[[ LEGAL REVIEW REQUIRED ]] — This page is a template and does not constitute legal advice. It must be reviewed by a qualified lawyer for the United States and the European Union before the store accepts orders. Fields shown as [to be confirmed] must be completed first. [[ TRADEMARK CLEARANCE PENDING ]] The brand name Aminique has not cleared trademark search yet; this material must not be used in public advertising campaigns before launch.
Company entity, registered address, responsible-person details, effective date and version are all pending. Nothing on this page should be relied on as legal advice.
⚠️
[[ LEGAL REVIEW REQUIRED ]]This document is a template only and does not constitute legal advice. It must be reviewed by a qualified lawyer and tailored to your entity, your processors and your markets (GDPR for the EU/EEA, UK GDPR where relevant, and CCPA/CPRA for California). Replace every[to be confirmed]placeholder before publishing. Last updated:[to be confirmed]· Version:[to be confirmed]
Data controller: Aminique / [to be confirmed] Registered address: [to be confirmed] Privacy contact / DPO: [to be confirmed] EU representative (Art. 27 GDPR): [to be confirmed]
1. Introduction
This Privacy Policy explains how Aminique ("we", "us", "our") collects, uses, shares and protects personal data when you visit [to be confirmed], create an account, place an order, subscribe to marketing, or contact us.
We are the data controller for the personal data described here. Where we use processors (for example, payment, hosting or email providers), they act on our instructions under written agreements.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & contact | name, email address, phone number, billing and shipping address | you |
| Order & transaction | products purchased, order value, order number, payment status (not full card details) | you / payment provider |
| Account | login details, order history, subscription settings | you |
| Communications | emails, chat and customer-service messages, adverse-reaction reports | you |
| Marketing preferences | newsletter consent, discount-code usage | you |
| Technical & usage | IP address, device and browser type, pages viewed, referring URL | automatic (cookies) |
| Cookies & similar | see our Cookie Policy [to be confirmed] |
automatic |
We do not intentionally collect special-category data (such as health data). If you send us an adverse-reaction report, we may record limited information about the reaction so we can meet our cosmetic safety and legal obligations — see section 8.
3. How and why we use your data (purposes and legal bases)
Under the GDPR we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Create and manage your account; process and deliver orders; take payment | Performance of a contract (Art. 6(1)(b)) |
| Provide customer service; handle returns, refunds and adverse-reaction reports | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Comply with tax, accounting, consumer-protection and cosmetic-safety obligations | Legal obligation (Art. 6(1)(c)) |
| Send marketing emails about products and offers | Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f)) where permitted |
| Improve the Site, prevent fraud, and keep it secure | Legitimate interests (Art. 6(1)(f)) |
| Place analytics and marketing cookies | Consent (Art. 6(1)(a)) where required |
Where we rely on legitimate interests, we have balanced those interests against your rights. You may object at any time (see section 9).
4. Cookies and tracking
We use cookies and similar technologies for essential site functions, analytics and — with consent — marketing. See our Cookie Policy at [to be confirmed] for the categories we use, how to manage them, and how to withdraw consent. We honour Global Privacy Control (GPC) signals where required.
5. Sharing your data
We share personal data only as needed, with:
- Payment processors:
[to be confirmed] - Hosting and platform:
[to be confirmed] - Shipping and fulfilment partners:
[to be confirmed] - Email, analytics and marketing providers:
[to be confirmed] - Professional advisers (legal, accounting, compliance), under confidentiality
- Authorities, where required by law (including cosmetic adverse-event reporting)
We require processors to protect data and to act only on our instructions. We do not sell your personal data. [to be confirmed]
6. International data transfers
We may transfer personal data outside the EU/EEA (for example, to suppliers or service providers in [to be confirmed]). Where we do, we rely on:
- an adequacy decision of the European Commission, or
- Standard Contractual Clauses approved by the European Commission, plus a transfer risk assessment.
[to be confirmed]
7. Data retention
We keep personal data only as long as necessary for the purposes described:
| Data | Retention |
|---|---|
| Order and transaction records | [to be confirmed] |
| Account data | While your account is active, then [to be confirmed] |
| Marketing consent records | Until you withdraw consent, plus [to be confirmed] |
| Adverse-reaction records | [to be confirmed] |
| Customer-service messages | [to be confirmed] |
| Cookie data | See the Cookie Policy |
8. Cosmetic safety and adverse-reaction data
If you report an adverse reaction, we may record your contact details, the product and batch number, and a description of the symptoms so that we can:
- investigate the report with our supplier;
- meet our legal obligations under the US MoCRA framework and EU Regulation (EC) No 1223/2009; and
- report serious adverse events to the relevant authority within the required timeframe.
We handle this information with extra care, restrict access to those who need it, and do not use it for marketing. [to be confirmed]
9. Your rights (EU/EEA and UK) [[ PHASE 2 — EU ]]
You have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase data in certain circumstances;
- restrict or object to processing (including direct marketing);
- data portability;
- withdraw consent at any time, without affecting prior processing;
- lodge a complaint with your local supervisory authority.
To exercise a right, email [to be confirmed]. We respond within one month, extendable by two months for complex requests. We may ask you to verify your identity.
10. Your rights (California — CCPA/CPRA)
If you are a California resident, you have the right to:
- know the categories and specific pieces of personal information we collect, use, disclose or "share";
- delete personal information we hold, subject to exceptions;
- correct inaccurate personal information;
- opt out of the "sale" or "sharing" of personal information (including cross-context behavioural advertising);
- limit the use of sensitive personal information;
- non-discrimination for exercising your rights (we will not deny service or charge a different price for exercising them).
We do not sell personal information. [to be confirmed]
How to exercise: email [to be confirmed] or use the "Do Not Sell or Share My Personal Information" link at [to be confirmed]. We honour Global Privacy Control (GPC) browser signals as a valid opt-out of sharing. An authorised agent may submit a request with proof of authorisation.
Categories collected and disclosed in the last 12 months: identifiers; commercial information; internet activity; geolocation (approximate); inferences. Purposes and third parties are as described in sections 2, 3 and 5.
11. Marketing and consent
You can subscribe to marketing emails when you create an account or at checkout. You can unsubscribe at any time using the link in every email or by contacting us. We send transactional messages (order and shipping confirmations) regardless of marketing consent. [to be confirmed]
12. Security
We use appropriate technical and organisational measures, including encryption in transit, access controls and least-privilege access. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach where required.
13. Children's privacy
The Site is not directed to children. We do not knowingly collect data from children below the age of digital consent in your market. If you believe a child has provided data, contact us and we will delete it.
14. Changes to this policy
We may update this Privacy Policy. The current version is always published on the Site, with the effective date shown. Material changes will be notified where required.
15. Contact and complaints
Controller: Aminique / [to be confirmed] Address: [to be confirmed] Email: [to be confirmed] EU representative: [to be confirmed] Supervisory authority: [to be confirmed]
⚠️
[[ LEGAL REVIEW REQUIRED ]]Placeholders outstanding: company name/address, DPO and EU representative, processor list, transfer mechanism, retention periods, IOSS/tax details, CPRA opt-out link, supervisory authority, effective date.