Privacy policy

Last updated: July 15, 2026

This Privacy Policy explains how Dermaceutic collects, uses, stores, and protects your personal data when you visit www.dermaceutic.com (the “Website”), use its features, subscribe to our communications, or, where this service is available, make an online purchase. 

The Website presents Dermaceutic’s products, expertise, and activities to an international audience. Online shopping features and the loyalty programme are currently available only to users located in France. 

We are committed to processing your personal data lawfully, fairly, and transparently, in accordance with applicable data protection laws, including the General Data Protection Regulation (“GDPR”). 

1. Who is responsible for processing your data? 

The data controller responsible for processing your personal data is: 

Lumiderme – Dermaceutic Laboratoire 
15 Chemin des Presses 
06800 Cagnes-sur-Mer 
France 

For any questions relating to the protection of your personal data or to exercise your rights, you may contact us at: 

dpo@dermaceutic.com 

 

2. Who does this Policy apply to? 

This Policy applies in particular to: 

  • visitors to the Website;  

  • customers and prospective customers;  

  • subscribers to our newsletters and communications;  

  • members of our loyalty programme in France;  

  • healthcare professionals and other professionals who visit the Website or subscribe to our communications;  

  • individuals who contact us through our forms, customer service, or social media channels.  

 

3. What personal data do we collect? 

The data we collect depends on how you use the Website and on your relationship with Dermaceutic. 

3.1. Identification and contact data 

We may collect: 

  • your first and last name;  

  • your email address;  

  • your telephone number;  

  • your postal address;  

  • your country of residence;  

  • your preferred language or market.  

3.2. Account data 

When you create a customer account, we may collect: 

  • your login credentials;  

  • information recorded in your profile;  

  • your communication preferences;  

  • the history of changes made to your account.  

We do not store your password in plain text. 

3.3. Order and payment data 

For purchases made through our French online store, we may process: 

  • the products ordered;  

  • the amount and date of the order;  

  • billing and delivery information;  

  • the status of the order;  

  • purchase, return, and refund history;  

  • information required to process payments and prevent fraud.  

Full payment card details are processed by our payment service providers and are not directly accessible to Dermaceutic, except where required by law or necessary for the operation of the service. 

3.4. Professional profile data 

When you identify yourself as a healthcare professional or industry professional, we may collect: 

  • your profession;  

  • your speciality;  

  • the name of your clinic, practice, pharmacy, company, or institution;  

  • your country of practice;  

  • your professional areas of interest;  

  • the scientific content, products, or training courses that interest you.  

3.5. Data relating to our communications 

When you subscribe to or interact with our communications, we may collect: 

  • your subscription or unsubscribe status;  

  • your communication preferences;  

  • the categories of content you wish to receive;  

  • your preference regarding open and click tracking;  

  • the emails sent to you;  

  • opens, clicks, and interactions where you have agreed to such tracking, or where it may be used without consent in accordance with applicable law;  

  • your replies and communications with us.  

3.6. Loyalty programme data 

For users of the loyalty programme available in France, we may collect: 

  • your membership of the programme;  

  • your points balance;  

  • your rewards and benefits;  

  • actions carried out as part of the programme;  

  • referrals and related interactions;  

  • your participation history.  

This programme is managed with the assistance of our service provider, Loyoly. 

3.7. Browsing and technical data 

When you visit the Website, we may collect, depending on your cookie choices: 

  • your IP address;  

  • the type of device used;  

  • your operating system;  

  • your browser and browser version;  

  • the pages viewed;  

  • the date and time of your visits;  

  • your browsing journey;  

  • the products or content viewed;  

  • searches performed;  

  • interactions with certain features;  

  • the website or campaign through which you arrived on our Website;  

  • approximate location information inferred from your IP address;  

  • cookie identifiers or advertising identifiers.  

Some of this information may constitute personal data, particularly where it can be used to distinguish you or associate you with an account, device, or profile. 

3.8. Data provided to customer service 

When you contact us, we may collect: 

  • the content of your request;  

  • any attachments you provide;  

  • the history of our communications;  

  • the information required to answer your question or handle your complaint.  

We ask that you do not provide sensitive or medical information unless it is necessary for us to handle your request. 

4. How do we collect your data? 

We may collect your data: 

  • directly from you, for example when you create an account, place an order, complete a form, subscribe to a newsletter, or contact customer service;  

  • automatically when you use the Website, through cookies, pixels, technical logs, and similar technologies;  

  • from our technical and commercial service providers where necessary to provide our services;  

  • through social media platforms when you interact with Dermaceutic on those platforms or use a social feature;  

  • from authorised distributors or partners, provided that the sharing is lawful and that you have been informed.  

 

5. Why do we use your data and what are our legal bases? 

We use your data only for specific purposes.

Purpose 

Main data used 

Legal basis 

Displaying and operating the Website 

Technical and browsing data 

Legitimate interest or technical necessity 

Creating and managing your account 

Identification, contact, and account data 

Performance of a contract 

Processing an order, payment, delivery, return, or refund 

Identification, order, payment, and delivery data 

Performance of a contract 

Providing after-sales support and responding to your requests 

Contact, order, and correspondence data 

Performance of a contract or legitimate interest 

Complying with tax, accounting, and regulatory obligations 

Order, billing, and payment data 

Legal obligation 

Preventing fraud and securing our services 

Order, login, and technical data 

Legitimate interest 

Sending newsletters and marketing communications 

Identification, contact, and preference data 

Consent, or another legal basis permitted by law 

Measuring email opens and clicks for personalisation and performance purposes 

Communication and interaction data 

Consent where required 

Measuring audience and improving the Website 

Browsing data 

Consent for non-exempt trackers 

Personalising content and recommendations 

Preferences, browsing, and interactions 

Consent or legitimate interest, depending on the processing 

Measuring and personalising advertising campaigns 

Browsing, interactions, and advertising identifiers 

Consent 

Managing the loyalty programme in France 

Account, order, and loyalty data 

Performance of the programme and, depending on the feature, consent 

Producing internal statistics 

Aggregated or pseudonymised data 

Legitimate interest 

Defending our rights and managing disputes 

Any relevant data 

Legitimate interest or legal obligation 

 

Where we rely on legitimate interest, we verify that this interest does not disproportionately affect your rights and freedoms. 

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn. 

 

6. Marketing communications and email tracking 

When you choose to receive communications from Dermaceutic, we may send you: 

  • information about our products and innovations;  

  • scientific and educational content;  

  • results, analyses, or news relating to skin science;  

  • information intended for healthcare professionals;  

  • invitations to events or training sessions;  

  • offers, benefits, or commercial communications.  

Our emails may contain invisible pixels and tracked links that allow us to determine whether a message has been opened or a link has been used. 

This information may enable us to: 

  • measure the performance of our communications;  

  • better understand which content interests our subscribers;  

  • adapt the content and frequency of our messages;  

  • personalise communications according to expressed interests;  

  • limit the sending of content that may be less relevant.  

The French Data Protection Authority, the CNIL, considers pixels embedded in emails to be tracking technologies and requires their use to be transparent and, for certain purposes, subject to the individual’s consent. 

You may choose to refuse the tracking of email opens and clicks while continuing to receive our communications. You can change this preference at any time using the preference management link included in our emails. 

You may also unsubscribe from our marketing communications at any time by using the unsubscribe link included in each email. 

We mainly use Klaviyo to manage our communications and, in France, Loyoly for certain communications relating to the loyalty programme. 

 

7. Cookies and similar technologies 

We use cookies and similar technologies to: 

  • ensure the operation and security of the Website;  

  • manage your shopping cart and account;  

  • remember your preferences;  

  • measure audience;  

  • analyse Website performance;  

  • personalise content;  

  • measure and personalise advertising campaigns;  

  • provide certain marketing or loyalty features.  

Strictly necessary cookies may be used without your consent where they are essential to provide the service requested. 

Non-exempt audience measurement, personalisation, and advertising cookies are used only after we have obtained your consent. The CNIL states that trackers requiring consent must not be stored or accessed before such consent has been given. 

We use Axeptio to collect and manage your choices. 

You may accept, reject, or customise cookies during your first visit and change your choices at any time through the “Cookie Preferences” link available on the Website. 

For a list of the cookies and partners we use, please refer to our Cookie Policy. 

 

8. Who do we share your data with? 

Your data may be accessed, within the limits of their roles, by authorised Dermaceutic teams, including: 

  • e-commerce;  

  • customer service;  

  • marketing and communications;  

  • IT and security;  

  • finance, accounting, and legal;  

  • sales and scientific teams, where relevant.  

We may also share your data with service providers acting on our behalf, including: 

  • Shopify, for hosting and operating our online store;  

  • our payment service providers;  

  • our carriers and logistics providers;  

  • Klaviyo, for managing marketing communications;  

  • Loyoly, for the loyalty programme available in France;  

  • Google Analytics 4, for audience measurement;  

  • Google Ads, for advertising and conversion measurement;  

  • Meta, including Facebook and Instagram, for social features, advertising, and campaign measurement;  

  • Axeptio, for managing your cookie preferences;  

  • our technical, security, hosting, maintenance, and advisory service providers.  

Certain partners, such as Google or Meta, may act as separate data controllers for certain processing activities. In such cases, their own privacy policies apply to the processing they carry out for their own purposes. 

We may also disclose your data: 

  • to administrative or judicial authorities where required by law;  

  • to our advisers, insurers, or auditors where necessary;  

  • as part of a restructuring, merger, acquisition, sale, or similar transaction, subject to appropriate safeguards.  

We do not sell your personal data in the ordinary sense of the term. 

 

9. International data transfers 

Dermaceutic is established in France, but some of our service providers may process data from countries outside France or the European Economic Area. 

This may be the case when we use international providers such as Shopify, Google, Meta, or Klaviyo. Shopify states that data may be processed or transferred in various countries, including outside the European Economic Area. 

Where data is transferred to a country that does not benefit from an adequacy decision, we ensure that the transfer is covered by a mechanism recognised under applicable law, such as: 

  • the Standard Contractual Clauses adopted by the European Commission;  

  • a transfer framework recognised by the competent authorities;  

  • Binding Corporate Rules;  

  • any other appropriate safeguard provided for by applicable law.  

You may contact us for further information about the safeguards applicable to a particular transfer. 

 

10. How long do we retain your data? 

We retain your data only for as long as necessary for the purposes for which it was collected, together with any applicable limitation periods or statutory retention periods.

Data category 

Intended retention period 

Active customer account 

For the duration of the account’s use 

Inactive customer account 

Up to 3 years after the last activity, unless a different retention obligation applies 

Customer data used for marketing purposes 

During the commercial relationship, then for up to 3 years after its end or the last contact 

Prospect and newsletter subscriber data 

Until consent is withdrawn or, in the absence of interaction, up to 3 years after the last active contact 

Evidence of consent or withdrawal 

For the duration of the processing, then for as long as necessary to demonstrate compliance with our obligations 

Orders, invoices, and accounting data 

For the period required by applicable law, generally 10 years for accounting documents 

Customer service requests 

For as long as necessary to handle the request, then for up to 3 years depending on the nature of the request 

Data relating to a dispute 

For the duration of the dispute and until the expiry of applicable appeal or limitation periods 

Loyalty programme data 

For the duration of participation in the programme, then for as long as necessary to manage the related rights and obligations 

Security data and technical logs 

12 months 

Data collected through cookies 

6 months 

Cookie preferences 

In principle, 6 months before consent is requested again, unless a change of purpose or another circumstance requires consent to be collected again 

 

At the end of these periods, data is deleted, anonymised, or securely archived where retention is required. 

11. How do we protect your data? 

We implement technical and organisational measures designed to protect your data against: 

- unauthorised access;  

- loss;  

- alteration;  

- disclosure;  

- destruction;  

- unlawful or abusive use.  

These measures may include access controls, authentication measures, secure data transfers, restricted permissions, system backups, and contractual safeguards with our service providers. 

However, no information system can guarantee absolute security. In the event of a personal data breach likely to present a risk to your rights and freedoms, we will take the measures required under applicable law. 

 

12. What are your rights? 

Depending on the applicable law and your circumstances, you may have the following rights: 

- the right to access your personal data;  

- the right to request its rectification;  

- the right to request its deletion;  

- the right to request the restriction of processing;  

- the right to object to certain processing activities;  

- the right to data portability in relation to data you have provided to us;  

- the right to withdraw your consent at any time;  

- the right to provide instructions regarding the use of your data after your death, where French law applies;  

- the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where permitted by law.  

The exercise of certain rights may be restricted where we must retain or process data in order to comply with a legal obligation, establish or defend our rights, prevent fraud, or perform a contract. 

To exercise your rights, contact us at: 

dpo@dermaceutic.com 

Your request must allow us to identify you sufficiently. We may ask for additional information where necessary to confirm your identity, while avoiding the collection of disproportionate supporting documents. 

We will respond within the time limits provided by applicable law. 

You also have the right to lodge a complaint with the competent data protection authority. In France, you may contact the Commission Nationale de l’Informatique et des Libertés (CNIL). 

The information that must be provided to individuals includes, in particular, the identity of the data controller, the purposes and legal bases of processing, recipients, retention periods, international transfers, and the rights available to them. 

 

13. Children and minors 

The Website is not intended for children under the age of 16, and we do not knowingly seek to collect their personal data. 

If you believe that a minor has provided us with personal data without the required authorisation, you may contact us so that we can investigate the matter and take appropriate action. 

 

14. Links to third-party websites and platforms 

The Website may contain links to websites, social networks, or services operated by third parties. 

Dermaceutic does not control the processing carried out by those third parties where they act for their own purposes. We encourage you to review their privacy policies before providing them with personal data. 

 

15. Changes to this Policy 

We may amend this Policy to reflect: 

- changes to our activities or services;  

- the addition or removal of a service provider;  

- technical developments;  

- legal or regulatory changes;  

- changes to our data processing practices.  

The “Last updated” date at the top of the page will be amended accordingly. 

Where the changes are significant, we may inform you through an appropriate method, including a notice on the Website or by email where relevant. 

 

16. Contact us 

For any questions regarding this Policy or the use of your personal data, you may contact us at: 

Lumiderme – Dermaceutic Laboratoire 
For the attention of the person responsible for data protection 
15 Chemin des Presses 
06800 Cagnes-sur-Mer 
France 

Email: dpo@dermaceutic.com