processed in countries outside the European Economic Area and Switzerland, including Canada and the United States.

Switzerland and Canada benefit from adequacy decisions of the European Commission. For transfers to other third countries, we rely on appropriate safeguards, in particular the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures.

You may request a copy of these safeguards by contacting contact@dermalea.com

 

ARTICLE 16 — COOKIES AND CONSENT

We use cookies and similar technologies. These fall into the following categories:

• Strictly necessary cookies — required for the site to function (cart, session, security). These do not require consent.

• Analytics cookies — help us understand how the site is used.

• Marketing and advertising cookies — including the Meta (Facebook) Pixel and Google, used to measure and target advertising.

Analytics and marketing cookies are only set with your prior consent, in accordance with Art. 6(1)(a) GDPR and § 25 TDDDG (Germany). You can give, refuse, or withdraw your consent at any time via the cookie banner or the cookie settings link in the footer of our website.

Refusing non-essential cookies does not affect your ability to use the site or place an order.

 

QUESTIONS AND CONTACT

If you would like to access, correct, modify, or delete any personal information we have about you, file a complaint, or simply want more information, please contact our privacy officer at contact@dermalea.com

TEXT MARKETING TERMS AND CONDITIONS

We utilize a text messaging platform that is subject to the following terms and conditions. By providing your phone number at checkout and initiating a purchase, subscribing via our subscription form or a keyword, you agree that we may send you SMS notifications (for your order, including abandoned cart reminders) and SMS marketing offers. Your phone number, name, and purchase information will be shared with our SMS platform, "SMSBump Inc," a European Union company headquartered in Sofia, Bulgaria, EU. This data will be used to send you targeted marketing messages and notifications. To unsubscribe from receiving marketing messages and notifications via SMS, reply with STOP to any mobile message sent by us or use the unsubscribe link provided in our messages. Please note that using alternative words or requests for unsubscribing will not be considered a reasonable method of unsubscribing. Message and data rates may apply. For more information, please refer to our Privacy Policy and Terms of Service. If you have any questions, please text "HELP" to the number that sent you the messages, or contact us for further assistance. If you wish to unsubscribe, please follow the provided procedures above.