Privacy policy

Privacy Policy

Last updated: August 28, 2025

This Privacy Policy explains how BIORÉSSENCE ("we", "us", or "our") collects, uses, discloses, and safeguards your personal information when you visit or shop at our online store (the "Services"). We host our store on Shopify. Shopify provides the e‑commerce platform that enables us to sell our products and operate the Services.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

1) Who we are

Data Controller: BIORÉSSENCE
Legal entity name (Companies House): BIORESSENCECOSMETICSLTD
Company number (CRN): 16599494
Email: bioressence@bioressence.com
Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us using the details above.

2) Personal information we collect

The types of personal information we collect depend on how you interact with the Services and are grouped as follows:

  • Identity & Contact Data — name, email address, billing and shipping addresses, telephone number.

  • Account Data — account credentials, profile details, preferences and settings, saved items.

  • Order & Transaction Data — products viewed, placed in cart, purchased, returned or exchanged, order numbers, purchase history, and related communications.

  • Payment Data — payment method, billing country, payment confirmation and status. We do not store full payment card numbers. Card details are processed securely by PCI‑DSS compliant payment processors we use, and are not stored by us.

  • Device & Usage Data — IP address, device and browser type, operating system, time zone, cookie identifiers and similar technologies, pages viewed, links clicked, and how you interact with the Services.

  • Communications Data — messages you send to us (e.g., customer support, reviews, social media).

We may combine information we collect from you with information we receive from our service providers and partners, and derive inferences to improve the Services.

3) How we collect information

  • Directly from you when you create an account, place an order, contact us, or otherwise use the Services.

  • Automatically via cookies, pixels, and similar technologies when you browse our site.

  • From service providers and partners who perform services on our behalf (e.g., payments, shipping, analytics, marketing).

You can manage cookies through your browser settings and the preferences tools we provide (see Cookies & similar technologies below).

4) How and why we use your information (legal bases)

Where EU/UK law applies, we process personal information under the following legal bases:

  • To perform a contract with you: provide the Services, process payments, fulfill and deliver orders, handle returns/exchanges, and provide customer support.

  • Our legitimate interests: operate, improve, and secure the Services; prevent fraud; personalize your shopping experience; and market our products (where permitted by law). You can object to processing based on legitimate interests at any time (see Your rights).

  • Your consent: send certain marketing communications, place non‑essential cookies, or run specific promotions. You can withdraw consent at any time.

  • Compliance with legal obligations: tax and accounting, responding to lawful requests, and enforcing our terms.

5) Marketing & advertising

We may send you marketing emails or show you online ads for our products. You can opt out of email marketing at any time using the unsubscribe link in our emails. Opt‑outs do not affect transactional emails (e.g., order confirmations). For interest‑based advertising controls, see Cookies & similar technologies.

6) Security and retention

We use technical and organizational measures designed to protect your information. However, no method of transmission or storage is completely secure.

We retain information for as long as necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. For example, we generally keep basic order and invoice records for up to six (6) years for tax and accounting in the UK.

7) How we share information

We share personal information with:

  • Service Providers acting on our behalf, such as Shopify (store hosting), payment processors, fraud prevention tools, analytics providers, email and marketing platforms, and shipping carriers. These parties process data under appropriate contracts and only as needed to provide their services to us.

  • Business & marketing partners who help deliver advertising and promotional services. Such partners may set cookies or similar technologies (see Cookies & similar technologies).

  • Authorities, advisors, and others as necessary to comply with law, enforce our terms, protect our rights, or in connection with corporate transactions (e.g., merger, acquisition).

We do not sell personal information. Where required by US state laws, you may have the right to opt out of “sale”/“sharing” for targeted advertising; see Your rights.

8) Relationship with Shopify

Our store is powered by Shopify. Shopify processes your personal information to provide the e‑commerce platform to us (generally as our processor). For some features (for example, to improve and protect its services across merchants), Shopify may act as an independent controller. For details about Shopify’s privacy practices and how to exercise rights with Shopify directly, see:
Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy
Shopify Privacy Portal (rights requests): https://privacy.shopify.com/

9) International data transfers

We may transfer, store, and process your information outside your country of residence. Where required (e.g., transfers from the UK/EEA), we rely on recognized transfer mechanisms, such as the EU Standard Contractual Clauses and the UK‑approved equivalents.

10) Your rights and choices

Depending on where you live, you may have the following rights:

  • Access (know what data we hold about you)

  • Correction (rectify inaccurate data)

  • Deletion (request erasure)

  • Portability (receive a copy in a portable format)

  • Restriction and Objection to certain processing (including processing based on legitimate interests and direct marketing)

  • Withdraw consent where processing is based on consent

To exercise these rights, contact us at bioressence@bioressence.com. We may need to verify your identity. You may designate an authorized agent where permitted by law.

Global Privacy Control (GPC): If you visit our site with GPC enabled, we will treat it as a request to opt out of targeted advertising for that browser/device where required by law.

UK/EEA: You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO): https://ico.org.uk/

US residents (where applicable): You may have the right to opt out of the “sale”/“sharing” of personal information for targeted advertising. To exercise this right, use our “Do Not Sell or Share My Personal Information” link (where provided) or contact us.

11) Children’s data

The Services are not intended for individuals under the age of majority in their jurisdiction. We do not knowingly collect personal information from children under 16 in the UK/EEA (or 13 in the US). If you are a parent or guardian and believe your child has provided personal information, please contact us to request deletion.

12) Cookies & similar technologies

We use cookies, pixels, and similar technologies to operate the site, keep your cart, remember preferences, analyze performance, and deliver ads. You can manage non‑essential cookies through our cookie banner or your browser settings. For more information, see our Cookie Policy (if available) or contact us.

13) Third‑party websites

The Services may contain links to third‑party websites or services. We are not responsible for their privacy practices. We encourage you to read their privacy policies.

14) Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy and update the “Last updated” date above.

15) Contact

BIORÉSSENCE
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: bioressence@bioressence.com
We are the data controller responsible for the processing described above.