Privacy Policy

Effective date: 1 July 2026

1. Information on the collection of personal data and contact details of the controller

1.1 We are glad you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data means all data by which you can be personally identified.

1.2 The controller responsible for data processing on this website is Dermaform, contactable at info@dermaform.com. The controller is the natural or legal person who alone or jointly decides on the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (such as orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the padlock symbol in your browser bar.

2. Data collection when you visit our website

When you use our website for information only, that is, when you do not register or otherwise provide us with information, we collect only the data your browser transmits to our server (server log files). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• the website visited
• date and time of access
• amount of data sent, in bytes
• the source or referrer from which you reached the page
• the browser used
• the operating system used
• your IP address (where applicable, in anonymised form)

This processing is carried out on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. We reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

3. Your skin quiz answers and photos

To provide a personalised routine, we collect information you choose to share about your skin, such as your skin type, concerns, and triggers, along with the photos you upload during the quiz or as progress photos.

• We use this information only to match and adjust your routine, to give you guidance, and to support your order. Your photos are reviewed to help select and fine-tune the right routine for you.
• We do not use any automated facial recognition or biometric analysis on your photos, and we do not create or store biometric data such as facial geometry.
• Because information about your skin and the photos you share are more sensitive than ordinary contact details, we ask for your explicit consent before collecting them, and you can withdraw that consent at any time by contacting info@dermaform.com.
• We will never use your photos in marketing, testimonials, or before-and-after content unless you give us separate, specific, opt-in permission. You can withdraw that permission at any time.
• We keep your skin data and photos only as long as needed to provide the service, then delete them.

4. Cookies

To make visiting our website attractive and to enable certain functions, we use cookies on various pages. Cookies are small text files stored on your device. Some cookies we use are deleted at the end of your browser session (session cookies). Others remain on your device and allow us or our partner companies to recognise your browser on your next visit (persistent cookies). Persistent cookies are deleted automatically after a set period that can differ per cookie.

Some cookies simplify the ordering process by storing your settings, for example remembering the contents of a shopping cart for a later visit. Where individual cookies also process personal data, this is done either to perform the contract or to protect our legitimate interests in the best possible functionality of the website and a customer-friendly, effective visit.

You can set your browser to inform you when cookies are set and to decide individually whether to accept them, or to exclude cookies in certain cases or generally. Please note that not accepting cookies may limit the functionality of our website.

5. Contacting us

When you contact us (for example by contact form or email), personal data is collected. The data collected in a contact form is shown in that form. This data is stored and used solely to answer your request and for the related technical administration. Your data is deleted once your request has been dealt with conclusively, unless statutory retention obligations apply.

6. Customer account and order processing

Personal data is collected and processed when you provide it to us to perform a contract or to open a customer account. Which data is collected is shown in the relevant input forms. You can delete your customer account at any time by sending a message to the contact address above. We store and use the data you provide to process the contract. After the contract has been fully performed or your account deleted, your data is restricted in line with tax and commercial retention periods and deleted after those periods expire, unless you have expressly consented to further use.

7. Direct marketing

7.1 Email newsletter

If you sign up for our email newsletter, we regularly send you information about our offers. The only required field for the newsletter is your email address. Any further information is voluntary and used to address you personally. We use the double opt-in procedure for the newsletter: we will only send it once you have expressly confirmed that you consent, by clicking a confirmation link we email you. At sign-up we store your IP address and the date and time, to trace any possible misuse of your email address. You can unsubscribe at any time using the link in the newsletter or by messaging the contact address above.

7.2 Newsletter to existing customers

If you provided your email address when purchasing, we reserve the right to send you regular email offers for goods or services similar to those you already bought. You can object to this at any time with effect for the future by messaging the contact address above. You will incur only basic transmission costs. After we receive your objection, we will stop using your email address for this purpose.

8. Order processing and payment providers

8.1 The personal data we collect is passed to the transport company commissioned with delivery, where this is necessary to deliver your goods. We pass your payment data to the commissioned credit institution where necessary for payment processing.

8.2 Payment providers:

• PayPal: when you pay via PayPal or payment methods offered through PayPal, we pass your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., Luxembourg, only insofar as necessary for payment processing. PayPal may carry out a credit check for certain methods. Further information is in PayPal's privacy policy.
• SOFORT: if you choose SOFORT, payment is processed via Sofort GmbH, part of the Klarna Group (Klarna Bank AB), to whom we pass the information needed for payment processing. Further information is in SOFORT's privacy policy.

9. Review reminders

We use your email address to send a one-time reminder to review your order for the review system we use, provided you gave your express consent during or after your order. You can withdraw your consent at any time by messaging the controller.

10. Social media plugins

Our website uses social plugins from Facebook, Google, and Instagram. To protect your data, these buttons are not embedded as full plugins but only as HTML links. This means no connection to the servers of these networks is made when you load a page containing such buttons. Only when you click a button does a new browser window open and load the relevant network's page, where you can interact with its plugins (if necessary after entering your login details). For the purpose and scope of data collection by these networks and your related rights and settings, please see their respective privacy notices.

11. Online marketing and analytics

• DoubleClick and Google Ads: this website uses Google's online marketing and conversion tracking. Cookies are used to serve relevant ads, improve campaign reporting, and avoid showing the same ad repeatedly. Google states these cookies contain no personal information. Processing is based on our legitimate interest in the optimal marketing of our website. You can disable ad cookies through your browser settings or the Digital Advertising Alliance.
• Google Analytics: this website uses Google Analytics with the IP anonymisation extension, so your IP address is shortened within the EU or EEA before transmission and cannot be directly linked to you. Google uses this information on our behalf to evaluate your use of the website, compile reports, and provide related services. You can prevent the storage of these cookies through your browser settings or by installing Google's opt-out browser add-on.
• Meta (Facebook) Pixel: with your express consent, we use the Meta Pixel to measure the effectiveness of our Facebook and Instagram ads and to show relevant ads. The data collected is anonymous to us but is stored and processed by Meta, which may link it to your profile and use it for its own advertising purposes in line with Meta's data policy. You can disable third-party cookies through your browser settings or the Digital Advertising Alliance.

Where any of the providers above transfer data outside your region, we rely on appropriate safeguards as required by applicable data protection law.

12. Your rights

Depending on where you live, you have rights over your personal data, which may include the right to access, correct, delete, restrict, or receive a copy of your data, to object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority. To exercise any of these, email info@dermaform.com and we will respond as required by the law that applies to you.

Residents of some US states (including California), and customers in Canada, Australia, and New Zealand, have specific rights under their local privacy laws. Where you have consented to processing, you may withdraw that consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal. Where we process your data for direct marketing, you may object at any time.

13. Data retention

We keep personal data only as long as needed for the purposes above or as required by law (for example commercial and tax retention periods). After those periods expire, the data is routinely deleted, unless it is still needed to perform or initiate a contract, or we have an ongoing legitimate interest in keeping it.

14. Contact

Dermaform Email: info@dermaform.com Website: derma-form.com