Privacy policy

1Who is responsible for your data

The data controller is NEEDS: registered company name, a private company limited by shares registered in Ireland, company number NEEDS: CRO number, registered office NEEDS: registered office address, trading as Aesthetic Medicine.

Data protection requests and questions go to NEEDS: data protection contact address. We answer within one month.

We are not required to appoint a Data Protection Officer and we have not appointed one. Requests are handled by the address above.

2What we collect, and why

3What we do not do

• We do not sell your personal data. Not to anyone, ever.
• We do not share it with advertising networks or data brokers.
• We do not build profiles of you, and no decision about you is made by automated means alone.
• We do not ask for or want health data about your patients, and you should not send it to us. If you need to describe a clinical situation, please do it without identifying anybody.

4Who else sees it

Only where they need it to do a job for us, and only under a contract that binds them to protect it.

• Our hosting and website providers, who keep the site running.
• Our payment provider, who takes the payment. They are a controller in their own right for fraud prevention.
• Couriers, who need a name, an address and a phone number to deliver.
• Our accountants and auditors, for the financial records the law requires us to keep.
• A manufacturer or the relevant authority, where a product safety issue or a recall means we have to say who received a batch.
• Professional advisers, insurers and, where we are legally required, the authorities.

The named list of processors is published here once the shop's payment and delivery providers are appointed, and this page will name them rather than describing them in general terms.

5Sending data outside the EU

We keep data inside the European Economic Area wherever we can. If a provider we use processes data outside it, we rely on the safeguards the GDPR allows, normally an adequacy decision by the European Commission or the European Commission's standard contractual clauses.

You can ask us which providers those are and what safeguard applies to each, and we will tell you.

6How long we keep it

Order and invoice records

Six years after the end of the tax year they relate to, which is what Irish tax law requires.

Batch and traceability records

Kept for as long as product traceability requires, which can be longer than six years for some medical devices.

Professional verification records

For as long as the account is open, and six years after it closes.

Correspondence

Three years, unless it relates to a complaint or a claim, in which case until that is resolved and the limitation period has run.

Marketing consent

Until you withdraw it. We also stop sending if you have not opened anything in two years.

An account you ask us to close

Deleted, except for the records above that we are legally required to keep.

7Marketing

We only send marketing to somebody who asked for it, or to an existing customer about products similar to what they already bought, which is what the ePrivacy rules allow. Every message carries an unsubscribe link, it works immediately, and using it costs you nothing else. You will still get the emails we have to send about an order you placed.

8Your rights

You can ask us to:

• show you the personal data we hold about you, and give you a copy;
• correct anything that is wrong or incomplete;
• delete it, where we do not have a legal reason to keep it;
• restrict what we do with it while a dispute about it is sorted out;
• hand it over to you or to somebody else in a machine-readable form, where we hold it on the basis of consent or a contract;
• stop, where we are relying on legitimate interests, or where it is marketing. For marketing there is no argument: we stop.

Where we rely on your consent, you can withdraw it at any time. That does not undo anything done before you withdrew it.

Ask at NEEDS: data protection contact address. We answer within one month, and we tell you if we need longer and why. There is no charge, unless a request is clearly excessive or repetitive.

9Keeping it safe

The site runs over HTTPS. Access to customer records is limited to people who need it. Payment card details never reach our servers. We review access when somebody joins or leaves.

No system is perfect. If a breach happens that is likely to put your rights at risk, we will tell the Data Protection Commission within 72 hours and, where the risk to you is high, we will tell you directly.

10Complaining about how we handle your data

Tell us first if you can, at NEEDS: data protection contact address. You do not have to.

You have the right to complain to the Data Protection Commission, the Irish supervisory authority, at any time. Their website is dataprotection.ie and they publish a complaint form and a phone number.

If you live in another EU country you can complain to your own national supervisory authority instead.

11Changes to this policy

When this policy changes, the date at the top changes with it. If a change materially affects how we use data we already hold, we will tell account holders directly rather than relying on you noticing this page.