Privacy policy

Last updated: 1 October 2026. This policy explains how your personal data is processed when you use innerskin.com and its online services (account, orders, contact forms, newsletter) for purchases in the United Kingdom. Health data processed in connection with clinic treatments is handled by IS UK Operations Ltd under its separate Clinic Privacy Policy (link here).

1. Controller and representative. The controller for e-commerce, website and marketing processing is Héritance. As the controller is not established in the United Kingdom, a representative under Article 27 of the UK GDPR will be appointed and identified here. Processing is carried out in accordance with the UK GDPR and the Data Protection Act 2018.

2. Data we collect. Identification data (name), contact details (email, telephone, delivery and billing address), order and payment data, navigation data (cookies and analytics) and marketing preferences, with your consent.

3. Purposes and legal bases. Managing orders, deliveries, returns and customer service (performance of a contract); billing and accounting (legal obligation); marketing communications and newsletter (consent, which you may withdraw at any time); website improvement and analytics cookies (consent, via the cookie banner); fraud prevention and security (legitimate interests).

4. Recipients and processors. Your data is accessible to authorised staff and to technical service providers acting as processors, bound by contract to protect it. These recipients fall within the following categories: hosting and e-commerce, payment providers, customer relationship management and emailing, customer service, telephony, analytics, and logistics and carriers. A detailed and current list of processors is available on request.

5. International transfers. Some processors may process data outside the United Kingdom or the European Economic Area. Such transfers are protected by appropriate safeguards, including standard contractual clauses or an adequacy decision, in accordance with the UK GDPR.

6. Call recording. Calls with customer service may be recorded to monitor and improve service quality and for training, on the basis of our legitimate interests. You are informed at the start of the call.

7. Retention. Contact data is kept for a period proportionate to the relationship; order and billing data are kept in accordance with legal obligations; marketing data is kept until you withdraw consent. Cookies have a limited lifetime, proportionate to their purpose; details are in the cookie management module.

8. Cookies. On your first visit, a banner lets you accept, refuse or set cookies (strictly necessary, analytics, marketing and social media). You can change your choices at any time.

9. Your rights. Under the UK GDPR you have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time. To exercise them, write to hello-uk@innerskin.com. You may also complain to the Information Commissioner's Office (ICO, www.ico.org.uk).

10. Security. We implement appropriate technical and organisational measures to protect your data.

11. Changes. This policy may be updated to reflect legal or technical changes; the date above indicates the latest version.