Search
Instytutum
LoadingLoading

Privacy Policy

Last updated: 09.15.26

PREAMBLE

INSTYTUTUM AG is a company registered in Switzerland with the main office at Gubelstrasse 12, 6300 Zug, company Enterprise Identification Number (UID): CHE-440.903.330 (“we”, “our”, “us”) that operates this Website https://instytutum.com/ (the “Website”).

Protection of your personal data is very important to us. We are committed to protecting the privacy of individuals who visit the Website and use its online facilities. In this Privacy Policy, we would like to inform you of all the details of the collection, processing, and use of personal data.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit our Website, use our services, make a purchase from the Website, subscribe to receive marketing communications by email, enroll in and participate in our SMS Program (where available), or otherwise communicate with us (collectively, the "Services"). 

You can be a website visitor, a customer, or an AI skin analysis user:

  • You are a website visitor when you merely browse the Website and provide us with your data via cookies or contact us via online chat, email, phone, our social media accounts (including Instagram, Facebook, TikTok and WhatsApp), or fill out online forms on the Website (including requests for consultations, subscriptions for newsletters, SMS Program enrollment forms (where available), the “email us” form, the “leave a review” form, and other types of forms) or book a call with a skincare expert on our Website;

  • You are a customer when you submit your personal data to register on the Website, provide your data when you make a purchase via our Website (including as a guest without registering on the Website), including when you purchase products on a subscription basis, submit information through our online skincare analyzer, contact us via available options for assistance, enroll in and participate in our SMS Program (where applicable), or use other services provided by us;

  • You are an AI skin analysis user when you submit your personal data for AI skin analysis.

We kindly ask you to read this Privacy Policy carefully to fully understand our practices in relation to your personal data.

DEFINITIONS 

We use the following definitions in this Privacy Policy:

  • “controller” means the natural or legal person who (either alone or jointly with others) determines the purposes and means of the processing of personal data.

  • “processor” means a natural or legal person who processes personal data on behalf of the controller.

  • “data subject” is an identified or identifiable natural person about whom we hold personal data.

  • “personal data” means any information relating to you and helping identify you (directly or indirectly), such as a name, email, address, etc.

  • “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

  • “GDPR”: European Union’s General Data Protection Regulation.

  • “CCPA”: the California Consumer Privacy Act. 

  • “CPRA”: the California Privacy Rights Act.

  • “VCDPA”: the Virginia Consumer Data Protection Act.

  • “CPA”: the Colorado Privacy Act.

  • “CTDPA”: the Connecticut Data Privacy Act.

  • “UCPA”: the Utah Consumer Privacy Act.

  • “TDPSA”: the Texas Data Privacy And Security Act.

  • “FDBR”: the Florida Digital Bill of Rights.

  • “OCPA”: the Oregon Consumer Privacy Act.

  • “MTCDPA”: the Montana Consumer Data Protection Act.

  • “NDPA”: the Nebraska Data Privacy Act.

  • “ICDPA”: the Iowa Consumer Data Protection Act.

  • “DPDPA”: the Delaware Personal Data Privacy Act.

  • “NHPA”: the New Hampshire Privacy Act.

  • “NJDPA”: the New Jersey Data Protection Act.

  • “TIPA”: the Tennessee Information Protection Act.

  • “MCDPA”: the Minnesota Consumer Data Privacy Act.

  • “MODPA”: the Maryland Online Data Privacy Act.

  • “INCDPA”: the Indiana Consumer Data Protection Act.

  • “KCDPA”: the Kentucky Consumer Data Protection Act.

  • “RIDTPPA”: the Rhode Island Data Transparency and Privacy Protection Act.

  •  “EU Data Act” : Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data, amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828.

  • “AI Act”: the European Union Regulation on Artificial Intelligence (AI).

  •  “Data Governance Act”: Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724.

IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

When processing your personal data in situations described in this Privacy Policy, we act as a controller under the GDPR and other applicable legislation.

INSTYTUTUM AG is a company incorporated and existing under the laws of the Swiss Confederation with Enterprise Identification Number (UID) CHE-440.903.330. 

  • Our address: Gubelstrasse 12, 6300 Zug, Switzerland; 

  • Our telephone number: +41 41 511 20 50; 

  • Our email: [email protected]. 

DATA COLLECTION

We collect your personal data when you:

  • visit our Website; 

  • contact us via online chat, email, phone, or our social media accounts;

  • fill out online forms on the Website;

  • register on the Website;

  • make a purchase via our Website, including purchase products on a subscription basis or manage your subscription through the Website;

  • subscribe to newsletters, enroll in and participate in our SMS Program (where available), or otherwise opt-in to receive marketing communications;

  • request for assistance;

  • leave a review;

  • request for AI skin analysis;

  • use our online skincare analyzer;

  • book a call with a skincare expert on our Website;

  • voluntarily provide your data, including any other instances on the Website where you knowingly choose to share your personal data.

Providing your contact details for registration, payment, and transaction information is necessary to enter into or perform a contract with you in the meaning of the GDPR. For example, if you refuse to provide your address when ordering our products, the products cannot be delivered to you.


We collect website visitor data, customer data, and AI skin analysis user data in connection with our Website and Services: 

Website visitor data

Type of data 

Description 

Collected personal data 

(a) Contact Information

When you contact us via online chat, our social media, email address, or phone number, fill out online forms on our Website, or subscribe to newsletters, enroll in and participate in our SMS Program (where available), or otherwise opt-in to receive marketing communications, we may collect some information about you.

Such data may include your full name, email address, phone number, country of residence, your name and information on social media, and any other details you provide to us via available options.

(b) Cookies Information

On our Website, we may use cookies to function correctly, for analytics, marketing activities, remembering your preferences, and other purposes.

For example, we can collect usage information (pages you have viewed on our Website, search terms and search results, and other information regarding your use of the Website) for analytics purposes. To learn more regarding our use of cookies, please read our Cookies Policy.

(c) Automatically Collected Information

When you access the Website, we collect certain information about you and your device automatically. 

We may use this information for technical administration of our Website, analytic tracking system, research and development, monitoring, and improvement of our Website.

This information may include the domain name and IP address of your computer, server log files, type of browser you are using, operating system and platform, technical information, geographical location, information about your visit to our Website (length of visit, products you viewed, page response time, navigation paths, as well as information about the timing, frequency, and pattern of your service use, etc.). 

Customer data

(d) Customer Information 

We may process your contact information relating to our customer relationships and other information you provide us with, in particular, when registering on the Website. 


We may process this information to manage our relationships with customers and communicate with them, keep records of those communications, and promote our services.

It may include your full name, place of residence (country, region, city, address, and postcode), contact details (email address, phone number, fax), your company name, mailing address when you make purchases, and information contained in communications between you and us. 

(e) Transactions and Payment Information

If you make a purchase via our Website, you will need to provide certain personal details.


To obtain payment from you, we will use or direct you to a third-party payment processor who will collect this information from you and process your payment. 


Please note that a third-party payment processor is responsible for all collection, processing, and storage of your financial information, and we do not have direct access to or possession of your payment card information or banking information. 

It includes your contact details, billing address, your card details, expiration date, and transaction details so that the order can be fulfilled.

(f) Subscription and Recurring Payment Information

When you purchase products on a subscription basis or enable recurring payments, we may process personal data necessary to create, manage, perform, bill, deliver, support, and cancel your subscription.

Such data may include your full name, email address, phone number, delivery address, recipient details, subscription ID, subscription details, (including SKU, quantity, subscription interval, next charge date, subscription status), order and delivery history, Stripe customer ID, payment method ID, payment status, payment history, fraud, risk and dispute-related events, acceptance logs, checkout confirmations, IP address, timestamp, and technical logs related to your subscription and recurring payments.


We do not store your full payment card details. Payment card details are processed by our payment service provider. We may receive and store payment tokens, payment method identifiers, customer identifiers, payment statuses, and transaction-related information required to process recurring/off-session payments, handle failed payments, prevent fraud, and manage disputes.

(g) SMS Communication Information

Where you enroll in and participate in our SMS Program, we may process personal data necessary to administer the SMS Program, deliver SMS communications, respond to HELP and opt-out requests, and demonstrate compliance with applicable legal requirements.

Such data may include mobile phone number, records of your consent, the date and time your consent was obtained, records of your participation in the SMS Program, message delivery status, HELP requests, STOP and other opt-out requests,

communications relating to your participation in the SMS Program and other information necessary to administer the SMS program and demonstrate compliance with applicable legal requirements.

(hg) Online Skincare Analyzer Information 

When you use our online skincare analyzer, we may process information you voluntarily provide to us.

We process this information to provide analyzer results, product-related guidance, recommendations, and customer support related to your request.

Such data may include your email address, phone number, first and last name, date of birth, information about your skin condition, pregnancy or breastfeeding status, and photos of skincare products.

AI skin analysis user data 

(ih) AI Skin Analysis Information

When you fill out the online form for conducting AI skin analysis, we may process some information about you to provide you with this service.

Such data may include your email, phone number, age, and information concerning your health (skin sensitivity, pregnancy or breastfeeding, your pictures, and results of skin analysis, etc.).


When we act as a data controller: 

  • we DO NOT sell your data; 

  • we DO NOT use automated decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects a data subject.

EMAIL RETARGETING (U.S. CAN-SPAM COMPLIANCE)

We may send commercial emails, product updates, remarketing and retargeting communications to email addresses obtained through our Website, CRM or marketing partners. All emails to U.S. recipients are sent in compliance with the CAN-SPAM Act and include: our sender identification, a valid physical address, a clear subject line, and an accessible unsubscribe option. You may opt out of future emails at any time by using the unsubscribe link included in each message.

SMS COMMUNICATIONS (APPLICABLE TO U.S. RESIDENTS)

Where available, we may send recurring automated marketing text messages to individuals who have provided the prior express written consent required under applicable law. Enrollment in our SMS Program is voluntary, and consent to receive marketing SMS messages is not a condition of purchasing any goods or services from us. Marketing SMS messages are sent in accordance with applicable legal requirements, our SMS Terms, and applicable messaging industry standards.

Additional information regarding our SMS Program, including the categories of SMS messages, how to withdraw your consent, message frequency, and other program-specific information, is available in our SMS Terms.

For information about the personal data we collect in connection with the SMS Program and how we use such information, please refer to the “DATA COLLECTION” section of this Privacy Policy.

LEGAL BASES FOR PROCESSING 

We process your personal data in accordance with the GDPR. The GDPR provides an exclusive list of lawful bases, allowing us to process your personal data. During personal data processing, we rely only on four of them, namely:

Article 6.1(a): consent 

We collect the information you choose to give us, and we process it with your consent. We collect special categories of your personal data (in particular, data concerning your health for performing AI skin analysis or online skincare analyzer. This may include information about your skin condition, pregnancy or breastfeeding status, uploaded photos, and analysis results) with your explicit consent (Article 9(2)(a)). 

You may withdraw your consent to the processing of your personal data at any time. 

Please remember that the withdrawal of consent does NOT automatically mean that the processing before the withdrawal is considered unlawful. You may withdraw consent to the processing of your personal data by sending us an email at [email protected] or by contacting us in any other way convenient for you. 

Article 6.1(f)): legitimate interest 

We process your personal data to protect our legitimate interests, such as: 

  • preventing fraud, 

  • ensuring the security of our Website, and 

  • ensuring the functionality of our Website. 

We only collect and use the strictly necessary data to achieve these purposes and do not override your fundamental rights and freedoms.

Article 6.1(b): performance of a contract 

When you provide us with personal data to purchase the products on our Website, manage your subscription, or submit recurring orders, this can be considered as a request to form a contract or to perform a contract between you and us. However, we may ask you for clear consent in case of doubt.

Article 6.1(c): legal obligation: 

We process your personal data to fulfill our legal obligations, such as complying with tax or regulatory requirements. In case you send us a request to exercise your rights under the GDPR, we may ask you for some personal data we already have to identify you and achieve compliance with the applicable law.

USE OF YOUR PERSONAL DATA

When acting as a data controller, we use your personal data for the purposes listed in the table below, where we also detail the type of personal data processed and the legal bases we rely on to do so.

Purpose of processing

Type of personal data

Legal grounds

Third parties recipients

Source

Creating an account on the Website

(d) Customer Information 

Performance of a contract (Article 6(1)(b))

Google OAuth, Microsoft OAuth, Apple OAuth, Mailgun, Google ReCaptcha, ABM Loyalty, Zoho CRM, eSputnik, Google Postgres-Google Cloud SQL

customer

Maintenance of the account on the Website

(d) Customer Information 

Performance of a contract (Article 6(1)(b))

ABM Loyalty, Zoho CRM, Mailgun, eSputnik, Google OAuth, Microsoft OAuth, Apple OAuth, Google ReCaptcha

customer

Provision of services and maintaining of the loyalty program

(d) Customer Information 

(hg) Online Skincare Analyzer Information

(e) Transactions and Payment Information

Performance of a contract (Article 6(1)(b))


Zoho CRM, Valdo, James and James, NovaPoshta, ABM Loyalty, eSputnik, USPS, our warehouse, carriers, forwarders, and customs brokers

customer



Processing of payments

(e) Transactions and Payment Information

(f) Subscription and Recurring Payment Information

Performance of a contract (Article 6(1)(b))


WayForPay, PayPal, Stripe (+Klarna), Foloosi 

customer

WayForPay PayPal

Stripe (+Klarna)

Foloosi 

Managing subscriptions

(d) Customer Information

(f) Subscription and Recurring Payment Information

Performance of a contract (Article 6(1)(b))

Stripe, Zoho CRM, ABM Loyalty

customer

Stripe

Performance of AI skin analysis

(ih) AI skin analysis data

Your consent (Article 6(1)(a)) 

Explicit consent (Article 9.1(a))

Google Cloud Storage, Google Pub/Sub, Google ReCaptcha 

AI skin analysis user

Communication with customers and website visitors (including responding to queries and requests, customer support, investigating complaints and assisting with product selection, sending transactional notifications and other service-related communications)

(a) Contact Information

(d) Customer Information 

(f) Subscription and Recurring Payment Information

Your consent (Article 6(1)(a)) 


Performance of a contract (Article 6(1)(b))

eSputnik, Mailgun, Zoho CRM, ABM Loyalty, Google Cloud SQL, Instagram, Facebook, WhatsApp

website visitor 

customer

Analytics & Developing & Maintenance of the Website

(a) Contact Information

(b) Cookies Information 

(c) Automatically Collected Information 

(d) Customer Information

f) Subscription and Recurring Payment Information

Your consent (Article 6(1)(a)) 


Our legitimate interest (Article 6(1)(f))

Google Analytics, BigQuery, Sentry, Google Tag Manager, Google Search Console, Cloudflare, CookieHub, Google CDN, Hotjar, Power BI



website visitor 

customer


Marketing activities (including newsletters, promotional, marketing SMS messages, administration of the SMS Program, sending marketing SMS)

(a) Contact Information

(b) Cookies Information 

(d) Customer Information

(g) SMS Communication Information

Your consent (Article 6(1)(a))

Google Ads, Meta, eSputnik, Twilio

website visitor 

сustomer

Reviews management

(a) Contact Information (namely, name, email, review and rating)

Your consent (Article 6(1)(a))

Google Cloud SQL, Google Cloud Storage 

website visitor 

customer

Security and fraud prevention

(b) Cookies Information 

(c) Automatically Collected Information 

(d) Customer Information

(e) Transactions and Payment Information

(f) Subscription and Recurring Payment Information

Our legitimate interest (Article 6(1)(f))

Cloudflare,

Google ReCaptcha, Sentry, CookieHub, Google Cloud Console, Stripe 

website visitor 

customer

Complying with the law or legal process 

(a) Contact Information

(b) Cookies Information 

(d) Customer Information

(e) Transactions and Payment Information

(f) Subscription and Recurring Payment Information

(g) SMS Communication Information

Legal obligation (Article 6(1)(c))

Hotjar, 

CookieHub, Twilio

website visitor 

customer

AI skin analysis

Applying for AI skin analysis, you voluntarily share with us data concerning your health, in particular information about your skin sensitivity, pregnancy or breastfeeding. Based on this information and your photos, we obtain the results of your skin analysis and share it and a personalised skincare routine program with you.

According to Article 9 of the GDPR, data concerning health is a special category of data, and its processing is allowed under certain conditions. For this reason, we obtain your explicit consent for this processing.

You may withdraw your consent anytime by submitting a request at [email protected]. 

We retain relevant data only for the purpose of providing you with this service. All data provided in the request for AI skin analysis is deleted one year after the analysis results are delivered to you or earlier upon your request. You may submit a request for erasure of this data anytime at [email protected]. 

For the use of the service, you must confirm that you are at least 18 years old.

Please note that this service does not provide medical advice, diagnosis, or treatment. Recommendations are cosmetic in nature and should not be considered a substitute for professional medical advice. 

Our AI skin analysis tool qualifies as an “AI System” under the AI Act. We therefore provide the following mandatory information:

  • The AI tool used for skin analysis performs automated pattern recognition on images you voluntarily upload.

  • The tool does not perform biometric identification or categorisation, and it is not used to make medical or legal decisions.

  • Human oversight is ensured at all times: our specialists may review the AI recommendations, and you may request a manual review at any time.

  • The output is advisory only and intended exclusively for cosmetic guidance, not diagnosis.

  • You have the right to opt out of AI processing and request a non-AI alternative (manual review or general product recommendations).

  • You will always be clearly informed when interacting with an AI system, and you may refuse to submit photos or health-related data.

For data generated through your interaction with our AI skin analysis service, we apply the principles of the Data Act:

  • You may request access to all data you provided as well as system-generated data resulting from the AI analysis.

  • Upon your request, this data can be transmitted to another company or service provider in a structured, commonly used, and machine-readable format.

  • We do not share system-generated AI analysis data with third parties except where necessary to provide the service or with your explicit consent.

  • We do not use your data for training AI models without your explicit, informed consent where required.

We do not use your personal data (including uploaded photos or health-related information) to train, refine, or improve AI models unless you provide separate explicit consent.

Training always uses either synthetic data, anonymised datasets, or data for which explicit training consent was obtained.

The AI system provides advisory cosmetic recommendations only. These recommendations are not binding, and no decision producing legal or similarly significant effects is made solely on the basis of automated processing.


DATA SHARING AND DISCLOSURE 

We may share your personal data as a data controller with joint controllers, other controllers, and data processors in accordance with the provisions specified hereafter.

Sharing personal data with joint controllers (other controllers)

We act as the joint controller while cooperating with Facebook (Meta Platforms Ireland Limited), for example, when using Facebook Pixel. With respect to this case of personal data processing, we are the party to the Facebook Controller Addendum.

Google LLC and we act as independent controllers of personal data across Google LLC’s digital marketing services, such as Google Ads. To learn more, please visit our Cookies Policy.

When we act as a joint controller for a particular processing of personal data, a data subject may exercise his/her rights under the GDPR in respect of and against both joint controllers.

Sharing personal data with data processors

We may disclose your personal data to data processors who perform services on our behalf based on our instructions (“service providers”) insofar as reasonably necessary for managing risks, obtaining professional advice, and providing services.

We may share your delivery address and telephone number with our warehouse, carriers, forwarders, customs brokers, and shipping service providers to complete, fulfill, manage, and communicate with you about your orders.

Also, we may share and disclose your personal data to other service providers:

  • Google Ireland Limited (Ireland) – including Google Cloud SQL, Google Cloud Storage, Google Pub/Sub, Google CDN, BigQuery, Google Analytics, Google Tag Manager, Google Search Console, Google Ads, Google OAuth, and Google reCAPTCHA. You may read its privacy policy here;

  • Microsoft Ireland Operations Limited (Ireland) – Microsoft OAuth authentication services and Microsoft Power BI business intelligence services. You may read its privacy policy here;

  • Apple Inc. (USA) – Apple Sign-In (OAuth) authentication services. You may read its privacy policy here;

  • Apple Payments Inc. (USA) – Apple Pay payment services. You may read its privacy policy here;

  • Zoho Corporation B.V. (Netherlands) – Zoho CRM customer relationship management services. You may read its privacy policy here;

  • Mailgun Technologies, Inc. (USA) – transactional and service-related email delivery. You may read its privacy policy here;

  • LLC “ESPUTNYK” (Ukraine) – eSputnik marketing automation and email marketing services. You may read its privacy policy here;

  • Twilio Inc. (USA) – messaging services provider for the administration of our SMS Program, delivery of marketing, transactional, and informational SMS communications (where applicable), and other services necessary to operate our SMS Program. You may read its privacy policy here;

  • Meta Platforms Ireland Ltd. (Ireland) – Facebook and Instagram advertising and social media integration services. You may read its privacy policy here;

  • WhatsApp Ireland Limited (Ireland) – customer communication services. You may read its privacy policy here;

  • WayForPay LLC (Ukraine) – online payment processing services. You may read its privacy policy here;

  • Stripe Payments Europe Ltd. (Ireland) – online payment processing services. You may read its privacy policy here;

  • Klarna Bank AB (Sweden) – payment processing services. You may read its privacy policy here.

  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – payment processing services. You may read its privacy policy here;

  • Foloosi Payment Services (UAE) – online payment processing services. You may read its privacy policy here;

  • Nova Poshta LLC (Ukraine) – shipping and delivery services. You may read its privacy policy here;

  • United States Postal Service (USPS) (USA) – delivery and shipping services, including Express, Standard, and Free Shipping delivery methods, where applicable;. You may read its privacy policy here;

  • Impact Tech, Inc. (US) – affiliate marketing tracking. You may read its privacy policy here;

  • Sentry (Functional Software, Inc., USA) – application monitoring and error tracking services. You may read its privacy policy here;

  • Hotjar Ltd. (Malta) – website analytics and user behaviour analysis services. You may read its privacy policy here;

  • CookieHub ehf. (Iceland) – cookie consent management services. You may read its privacy policy here;

  • Cloudflare, Inc. (USA) – content delivery network (CDN) and website security services. You may read its privacy policy here;

  • External carriers, freight forwarders, and customs brokers – logistics and customs clearance services, where applicable.

Links to Third-Party Websites

This Privacy Policy is applicable only to this Website but not any other sites, therefore, we strongly recommend reviewing the privacy policies of any websites that you may reach by following hyperlinks presented on this Website. We have no control over the content and practices of other websites, and therefore, we are not responsible for any actions or policies of third-party websites.


We do not make your personal data available for “data altruism” or re-use by public bodies under the Data Governance Act unless you provide explicit authorisation through a separate consent form.

DATA TRANSFER TO THIRD COUNTRIES 

We may transfer your personal data to countries outside the European Union (EU) and the European Economic Area (EEA) that are not deemed to provide an adequate level of data protection under Article 45 of the GDPR (adequacy decision). 

In such cases, we will ensure that appropriate safeguards are implemented in accordance with the GDPR to protect your personal data, in particular, the standard contractual clauses adopted by the European Commission. When we transfer your personal data to third parties, we always comply with the requirements of the GDPR. Where possible, we always enter into Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) with these third parties to ensure that your personal data is adequately protected.

We put supplementary technical and organizational measures in place when transferring data outside the EU and the EEA. e.g., prior assessment of the service supplier’s reliability and personal data protection practices, encryption of the transferred personal data, prompt reacting to any threats to confidentiality, integrity, and availability of the personal data, conducting transfer impact assessments (TIA) when necessary, etc.

When transferring personal data outside the EU/EEA, we:

  • Conduct a Transfer Impact Assessment (TIA) following EDPB Recommendations 01/2020;

  • Apply supplementary encryption and pseudonymisation measures to reduce the identifiability of data;

  • Contractually require third-country recipients to notify us of any government access requests and challenge them when legally permissible.

DATA RETENTION

As a data controller, we store and process your personal data until we do not need it for any of the purposes defined in this Privacy Policy, unless a longer retention period is required or expressly permitted by law. We may not delete or anonymize your data if we are required to retain it to comply with the law or legal process.

Regarding data stored in the customer's account, we will delete your personal data if you request deletion of the account or if the account is inactive for 3 years from the time of the last order.

When you enroll in our SMS Program or subscribe to receive marketing SMS communications, we may retain records relating to your consent, opt-out requests, and other compliance-related records for the period required to comply with applicable legal and regulatory requirements.

You may request us to delete your personal data by using this link: I would like to delete all my personal data. 

Additionally, you may send us an email to [email protected] or contact us in any other way that is convenient for you.

YOUR RIGHTS UNDER THE GDPR 

In this Section, we have summarised the rights that you have under the GDPR. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

You may exercise the following rights by submitting a data subject request at  [email protected] 

Please note that we may need to confirm your identity to process your requests to exercise your rights under the GDPR. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

Right under the GDPR

Description 

How to exercise it

Right to be informed 

(Art. 13, 14)

You, as a data subject, have the right to be informed about the

collection and use of your personal data.

All information about our collection and use of your personal data is available in this Privacy Policy, the Cookies Policy, and the Terms & Conditions.

Right of Access

(Art. 15)

You have the right to confirm whether your personal data is being processed by us and access such data, along with specific information. 

You can submit a request.

Right to rectification

(Art. 16)

You have the right to correct inaccurate personal data about you. Also, you have the right to have incomplete personal data completed.

You can submit a request.

Right to erasure (‘right to be forgotten’)

(Art.17)

You have the right to have your

personal data deleted without undue delay where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 

  • you withdraw consent to consent-based processing; 

  • you object to the processing under certain rules of applicable data protection law;

  • the personal data have to be erased for compliance with a legal obligation in the European Union or an EU Member State law;

  • the personal data have been collected in relation to the offer of information society services referred to in Article 8(1);

  • the personal data have been unlawfully processed.

You can submit a request, including via a dedicated form:

I would like to delete all my personal data. 

Right to restriction of processing

(Art. 18)

You can limit the way in which we use your data where one of the following applies:

  • you contest the accuracy of the personal data;

  • processing is unlawful, but you oppose erasure;

  • we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise, or defense of legal claims;

  • you have objected to processing, pending the verification of that objection.

You can submit a request.


Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it:

  • with your consent;

  • for the establishment, exercise, or defense of legal claims;

  • for the protection of the rights of another natural or legal person; 

  • or for reasons of important public interest.

Right to data portability

(Art. 20)

You have the right to receive your personal data in a structured, commonly accepted, and machine-readable format and have the right to request that we transmit this data directly to another controller to the extent that the legal basis for our processing of your personal data is your consent or performance of a contract and the processing is carried out by automated means.

You can submit a request.

Right to object

(Art. 21)

You have the right to object to our processing of your personal data at any time to the extent that the processing is based on point (e) or (f) of Article 6(1), including profiling based on those provisions.


Also, you have the right to object to our processing of your personal data for direct marketing purposes (including profiling).

You can submit a request.

Right not to be subject to a decision based solely on automated processing, including profiling 

(Art. 22)

This right restricts us from making solely automated decisions, including those based on profiling, which produce legal or other significant effects for data subjects.

We DO NOT use automated decision-making and profiling.

Right to withdraw consent

(Art. 7)

You can withdraw your consent at any time.

You can submit a request.

Right to lodge a complaint 

(Art. 77)

You have the right to lodge a

complaint with the supervisory authority if you believe that the processing of your personal data violates the requirements of the GDPR.

You can submit the complaint in the EU member state of your place of habitual residence or to the data protection authority stated in this Privacy Policy. 

Right to compensation 

(Art. 82)

Any person who has suffered material or moral damage as a result of a violation of GDPR requirements has the right to receive compensation from the controller or processor for the caused damage.

Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the EU Member State referred to in Article 79(2).

DATA PROTECTION AUTHORITY UNDER THE GDPR

We kindly invite you to share your concerns with us in the first place regarding any issue related to your personal data processing. You may use the following channel to address your inquiries: [email protected]

In some cases, you have the right to lodge a complaint about our use of your personal data with a data protection authority. For more information, please contact your national data protection authority. We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved between you and us. You can find a full list of EU supervisory authorities through this link.

US PRIVACY LAWS AND REGULATIONS

Under the laws of certain U.S. states, you may be entitled to specific rights regarding the processing of your personal information. The table below provides general descriptions of the US residents' privacy rights established by: 

  • the California Consumer Privacy Act (the “CCPA”) amended with the California Privacy Rights Act (the “CPRA”));

  • the Virginia Consumer Data Protection Act (the “VCDPA”);

  • the Colorado Privacy Act (the “CPA”);

  • the Connecticut Data Privacy Act (the “CTDPA”);

  • the Utah Consumer Privacy Act (the “UCPA”);

  • the Texas Data Privacy And Security Act (the “TDPSA”);

  • the Florida Digital Bill of Rights (the “FDBR”);

  • the Oregon Consumer Privacy Act (the “OCPA”);

  • the Montana Consumer Data Protection Act (the “MTCDPA”);

  • the Nebraska Data Privacy Act (the “NDPA”);

  • the Iowa Consumer Data Protection Act (the “ICDPA”);

  • the Delaware Personal Data Privacy Act (the “DPDPA”);

  • the New Hampshire Privacy Act (the “NHPA”);

  • the New Jersey Data Protection Act (the “NJDPA”);

  • the Tennessee Information Protection Act (the “TIPA”);

  • the Minnesota Consumer Data Privacy Act (the “MCDPA”);

  • the Maryland Online Data Privacy Act (the “MODPA”);

  • the Indiana Consumer Data Protection Act (the “INCDPA”);

  • the Kentucky Consumer Data Protection Act (the “KCDPA”);

  • the Rhode Island Data Transparency and Privacy Protection Act (the “RIDTPPA”).

Please note some states do not have their own privacy laws. The rights of residents of such states are governed by U.S. federal law. 

The terms used in this section of the Policy are taken from the GDPR, considering the definitions established in the US privacy laws and regulations.

You may exercise the following rights by submitting a request at [email protected]. Where applicable, you may also exercise certain choices relating to marketing SMS communications by replying STOP to any marketing text message, as described in our SMS Terms.

Please note that we may need to confirm your identity to process your requests to exercise your rights. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

Right

Description 

US laws

Right to know 

You can request information about what personal information we collect about you and how it is used and shared. 

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to access

You can request access to the collected personal information.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to correct

You can request us to correct the inaccurate personal information about you.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to delete

You can request us to delete your personal information, subject to applicable legal exceptions.


The scope of this right may vary by state:

1. Personal information collected from or provided by you: in some states, this right applies to personal information collected from you or provided by you.

2. Broader deletion right: in other states, this right may apply more broadly to personal information obtained about, concerning, or otherwise relating to you.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to data portability

You can request obtaining a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to opt out of sale

You can request opting out of the processing of personal data for the sale of personal information. 


We neither sell your personal information to anyone nor use your data as a business model.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to opt out of sharing

You may request to stop sharing your personal information.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to opt out of targeting advertisements

You can request opting out of the processing of personal data for targeted advertising.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to opt out of profiling

You can request opting out of the processing of personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to limit the use and disclosure of sensitive personal information 

This right allows you to limit the use and disclosure of your sensitive personal information by the company. 

California (CCPA/CPRA)

Right to non-discrimination

Right to be free from discrimination relating to the exercise of any of your privacy rights.

California (CCPA/CPRA)

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Utah (UCPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to appeal

If we refuse to take action on your privacy request, you may have the right to ask us to review our decision. This is an internal appeal process. If we refuse to take action on your privacy request, you may have the right to ask us to review our decision. If your appeal is denied, where required by applicable law, we will provide you with information on how to contact the relevant Attorney General or regulator to submit a complaint. This is an internal appeal process and is different from a private court claim.

Virginia (VCDPA)

Colorado (CPA)

Connecticut (CTDPA)

Texas (TDPSA)

Florida (FDBR)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Iowa (ICDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Tennessee (TIPA)

Minnesota (MCDPA)

Maryland (MODPA)

Indiana (INCDPA)

Kentucky (KCDPA)

Rhode Island (RIDTPPA)

Right to initiate a private cause of action for certain data breaches

In limited circumstances, California residents may bring a court claim if certain personal information is subject to unauthorized access, theft, exfiltration, or disclosure as a result of a business’s failure to maintain reasonable security. This is different from an appeal and applies mainly to certain data breach/security incidents.

California (CCPA/CPRA)

ADMT (Automated Decisionmaking Technology) appeal right

Where applicable, California residents may have appeal-related rights in connection with certain uses of automated decision-making technology (ADMT), especially where ADMT is used for significant decisions. This is narrower than a general right to appeal any refusal to act on a privacy request.

California (CCPA/CPRA)

Right to use an authorized agent

You may have the right to designate an authorized agent to exercise certain privacy rights on your behalf, subject to verification and other applicable requirements.

California (CCPA/CPRA)

Colorado (CPA)

Connecticut (CTDPA)

Texas (TDPSA)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Minnesota (MCDPA)

Maryland (MODPA)

Rhode Island (RIDTPPA)

Right to opt out through opt-out preference signals

Where required by applicable law, we will recognize legally required opt-out preference signals, such as universal opt-out mechanisms, for applicable opt-out rights.

California (CCPA/CPRA)

Colorado (CPA)

Connecticut (CTDPA)

Texas (TDPSA)

Oregon (OCPA)

Montana (MTCDPA)

Nebraska (NDPA)

Delaware (DPDPA)

New Hampshire (NHPA)

New Jersey (NJDPA)

Minnesota (MCDPA)

Maryland (MODPA)

Right to obtain information about third-party disclosures

You may request information about the third parties or categories of third parties to whom we disclose personal information, where required by applicable law.

Connecticut (CTDPA)

Oregon (OCPA)

Minnesota (MCDPA)

Maryland (MODPA)

You can find a detailed description of the personal information that we may collect from you above in the “DATA COLLECTION” section of this Policy. 

The purposes of the collection and/or use of personal information are stated in the “USE OF YOUR PERSONAL DATA” section of this Policy.

DATA SUBJECT AGE 

We undertake the best possible efforts to secure the processing of personal data belonging to underage. 

Generally, we do not knowingly collect personal data from persons under 16. By submitting your personal data to us, you acknowledge that you have reached the age of 16, and under the laws of your country of residence, you have all rights to provide us with your personal data for processing. If you have any reason to believe that a child under 16 has provided his/her personal data to us, please contact us at [email protected].

For the purpose of AI skin analysis, we DO NOT collect personal data from persons under 18.

SECURITY AND INTEGRITY OF THE DATA

Protecting the information you give us or that we receive about you is our priority. 

We have implemented appropriate organizational, technical, administrative, and physical security measures to ensure the ongoing confidentiality, integrity, availability, and resiliency of systems and services that process personal information and will restore the availability and access to information in case of a physical or technical incident on time.

In particular, the database is located on a private network segment. Moreover,  we have implemented TLS 1.3 (Transport Layer Security) and use Cloudflare to protect the Website's security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify:

  • the competent supervisory authority within 72 hours, and

  • you without undue delay when the breach is likely to result in a high risk.

COMPLAINTS

If you have complaints about how we process your personal data, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live, you may have the right to appeal our decision by contacting us using the contact details set out below or lodge your complaint with your local data protection authority.

Because we offer services to individuals in the EU, we have appointed an EU representative pursuant to Article 27 GDPR:

(name, address, email)

If, based on the nature and scale of processing (including AI skin analysis), we meet the criteria of Art. 37 GDPR, we will appoint a Data Protection Officer. Updated contact details will be included here and in the imprint.

AMENDMENTS

We may update this Privacy Policy from time to time due to the implementation of new updates, technologies, law requirements, or for other purposes by publishing a new version on our Website.

Such change(s) will be effective immediately upon posting the change or modification on this Website. We encourage you to review this Privacy Policy to check for any changes regularly. 

If the modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change. For example, we may send you an email or generate a pop-up or similar notification when you access the Website for the first time after such material changes are made or provide you with information in any other way. Your continued use of our Website after the revised Privacy Policy has become effective constitutes your acceptance of the new terms of the Privacy Policy. 


HOW TO CONTACT US

For questions regarding the processing of your personal data, please contact us:

INSTYTUTUM AG, 

Our address: Gubelstrasse 12, 6300 Zug, Switzerland; 

Our telephone: +41 41 511 20 50; 

Our email: [email protected]. 

We always welcome and greatly appreciate your feedback, any comments, or suggestions that may contribute to a better quality of our work.

Thank you for choosing INSTYTUTUM AG!