EU/EEA Privacy Supplement
Item Details
Controller: Island Organics Limited, trading as Skin Shop
Registered office: Innovations House, 19 Staple Gardens, Winchester, Hampshire, SO23 8SR, United Kingdom
EU representative: SKINSHOP EU, 6 Ferm Road, Dublin, D18 FP98, IE
Effective date: 8 September 2026
1. Scope and relationship with the Global Privacy Policy
This EU/EEA Privacy Supplement applies if you are in the European Economic Area (EEA) when you interact with Skin Shop, including when you visit www.skinshop.co.uk, purchase products, create an account, join a loyalty or subscription service, contact Customer Support or submit a product-safety enquiry.
It supplements the Skin Shop Global Privacy Policy. The Global Privacy Policy explains the categories of personal data we collect, our purposes, recipients, security measures and general retention approach. If this Supplement conflicts with the Global Privacy Policy, this Supplement applies to the extent required by the EU General Data Protection Regulation (EU GDPR) or other mandatory EEA law.
2. Controller and EU representative
Island Organics Limited is the controller of the personal data described in this Supplement unless another organisation is identified as an independent or joint controller.
Because Island Organics Limited is established in the United Kingdom and offers products to individuals in the EEA, it will publish the details of its formally appointed representative in the European Union under Article 27 EU GDPR in the table above. Individuals and supervisory authorities may contact that representative about EU GDPR matters in addition to contacting Island Organics Limited directly.
3. Lawful bases
The lawful basis depends on the purpose. We rely on the following bases under Article 6 EU GDPR:
Orders, delivery, accounts, returns and subscriptions
Performance of a contract; steps requested before entering into a contract.
Tax, accounting, product-safety and regulatory records
Compliance with a legal obligation.
Customer support, fraud prevention, security, service improvement and legal claims
Our legitimate interests or those of a third party, after balancing those interests against your rights.
Email/SMS marketing and non-essential cookies
Consent where required by ePrivacy rules; legitimate interests only where the law permits, including an applicable existing-customer exception.
Competitions, surveys and voluntary content
Contract, legitimate interests or consent, depending on the activity and notice provided.
Where consent is the basis, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you may request information about our balancing assessment.
4. Health information and product-safety enquiries
Information you voluntarily provide about skin conditions, allergies, pregnancy, medication, symptoms or suspected adverse reactions may be data concerning health and therefore special category data under Article 9 EU GDPR.
We process such information only where an Article 6 lawful basis and an Article 9 condition apply. Depending on the circumstances, the relevant Article 9 condition may include your explicit consent, processing necessary for reasons of public interest in product safety under applicable law, or processing necessary to establish, exercise or defend legal claims. We collect only information reasonably necessary for the enquiry, safety investigation, legal duty or claim.
We do not use health or skin-condition information for targeted advertising, advertising audiences or general-purpose AI training unless a separate, specific and valid explicit consent has been obtained. A refund request does not require you to provide unnecessary medical details.
5. Recipients and independent controllers
The categories of recipients are described in the Global Privacy Policy and may include Shopify and approved apps, payment providers, fulfilment and delivery providers, Freshdesk, LoyaltyLion, analytics and advertising providers, professional advisers and public authorities.
Some marketplaces, payment services and social platforms process data for their own purposes as independent controllers. Their privacy notices also apply.
6. Transfers outside the EEA
Personal data may be transferred from the EEA to the United Kingdom, United States and other countries where our providers operate. We rely on an applicable European Commission adequacy decision where available.
For transfers not covered by adequacy, we use an approved mechanism such as the European Commission's Standard Contractual Clauses and, where required, assess the legal environment and apply supplementary technical, contractual or organisational safeguards.
For a transfer to a US organisation under the EU-US Data Privacy Framework, we verify that the organisation has an active certification covering the relevant data. If it does not, another valid transfer mechanism is required.
You may request information about the applicable safeguard and how to obtain a copy, subject to necessary security and confidentiality redactions.
7. Retention
The Global Privacy Policy states our usual retention periods. We keep personal data no longer than necessary for the stated purpose, legal and accounting duties, product-safety monitoring, complaint handling and legal claims.
When a period expires, data is deleted or irreversibly anonymised unless a lawful reason requires further retention.
8. Your EEA rights
Subject to the conditions and exceptions in the EU GDPR, you may have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- request erasure;
- restrict processing;
- object to processing based on legitimate interests;
- object at any time to direct marketing, including related profiling;
- receive eligible data in a structured, commonly used and machine-readable format and transmit it to another controller;
- withdraw consent at any time; and
- obtain safeguards concerning qualifying solely automated decisions that have legal or similarly significant effects.
Right to object: You have an absolute right to object to the use of your personal data for direct marketing. If you object, we will stop that processing.
9. How to exercise rights
Submit a request through https://support.skinshop.co.uk and mark it "EU Privacy Request", or contact the EU representative once its details are published.
We may request information reasonably necessary to verify identity. Requests are normally free of charge and answered without undue delay and within one month, subject to a permitted extension for complex or numerous requests.
10. Complaints
You may complain to the data protection authority in the EEA country where you habitually live, work or believe an infringement occurred.
Contact details for EEA supervisory authorities are available through the European Data Protection Board.
You may also contact our EU representative or Privacy Team first so that we can investigate, but this does not limit your right to contact a supervisory authority.
11. Cookies and electronic marketing
Strictly necessary technologies may operate without consent where permitted.
Analytics, advertising and other non-essential technologies are activated only after the consent required by applicable EEA ePrivacy law.
You can change choices through the cookie preference centre.
Marketing messages identify Skin Shop and include a simple method to withdraw consent or object.
12. Changes
We may update this Supplement when laws, services or processing change.
We will publish the revised effective date and provide a prominent notice or obtain consent where required for a material change.
