PRIVACY POLICY

Neoderma Amsterdam B.V. — neoderma.eu
Effective 30 September 2026. This version replaces the Privacy Policy of 29 May 2018.

1. Who we are

Neoderma Amsterdam B.V., Herengracht 280, 1016 BX Amsterdam, the Netherlands, registered with the Chamber of Commerce under number 69831750 ("Neoderma", "we"), is the controller responsible for the processing of your personal data described in this policy.

For any question or request concerning your personal data, contact us at legal@neoderma.com or by post at the address above. We have not appointed a data protection officer, as we are not required to do so.

2. Scope

This policy applies to personal data we process when you visit neoderma.eu (the "website"), create a customer account, place an order, contact our customer care, join our loyalty programme or receive our marketing communications. It applies to consumers in the Netherlands, Belgium, Luxembourg and Cyprus, the countries served by the website.

3. What data we process

• Identity and contact data: name, e-mail address, telephone number, billing and delivery address.

• Order data: products ordered, order number, price, delivery and return information, invoices, correspondence about the order.

• Payment data: means of payment chosen and payment status. Card and bank details are processed by our payment providers; we do not receive or store full card numbers.

• Account data: login e-mail address, password (encrypted), order history, saved addresses, preferences.

• Customer care data: the content of your e-mails, messages and conversations with our customer care team and with our AI customer-care assistant, and the information you provide in them.

• Marketing data: your subscription status, consent records, and how you interact with our e-mails and text messages (opens, clicks).

• Loyalty programme data: points earned and redeemed, rewards, referral activity.

• Technical and usage data: IP address, device and browser type, language, pages visited, referring website, date and duration of your visit, and the country derived from your IP address to suggest the correct store and language.

• Cookie data: as described in section 9 and in our Cookie Policy.

4. Why we process your data and on what legal basis

Where processing is based on legitimate interest, we have assessed that our interest does not override your rights and freedoms. You may request a copy of that assessment.

Providing identity, contact, delivery and payment data is necessary to conclude and perform the contract; without it we cannot process your order. All other data is provided voluntarily.

5. Who receives your data

We share your data only with the following categories of recipients, and only to the extent necessary for the purposes above.

• E-commerce platform: Shopify International Limited (Dublin, Ireland), which hosts the website, the checkout and our customer database. Shopify may process data on infrastructure in Canada and the United States (see section 6).

• Payment providers: Shopify Payments for card payments, iDEAL, Bancontact, Apple Pay and Google Pay; PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg); Klarna Bank AB (Stockholm, Sweden). When you choose PayPal or Klarna, the data required for payment is transmitted to that provider, which processes it as an independent controller under its own privacy notice. Klarna carries out its own identity and credit assessment.

• Fulfilment and returns: our fulfilment partner in the Netherlands, which stores, packs and dispatches orders and receives returns; and, for returns from Cyprus, Neoderma Global Limited (Nicosia, Cyprus), a company of our group.

• Carriers: postal and courier services, which receive your name, delivery address, telephone number and e-mail address for delivery and delivery notifications.

• Marketing platform: Omnisend (Vilnius, Lithuania), for e-mail and text-message marketing and segmentation.

• Loyalty programme: Smile.io Inc. (Kitchener, Canada), which operates our loyalty programme.

• Customer care: the provider of our AI customer-care assistant, which operates on the Shopify platform and processes your conversations on our behalf.

• Analytics: Google Ireland Limited (Dublin, Ireland), for Google Analytics 4, activated only with your consent. IP addresses are not stored by Google Analytics 4; data is retained for 14 months.

• Advertising: Meta Platforms Ireland Limited (Dublin, Ireland), through the Meta Pixel and Conversions API, activated only with your consent. For the collection and transmission of data via the Meta Pixel, we and Meta are joint controllers; Meta is solely responsible for any subsequent processing, as described in Meta's privacy policy.

• Geolocation: the provider of our geolocation application (Orbe), which processes your IP address transiently to determine your country.

• Consent management: iubenda S.r.l. (Milan, Italy), which operates our cookie banner and records your consent choices.

• Group companies: Neoderma Switzerland GmbH (Zug, Switzerland) and Neoderma Global Limited (Nicosia, Cyprus), where they provide customer care or administrative services to us.

• Professional advisers and authorities: accountants, auditors, lawyers, and public authorities where the law requires disclosure.

Providers that process data on our behalf are bound by data processing agreements under Article 28 GDPR. We do not sell personal data and do not share it with third parties for their own marketing purposes.

6. International transfers

Your data is processed primarily within the European Economic Area. Where a recipient is established outside the EEA, we rely on one of the following safeguards:

• an adequacy decision of the European Commission (Canada, for Shopify Inc. and Smile.io Inc.; Switzerland, for Neoderma Switzerland GmbH);

• certification under the EU–US Data Privacy Framework (Shopify Inc., Google LLC and Meta Platforms, Inc., for processing in the United States);

• the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional measures.

A copy of the relevant safeguards may be requested at legal@neoderma.com.

7. How long we keep your data

• Order, invoice and payment records: seven years after the end of the financial year in which the order was placed (Article 52 of the Dutch General Tax Act).

• Customer account: until you delete your account or after three years without login or order, after which the account is deleted and order records retained only as required above.

• Customer care correspondence, including conversations with the AI assistant: two years after the matter is closed.

• Marketing data: until you unsubscribe or object; your e-mail address is then kept on a suppression list solely to ensure you receive no further marketing.

• Loyalty programme data: for as long as you participate, and one year thereafter.

• Consent records: for as long as the processing based on the consent continues, and thereafter for as long as necessary to demonstrate that consent was given.

• Analytics data: 14 months.

• Technical logs for security and fraud prevention: twelve months.

Data is deleted or anonymised when the period expires, unless a longer retention is required by law or for the establishment, exercise or defence of legal claims.

8. Marketing communications

You receive our newsletter and offers by e-mail or text message only if you have subscribed, or if you are an existing customer and have not objected. Every message contains an unsubscribe link. You may also unsubscribe or change your preferences at any time by writing to legal@neoderma.com. Unsubscribing does not affect order-related communications, which we must send to perform the contract.

9. Cookies and similar technologies

The website uses cookies and similar technologies. Cookies that are strictly necessary for the website to function, including the cookie that stores your store and language choice, are placed without consent. Analytics, advertising and other non-essential cookies are placed only after you have given consent through our cookie banner, operated by iubenda. You may withdraw or change your consent at any time via the "Cookie preferences" link in the footer of the website. Full details of the cookies used, their providers and their duration are set out in our Cookie Policy, accessible from the footer.

10. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Our fraud-prevention tools may flag an order for manual review by our team; the decision is taken by a person. Klarna carries out its own automated assessment when you choose to pay with Klarna, as described in Klarna's privacy notice.

11. Your rights

You have the right to:

• access the personal data we hold about you and receive a copy;

• rectify inaccurate or incomplete data;

• erase your data, where the conditions of Article 17 GDPR are met;

• restrict processing, where the conditions of Article 18 GDPR are met;

• receive your data in a structured, commonly used and machine-readable format and have it transmitted to another controller (portability), where processing is based on consent or contract;

• object to processing based on legitimate interest; where you object to direct marketing, we stop it without exception;

• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, write to legal@neoderma.com or to the postal address in section 1. We respond within one month, extendable by two months for complex requests, and may ask you to verify your identity. Exercising your rights is free of charge.

You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, the Netherlands (autoriteitpersoonsgegevens.nl). If you reside in Belgium, Luxembourg or Cyprus, you may instead contact the Gegevensbeschermingsautoriteit / Autorité de protection des données, the Commission nationale pour la protection des données or the Office of the Commissioner for Personal Data Protection, respectively.

12. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, alteration and destruction, including TLS encryption of all traffic to the website, encrypted storage of passwords, role-based access to customer data, and payment processing by PCI DSS-certified providers. No transmission over the internet is entirely secure; you are responsible for keeping your account credentials confidential.

13. Minors

The website is intended for persons aged 18 or over. We do not knowingly collect personal data from persons under 16. If you believe a minor has provided us with personal data, contact us and we will delete it.

14. Third-party websites and social media

The website may contain links to third-party websites and social media platforms. Their processing of your personal data is governed by their own privacy policies, for which we are not responsible. If you interact with our pages on social media, the platform processes your data as a controller under its own terms.

15. Changes to this policy

We may amend this policy to reflect changes in law, in our processing or in our service providers. The current version, with its effective date, is always available on the website. Material changes are announced on the website or, where appropriate, by e-mail.

16. Contact

Neoderma Amsterdam B.V.
Herengracht 280
1016 BX Amsterdam
The Netherlands
E-mail: legal@neoderma.com
Telephone: +31 20 225 1202