Privacy policy
At SKINOREA, our customers' trust matters as much as the quality of our skincare. This policy explains simply what data we collect, why we use it, who we share it with, how long we keep it and how to exercise your rights. It applies to the skinorea.com website, your orders, your account, the Glow Club, the skin quiz and our exchanges with you.
1. Who is responsible for your data?
The data controller is SKINOREA, a French simplified joint-stock company (SAS) whose registered office is at 61 rue de Lyon, 75012 Paris, France, registered with the Paris Trade and Companies Register under number 987 821 840.
For any question about your data: hello@skinorea.com or our contact form.
2. What data do we collect?
- Identity and contact details: last name, first name, email address, phone number, shipping and billing addresses.
- Orders: products purchased, amounts, discount codes used, purchase history, deliveries, returns, complaints and exchanges with our customer service.
- Payment: payment is processed directly by Shopify Payments or PayPal. SKINOREA never has access to your full card number. We only receive partial information (card type, last 4 digits, payment status, results of fraud checks).
- Customer account and Glow Club: login details, points, rewards, referrals and your birthday if you provide it.
- Skin quiz: first name, email, age, skin type and skin concerns. This information is only used to recommend cosmetic products; it is not a medical diagnosis. Do not send us any medical information.
- Customer reviews: rating, comment, photos and first name you choose to publish.
- Chat and messages: content of your exchanges with our customer service, including the AI-assisted chat.
- Browsing: IP address, device and browser type, pages viewed, searches and interactions with the site, collected through cookies (see section 8).
3. Why do we use your data?
| Purpose | Legal basis |
|---|---|
| Managing your orders, payments, deliveries, returns and customer service requests | Performance of the contract |
| Issuing invoices and meeting our accounting and tax obligations | Legal obligation |
| Checking orders, preventing fraud, securing the site and fighting abuse (chargebacks, abusive returns, multiple accounts, fake referrals, resale, bypassing purchase limits) | Legitimate interest |
| Keeping evidence and handling complaints, payment disputes and litigation | Legitimate interest |
| Managing your customer account, the Glow Club and referrals | Performance of the contract |
| Recommending a suitable routine after the skin quiz | Performance of the service you request |
| Emailing you offers on products similar to those you have purchased | Legitimate interest (article L.34-5 of the French Post and Electronic Communications Code) |
| Sending you the newsletter and our offers if you are not a customer | Consent |
| Inviting you to leave a review after a purchase | Legitimate interest |
| Answering your messages, including through the AI-assisted chat | Legitimate interest |
| Measuring audience and improving the site | Consent (cookies) |
| Producing internal statistics and improving our offer | Legitimate interest |
You can unsubscribe from our marketing emails at any time using the link in each email.
4. Who do we share your data with?
Your data is accessible to the SKINOREA team only to the extent they need it. It is also sent to our service providers, which process it on our behalf:
| Provider | Role |
|---|---|
| Shopify | Store hosting, payments (Shopify Payments), emails (Shopify Messaging), AI-assisted chat (Shopify Inbox), forms |
| PayPal | Payment and payment in instalments |
| Bigblue | Storage, preparation and shipping of orders |
| Carriers (La Poste, Colissimo, Mondial Relay, Chronopost, Paack…) | Delivery and parcel tracking |
| BON Loyalty | Glow Club loyalty program and referrals |
| Judge.me and Trustpilot | Collecting and publishing customer reviews |
| Pandectes | Cookie consent management |
| Google (Tag Manager, Analytics) | Audience measurement |
| Dougs | Accounting |
Where necessary, we may also disclose your data to administrative or judicial authorities, to our advisers (lawyers, bailiffs), to banks and payment providers in connection with a payment dispute, or to a buyer in the event of the sale of all or part of our business.
We never sell your data.
5. AI-assisted chat
The chat on our site uses Shopify Inbox. When you use it, Shopify processes the content of your exchanges to generate responses on our behalf and to improve the quality of its AI agent. More information: Shopify's privacy policy. If you'd prefer not to use it, email us at hello@skinorea.com.
6. Is your data transferred outside the European Union?
We only deliver within Europe and the French overseas territories, but some of our service providers (in particular Shopify, PayPal and Google) may process data in Canada or the United States. These transfers are covered by the safeguards provided by the GDPR: an adequacy decision of the European Commission (Canada, Data Privacy Framework for certified US companies) or standard contractual clauses.
7. How long do we keep your data?
| Data | Retention period |
|---|---|
| Orders, proof of transactions and related exchanges | 5 years from the order |
| Invoices and accounting records | 10 years from the end of the financial year |
| Customer account | Until it is deleted, or 3 years after your last activity |
| Marketing (customers) | 3 years after your last purchase |
| Marketing (non-customers, skin quiz) | 3 years after your last contact |
| Unsubscribes from marketing emails | 3 years, to ensure your choice is respected |
| Messages and chat with customer service | 3 years after the last exchange |
| Data related to a complaint, payment dispute or litigation | Until the end of the proceedings and the expiry of appeal periods |
| List of persons excluded for fraud or abuse | 3 years after the last entry |
| Customer reviews | As long as they are published |
| Cookies | 13 months maximum; your choice is kept for 6 months |
When these periods expire, the data is deleted or anonymised. Some data may be securely archived where required by law.
8. Cookies
On your first visit, a banner lets you accept or refuse non-essential cookies. Cookies required for the site to work (cart, login, payment, security, remembering your choice) do not require your consent. Audience measurement cookies are only set with your agreement. You can change your choice at any time from the site's cookie management tool, or block cookies in your browser settings. Some features may then no longer work properly.
9. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- Access to your data and to obtain a copy;
- Rectification of inaccurate data;
- Erasure of your data;
- Restriction of processing;
- Portability of the data you have provided to us;
- Objection to processing based on our legitimate interest, and at any time to marketing;
- Withdrawal of your consent at any time, without affecting processing already carried out;
- Instructions on what happens to your data after your death.
How to exercise them? Email hello@skinorea.com with the subject "Personal data", from the email address linked to your account or orders. If we have reasonable doubts about your identity, we may ask you for proof. We reply within 1 month, which may be extended by 2 months depending on the complexity or number of requests.
Limits provided by law: we may refuse a request that is manifestly unfounded or excessive, in particular because of its repetitive nature. Erasure does not apply to data we must keep to comply with a legal obligation (invoicing, accounting) or to establish, exercise or defend our legal rights. Objection may be refused where we have compelling legitimate grounds, in particular for fraud prevention.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.
10. Automated decisions
We do not make any decision producing legal effects concerning you based solely on automated processing. The fraud tools of our payment providers assign a risk level to some orders, which may be put on hold pending a check by our team.
11. Security
We and our service providers apply appropriate technical and organisational measures to protect your data (secure payment, HTTPS encryption, restricted access). As no system is infallible, we cannot guarantee absolute security. In the event of a data breach, we act in accordance with our legal obligations. Keep your password confidential.
12. Minors
The site is reserved for adults. We do not knowingly collect data relating to minors.
13. Social networks and third-party sites
The site may display content from, or links to, third-party services (Instagram, TikTok, Facebook, Pinterest, PayPal…). These services apply their own privacy policies, over which we have no control.
14. Changes
We may change this policy at any time, in particular to reflect changes in the law or in our services. The applicable version is the one online at the time of your visit.
Last updated: 20/10/2026