Privacy policy
Last updated: 14/7/2026 — replaces the version dated 18 May 2018
Who we are
This website is operated by Skinaddict® Ltd (trading as SkinAddict), part of No6 Clinic Ltd, registered in England & Wales.
Registered office: No.6 Clinic, Clayfield Mews, Newcomen road, Tunbridge Wells, TN4 9PA
Contact for privacy queries: info@skinaddictc.co.uk
Data protection contact: Samantha Clarke Director
We are the “data controller” for the personal data described in this policy, meaning we decide how and why it’s used.
Important update: we’re moving to Shopify
On 16/7/2026 we’re migrating our website and store from WooCommerce to Shopify. As part of this move:
• Your account and contact details (name, email, address, phone number) are being transferred securely using encrypted migration tools.
• Previous order history will not carry over to the new platform and will not be retained after the migration. If you need a record of a past order, please request or download this before 16/7/2026.
• Shopify Inc. becomes one of our data processors going forward — see “Who we share your data with” below.
• Your login method is changing: instead of a password, you’ll receive a one-time code by email each time you sign in. No action is needed from you.
• This policy has been updated to reflect that change and to bring it up to current UK GDPR standards.
What information we collect
• Identity and contact data: name, email address, postal address, phone number.
• Order and transaction data: products purchased, order history, payment confirmation (we do not store full card numbers — these are handled directly by our payment processor).
• Account data: login details, order preferences, saved addresses.
• Health/consultation data: if you complete an online skincare consultation, you may provide information about skin conditions, medical history, allergies, medication, or pregnancy/breastfeeding status. This is “special category data” under Article 9 UK GDPR and is handled with additional safeguards (see below).
• Technical data: IP address, browser type, device information, and cookie data (see “Cookies” below).
• Gift recipient data: name and address, used only to fulfil a gift order — never for marketing.
The legal basis for using your data
UK GDPR requires us to have a valid lawful basis for each way we use your data:
|How we use your data — and why
• Processing your order, account, and payment — Performance of a contract with you
• Responding to customer service queries — Contract / legitimate interest
• Sending you marketing emails — Consent (you can withdraw this any time)
• Reviewing your skincare consultation — Explicit consent, and necessity for the provision of healthcare/treatment advice (Article 9(2)(h))
• Fraud prevention and site security — Legitimate interest
• Keeping records for tax/accounting — Legal obligation
Special category (health) data
Where you submit medical or skin-health information via an online consultation:
• It is accessible only to qualified healthcare professionals within No6 Clinic and Skinaddict Ltd.
• It is retained only as long as needed to assess your consultation — up to 7 days, or until your application is approved or declined, after which it is deleted, unless you become a client, in which case it’s retained for ongoing care.
• You must tell us if your medical situation changes (e.g. pregnancy, new medication, new allergies) so we can ensure products remain suitable for you.
Cookies
We use cookies to run your shopping cart, remember your preferences, and understand site traffic. Under UK PECR rules, we ask for your consent to non-essential cookies (such as analytics or marketing pixels) via a cookie banner when you first visit — strictly necessary cookies (e.g. those needed to keep items in your basket) don’t require consent.
You can manage or withdraw cookie consent at any time through our cookie banner settings or your browser settings. Turning off non-essential cookies won’t stop you shopping with us, but may affect personalisation.
Who we share your data with:
We don’t sell your personal data. We share it only with:
• Shopify Inc. — our e-commerce platform provider, which hosts our store and processes orders on our behalf.
• Payment processors — to process your payment securely (they receive card details directly; we don’t store them).
• Delivery/courier partners — to fulfil your order.
• Email and marketing service providers — to send order confirmations and, where you’ve consented, marketing emails.
• Analytics providers — to understand site usage (only with your cookie consent).
• Regulators or authorities — where required by law.
All third parties are contractually required to protect your data and use it only for the purposes we’ve instructed.
International transfers
Some of the providers above (including Shopify) may store or process data outside the UK/EEA. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision.
How we protect your data
We use industry-standard security measures, including encrypted (SSL/TLS) connections for order and payment data, restricted internal access on a need-to-know basis, and confidentiality obligations for anyone handling your data. Data migrated to Shopify is transferred using encrypted tools throughout the process.
How long we keep your data
We keep personal data only as long as necessary for the purposes described above — for example, order records for tax and accounting purposes, or consultation data for the periods set out under “Special category data.”
Your rights
Under UK GDPR, you have the right to:
• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (“right to be forgotten”), where applicable
• Restrict or object to certain processing
• Data portability — receive your data in a portable format
• Withdraw consent at any time, where we rely on consent
• Complain to the ICO (Information Commissioner’s Office) at ico.org.uk if you’re unhappy with how we’ve handled your data.
You can manage most of this yourself in “My Account” (edit or remove addresses, payment details, email preferences), or contact us at [insert privacy email] for anything else. We’ll respond within one month, as required by law.
Children
Our services are not directed at children, and we don’t knowingly collect data from anyone under 18 without appropriate consent.
Third-party links
Our site may link to other websites. We aren’t responsible for their privacy practices — please check their own policies.
Changes to this policy
We’ll post any updates to this page. Material changes will be highlighted, and the “last updated” date at the top will reflect the most recent version.
Contact us
Questions or concerns about this policy or your data:
Samantha Clarke Director