PRIVACY NOTICE

With this Privacy Notice, we provide you with information about how and why we process your personal data in connection with the SkinVault service (hereafter “Service”).

Please note that our Service may contain links to third-party websites and services. When a data subject visits third-party websites or uses third-party services, the data subject does so on their own responsibility and risk. The Company is not responsible for data processing by third parties. This includes, for example, the payment provider(s) of the Service, who may have a legal obligation to collect your personal data.

1. WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?

The controller of your personal data is:
Not So Boring FZCO (DSO-FZCO-43359), which is located at IFZA Business Park, DDP, PO Box 342001, Dubai, United Arab Emirates, and is the Operator of the Service.

You can reach us via email at: support@skinvault.gg.

2. WHAT DEFINITIONS ARE USED IN THIS PRIVACY NOTICE?

• Controller means a party that is in charge of the personal data processing activities.
• Data subject is a term for a human being in accordance with data protection laws.
• Legal basis for processing means the legal basis with which the controller processes personal data of a data subject. Article 6 of the GDPR contains provisions on legal bases for processing.
• Personal data means any data concerning a data subject or data with which a data subject can be identified.
• Privacy Notice means a data protection document that has been drafted according to Articles 13 and 14 of the GDPR and relevant U.S. privacy laws, and with which the controller informs data subjects of the ways their personal data is processed.
• Processor means a party that processes personal data for and on behalf of the controller.
• Purpose for processing means the reason why the controller processes personal data of a data subject.

3. WHY DO WE PROCESS YOUR PERSONAL DATA?

We process personal data to be able to provide the Service to our users and enhance and develop our Service.

Our legal basis for processing personal data depends on the purpose for which we process personal data. We use as a legal basis:

• (i) our contractual obligations when we provide the Service to our users,
• (ii) our legitimate interests when enhancing and developing our Service, and
• (iii) compliance with legal obligations under applicable data protection laws.

In our personal data processing activities, we process names, contact information, and other data related to the use of our Service.

4. FROM WHERE DO WE COLLECT YOUR PERSONAL DATA?

We collect your personal data from you personally, digital services (e.g., Service and email service providers), and authorities and public sources (e.g., official registries such as the trade registry).

5. DO WE TRANSFER YOUR PERSONAL DATA?

As a general rule, we will not disclose your personal data to third parties. However, if we are required by mandatory law or governmental authorities to disclose your personal data, we will assess the legality of such disclosure on a case-by-case basis.

We do share, i.e., transfer your personal data to others as part of our normal business activities when using various digital services. For example, we use the following digital services provided by data processors, which involve the processing of personal data: data storage services (e.g., cloud services), communication services (e.g., e-mails), and financial management tools.

6. DO WE PROCESS YOUR PERSONAL DATA OUTSIDE THE EU AND THE EEA AREA?

Your personal data may be processed outside the EU and the EEA area. In these situations, we ensure an adequate level of data protection, for example, through Data Privacy Framework (DPF), standard contractual clauses, adequacy decisions, and other similar arrangements.

7. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

We retain personal data for:

• (i) as long as we have a valid contractual relationship in connection to the data, and
• (ii) as long as it is necessary to fulfill the purpose of data processing.

8. DATA PROTECTION RIGHTS UNDER THE GDPR

You may have the right to use the below-listed data protection rights under the GDPR:

• Right to inspect (art. 15)
• Right to rectify (art. 16)
• Right to erasure (art. 17)
• Right to restriction of processing (art. 18)
• Right to data portability (art. 20)
• Right to object; especially when processing personal data based on legitimate interests (art. 21)
• Right not to be subject to automated individual decision-making, including profiling (art. 22)

If you would like to use your rights or inquire something about data protection, please be in touch via email (see contact information in Section 1).

You may also have a right to lodge a complaint with the data protection authorities if you think that the processing of your personal data infringes data protection laws.

9. U.S. CONSUMER RIGHTS

If you are a resident of the United States, you may have specific rights under U.S. privacy laws, including the California Consumer Privacy Act (CCPA):

• Right to Know and Access: Request information about the categories of personal data we collect, the purposes for which we use it, and with whom it is shared.
• Right to Delete: Request deletion of your personal data, subject to certain exceptions.
• Right to Opt-Out of Sale: Opt-out of the sale of your personal data (if applicable).
• Right to Non-Discrimination: You have the right not to be discriminated against for exercising these rights.

To exercise your U.S. privacy rights, please contact us at: support@skinvault.gg

10. CHILDREN’S PRIVACY

Our Service is not directed toward children under the age of 13, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 13, we will delete it in accordance with the Children’s Online Privacy Protection Act (COPPA).

11. CAN THIS PRIVACY NOTICE BE AMENDED?

We may unilaterally amend this privacy notice. We update the privacy notice as necessary, for example, when there is a change in legislation. Amendments to this privacy notice will take effect immediately when we post an updated version on our website.

If we make significant changes to the privacy notice, or if there is a significant change in the way it is used, we will notify the data subjects.

(Last update: 17.12.2024)