Privacy policy

privacy policy — Derm A+

this privacy policy describes how Derm A+ collects, uses, discloses, and protects your personal data when you visit our website, utilize our services, or purchase products from us. we operate under a strict commitment to data minimization, security, and absolute compliance with global data protection standards, including the eu general data protection regulation (gdpr), the uk gdpr, the california consumer privacy act (ccpa/cpra), and the canadian personal information protection and electronic documents act (pipeda).

1. data controller identification

the data controller responsible for the processing of your personal data through this platform is:

Derm A+ warsaw, poland contact email: info@dermaplusco.com digital contact portal: www.dermaplusco.com/pages/contact-us

2. categories of personal data we collect

we process only the necessary technical and personal information required to execute transactions, maintain platform security, and deliver customer support.

2.1. identity and contact data: including your first name, last name, shipping address, billing address, email address, and telephone number. 2.2. transactional data: details regarding payments processed, products purchased, order history, and full financial telemetry related to fulfillment. we do not store raw credit card numbers on our servers; all payments are securely routed through certified, pci-dss compliant third-party payment processors. 2.3. technical and analytical data:internet protocol (ip) addresses, browser type and version, time zone configurations, operating system platforms, and diagnostic logs regarding how you interact with our storefront. 2.4. communication data: any information you voluntarily submit when filling out our contact us form, initiating a return request, or communicating with our customer care channels.

3. legal bases and purposes for data processing

we process personal data strictly under valid legal frameworks as defined by international laws:

3.1. performance of a contract: to process, package, ship, and track your orders (including led masks, cosmetics, and medicube hardware), verify billing information, and handle open-box returns or warranty service. 3.2. legal obligation: to comply with fiscal, tax, customs, and accounting regulations across the european union, united states, canada, and the united kingdom (e.g., maintaining transaction ledgers and generating export/import documentation). 3.3. legitimate interests: to optimize our technical systems, prevent fraudulent transactions, manage corporate security, and ensure our digital infrastructure remains stable and fully functional. 3.4. consent: where you explicitly opt-in to receive electronic marketing communications or allow the use of advanced analytical cookies. you possess the absolute right to revoke this consent at any time.

4. data sharing and international transfers

4.1. logistical and operational sharing: we share relevant portions of your data with trusted service providers to execute your orders. this includes courier networks, technical fulfillment hubs, international customs brokerage entities, and enterprise cloud infrastructure systems. 4.2. no data monetization: Derm A+ does not sell, lease, or trade your personal data to external third-party marketing networks under any circumstances. 4.3. cross-border transfers: because we fulfill orders globally (such as worldwide shipping for Derm A+ led masks), data may be transferred to and processed in countries outside your domestic jurisdiction. we implement strict legal safeguards, including standard contractual clauses (sccs), to guarantee an equivalent level of data protection wherever your information travels.

5. data retention principles

5.1. your personal data is retained only for the duration strictly necessary to fulfill the purposes outlined in this policy, execute contractual obligations, or comply with statutory retention windows mandated by polish and european financial laws (typically 5 to 7 years for tax and accounting records). 5.2. diagnostic and technical log data is automatically scrubbed or anonymized after short-term automated cycles, unless suspicious activity requires prolonged technical investigation.

6. consumer rights and data control

regardless of your geographical location, Derm A+ extends premium data privacy controls to all users. depending on your residency (including the eu, uk, usa, and canada), you possess the following actionable rights:

6.1. right of access and portability: you have the right to request a digital copy of all personal data we hold about you. 6.2. right to rectification: you may demand the immediate correction of inaccurate or incomplete address, identity, or contact details. 6.3. right to erasure ("right to be forgotten"): you may request the deletion of your personal data, provided it is no longer required for active fulfillment, ongoing fraud prevention, or legal tax compliance. 6.4. right to object and restrict processing: you can halt the processing of your data for specific analytical purposes or withdraw your consent entirely. 6.5. how to exercise your rights: to submit a formal data request, please utilize our contact us form or reach out directly to info@dermaplusco.com. we process all verification and data execution requests free of charge within the legal 30-day window.

7. cookie policy and tracking metrics

7.1. our platform utilizes functional cookies and web identifiers to maintain basic shopping cart memory, secure user sessions, and analyze broad traffic patterns. 7.2. users can fully configure, restrict, or disable cookies directly through their native browser settings. restricting technical cookies may affect your ability to add items to your cart or complete checkout securely.

8. updates to this policy

8.1. Derm A+ reserves the right to amend this privacy policy periodically to reflect operational changes, internal logistical updates, or shifting global legal requirements. 8.2. the updated version will be marked with a new "last updated" date at the top of the publication and will take effect immediately upon being posted on our digital channels.