Privacy policy

Last updated: 24 September 2026

Website: https://cosmedicshop.co.uk

CosmedicShop.co.uk ("CosmedicShop", "we", "us" or "our") respects your privacy. This Privacy Policy explains how we collect, use, share and protect personal data when you browse our website, place an order, create an account, contact us or otherwise use our services.

We process personal data in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.

1. Who we are and how to contact us

The controller responsible for personal data collected through this website is [INSERT FULL LEGAL COMPANY NAME], trading as CosmedicShop, of [INSERT REGISTERED OR BUSINESS POSTAL ADDRESS].

For privacy enquiries or to exercise your rights, contact [INSERT PRIVACY CONTACT EMAIL]. Our general customer service contact is [INSERT CUSTOMER SERVICE EMAIL, IF DIFFERENT].

Before publishing: complete these contact details and, where applicable, identify your appointed data protection officer or UK representative. Do not publish the bracketed placeholders.

2. Personal data we collect

Depending on how you use our website, we may collect:

·       Identity and contact data: name, billing and delivery addresses, email address and telephone number.

·       Order and transaction data: products purchased, order history, delivery instructions, returns, refunds, payment status and transaction references. Payments are processed by payment providers; we do not ordinarily receive or store full payment card details.

·       Account data: account identifiers, login and authentication information, preferences and account activity, where an account is created.

·       Communications: messages, enquiries, complaints, reviews and information you choose to provide to customer support.

·       Technical and usage data: IP address, device and browser details, approximate location derived from IP address, website interactions, referral sources and cookie or similar identifiers, subject to your preferences and applicable law.

·       Marketing preferences: newsletter subscriptions, consent records and opt-out requests.

We generally collect data directly from you, automatically through our website where permitted, and from service providers such as Shopify, payment processors and delivery partners when necessary to provide our services. We may also receive information from advertising or analytics providers where their use is lawful and applicable to our website.

Please do not send sensitive personal data unless we specifically request it for a legitimate reason.

3. Why we use your data and our lawful bases

We only process personal data when we have an applicable lawful basis under the UK GDPR.

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and freedoms. You can contact us for information about the relevant assessment. We will not use consent as a basis unless we can demonstrate valid consent, and you can withdraw consent at any time without affecting earlier lawful processing.

4. Cookies and similar technologies

Our website uses cookies and similar technologies for functions such as keeping your shopping basket working, remembering preferences, measuring website performance and, where enabled, advertising.

Strictly necessary cookies support essential website functions and generally do not require consent under PECR. Non-essential cookies and similar technologies, including advertising cookies and analytics technologies where consent is legally required, will not be set or accessed until you have provided valid consent. We will offer a way to reject non-essential cookies and to change or withdraw your choices later.

Certain storage and access technologies may qualify for a specific statutory exemption; where an exemption applies, we will use it only within its legal conditions. Blocking cookies through your browser may affect some website features.

For details of the actual cookies, providers, purposes and durations used on our website, see [INSERT LINK TO SITE-SPECIFIC COOKIE POLICY OR COOKIE SETTINGS]. Shopify's general cookie information is available at https://www.shopify.com/legal/cookies, but it is not a substitute for a list of cookies actually used on this website.

5. Marketing communications

We may send promotional emails or text messages if you have consented or, for our own similar products or services, where all requirements of the PECR existing-customer soft opt-in are satisfied. This includes giving you a clear opportunity to opt out when your contact details are collected and in every subsequent marketing message. We do not treat making a purchase alone as blanket consent to all marketing.

You can unsubscribe through the link or instructions in our marketing messages or contact us using the details above. We may still send essential service messages about your orders, deliveries, returns and account.

If we use marketing or email-tracking pixels, we will comply with the applicable rules for those technologies.

6. Who we share personal data with

We may disclose personal data where necessary to:

·       Shopify and website technology providers, to host and operate our online store and related services;

·       Payment processors and fraud-prevention providers, to process transactions and protect against fraud;

·       Delivery, fulfilment and returns partners, to deliver orders and handle returns;

·       Customer service, IT, security, analytics and marketing providers, to provide services on our behalf, subject to appropriate agreements and applicable consent requirements;

·       Professional advisers, regulators, law enforcement or courts, where legally required or necessary to protect lawful rights; and

·       A purchaser or successor, in connection with a genuine business sale or reorganisation, subject to applicable law.

Some service providers act as processors on our instructions; others act as independent controllers and provide their own privacy notices. We do not disclose personal data to advertising partners unless there is an appropriate lawful basis and any necessary cookie consent. [VERIFY AND INSERT ANY MATERIAL THIRD-PARTY PROVIDERS OR DATA SHARING ARRANGEMENTS NOT COVERED ABOVE.]

7. International transfers

Our website and service providers may process personal data outside the United Kingdom. Where UK personal data is transferred to a country without applicable UK adequacy regulations, we will use a lawful transfer mechanism where required, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any necessary transfer risk assessment and supplementary safeguards. Other lawful exceptions will be used only where their conditions are met.

You can request further information about applicable safeguards using the contact details above. [VERIFY ACTUAL COUNTRIES, PROVIDERS AND TRANSFER MECHANISMS BEFORE PUBLICATION.]

8. How long we retain data

We retain personal data only as long as reasonably necessary for the purposes described here, including order fulfilment, customer support, fraud prevention, legal claims and applicable tax and accounting obligations. Relevant financial and business records may need to be kept for statutory periods, depending on the record and the legal obligation involved.

Account information is normally retained while your account is active and for a justified period afterwards. Marketing data is retained until you unsubscribe or withdraw consent, subject to keeping a minimal suppression record to honour your request. Cookie durations depend on the particular technology and are described in our cookie information. We securely delete or anonymise data when it is no longer required.

[INSERT YOUR ACTUAL RETENTION PERIODS OR PRECISE CRITERIA FOR EACH MATERIAL DATA CATEGORY AFTER CHECKING YOUR OPERATIONS AND LEGAL OBLIGATIONS.]

9. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. Access is restricted according to business need, and relevant providers are expected to apply suitable safeguards. No online transmission or storage system can be guaranteed completely secure. Please contact us promptly if you believe your account or information has been compromised.

10. Your UK data protection rights

Subject to the conditions and exemptions in UK law, you may have the right to:

·       Access personal data we hold about you and obtain a copy;

·       Rectification of inaccurate data and completion of incomplete data;

·       Erasure of data in applicable circumstances;

·       Restriction of certain processing;

·       Data portability where the statutory conditions apply;

·       Object to processing based on legitimate interests in applicable circumstances; and

·       Withdraw consent at any time where processing is based on consent.

You have an absolute right to object to processing of your personal data for direct marketing, including related profiling. If you object, we will stop that processing.

You also have rights relating to qualifying solely automated decisions that produce legal or similarly significant effects. [IF SUCH DECISIONS ARE USED, DESCRIBE THEIR LOGIC, SIGNIFICANCE, CONSEQUENCES AND APPLICABLE SAFEGUARDS.]

To exercise your rights, contact [INSERT PRIVACY CONTACT EMAIL]. We may ask for reasonable information to verify your identity. We normally respond without undue delay and within one month, subject to any lawful extension or exception. Exercising your rights is normally free of charge.

11. Children's privacy

Our website is intended for general retail customers and is not directed at children. We do not knowingly collect children's personal data for marketing without any consent or other safeguards required by law. If you believe a child has provided us with personal data inappropriately, please contact us so that we can review the matter.

12. Third-party websites

Our website may contain links to third-party websites, payment services or social platforms. Their privacy practices are governed by their own notices. We encourage you to review those notices before providing personal data to third parties.

13. Complaints

If you have concerns about how we use your personal data, please contact us first at [INSERT PRIVACY CONTACT EMAIL] so we can investigate and respond.

You also have the right to complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ . You do not have to contact us before raising a concern with the ICO.

14. Changes to this policy

We may update this policy to reflect changes in our services, data practices or legal requirements. We will publish the revised version on this page, update the date above and provide additional notice where required by law.

 

Internal publication checklist — remove before publishing

1.          Insert the verified legal entity, business postal address and working privacy email address.

2.          Audit installed Shopify apps, payment services, advertising pixels, analytics, customer service tools and fulfilment partners; align all disclosures with actual data flows.

3.          Implement and test a compliant cookie banner and persistent preference control; document the actual cookie list, purposes, providers and durations.

4.          Verify marketing consent capture and, if used, every requirement of the PECR soft opt-in; ensure every marketing message has an effective opt-out.

5.          Record actual retention periods, overseas processing locations and applicable UK transfer safeguards.

6.          Confirm whether any significant solely automated decisions, children's services, special-category data or other unusual processing occurs, and expand the policy if needed.

7.          Obtain a final review against the company's actual operations before publishing. This template does not itself establish legal compliance.

Regulatory references: UK ICO privacy information guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/ ; ICO electronic marketing guidance: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/ ; ICO storage and access technologies guidance: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/