Privacy policy

Item Details

Controller
Island Organics Limited, trading as Skin Shop

Registered office
Innovations House, 19 Staple Gardens, Winchester, Hampshire, SO23 8SR, United Kingdom

Company details
Company No. 08920980 | VAT No. GB182970087

Effective date
11 August 2026

1. About this Privacy Policy

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how Island Organics Limited, trading as Skin Shop, collects, uses, shares and protects personal information when you visit or purchase from www.skinshop.co.uk, create an account, join our loyalty or subscription services, contact us, submit a review, enter a promotion or otherwise interact with us.

For UK data protection law, Island Organics Limited is the controller of the personal information described in this notice unless we explain otherwise. This notice should be read with our Cookie Policy and Website Terms, Cancellation & Returns Policy.

2. How to contact us

Privacy enquiries and rights requests: Submit a ticket at https://support.skinshop.co.uk and mark it 'Privacy'

Post: Privacy Team, Island Organics Limited, Innovations House, 19 Staple Gardens, Winchester, Hampshire, SO23 8SR, United Kingdom.

Please do not send product returns to the registered office. We may ask for information reasonably necessary to confirm your identity before acting on a data protection request.

3. Personal information we collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Identity and contact information, such as your name, title, billing and delivery addresses, email address and telephone number.
• Account information, including your login details, saved preferences, wish lists, loyalty membership, points and subscription settings.
• Order and transaction information, including products purchased, order history, refunds, discounts, delivery status and payment status. Payment card details are handled by our payment providers; we normally receive confirmation and limited transaction information rather than your full card number.
• Customer-service information, including messages, call or ticket records, returns, complaints, photographs and information you choose to provide when asking for product guidance.
• Product-safety and health-related information you voluntarily provide, such as allergies, skin conditions, pregnancy, medication history, symptoms or a suspected adverse reaction. This may be special category data and receives additional protection.
• Marketing and preference information, including newsletter choices, promotion participation, product interests and responses to campaigns.
• Reviews, survey responses, competition entries, comments, images or other content you submit.
• Technical and usage information, such as IP address, cookie identifiers, device and browser type, operating system, approximate location, pages viewed, referral source and interactions with our website and marketing.
• Fraud-prevention and security information, including risk indicators, failed payments and activity needed to protect customers and our services.
• Information from third parties, such as Shopify and its apps, payment providers, delivery partners, marketplaces, social-media or advertising platforms, analytics providers, referral partners and publicly available sources, where lawful.

Please do not provide health information unless it is relevant to your enquiry. The website and our products are intended for adults; we do not knowingly collect personal information directly from children for customer accounts or marketing.

4. How we collect personal information

• Directly from you when you place an order, create an account, subscribe, contact us, submit a return or safety report, complete a form, review or survey, or enter a competition.
• Automatically when you use the website, subject to your cookie choices and applicable law.
• From service providers and commercial partners that help complete transactions, deliver orders, operate rewards or subscriptions, prevent fraud, provide support, measure campaigns or run our online services.
• From marketplaces and social platforms where you interact with Skin Shop or buy through a Skin Shop marketplace channel. Those services may also act as independent controllers under their own privacy notices.

5. Why we use your information and our lawful bases

We only use personal information where we have a valid reason under data protection law. The principal purposes and lawful bases are set out below.

Orders and delivery
What we do: Process orders, payments, delivery, returns, refunds and subscriptions.
Lawful basis: Contract; legal obligation.

Accounts, rewards and subscriptions
What we do: Create and manage accounts, loyalty points, preferences and recurring orders.
Lawful basis: Contract; legitimate interests in administering customer services.

Customer support
What we do: Answer questions, handle complaints and keep a record of our response.
Lawful basis: Contract; legitimate interests in service quality and dispute management; legal obligation where applicable.

Product safety and reactions
What we do: Assess and document suspected adverse reactions, escalate safety concerns, investigate quality issues and comply with cosmetic/product-safety duties.
Lawful basis: Legal obligation; legitimate interests in product safety. For health data: explicit consent and/or a condition permitted by UK data protection law, depending on the circumstances.

Fraud and security
What we do: Authenticate users, protect accounts, prevent fraud, secure transactions and enforce our terms.
Lawful basis: Legitimate interests; legal obligation.

Service improvement
What we do: Analyse performance, troubleshoot, develop products and improve the website and customer experience.
Lawful basis: Legitimate interests; consent where required for cookies or similar technologies.

Direct marketing
What we do: Send newsletters, offers and product news; measure and personalise campaigns.
Lawful basis: Consent where required by PECR; otherwise legitimate interests where the law permits, including the customer soft opt-in. Cookie consent for advertising technologies where required.

Reviews, surveys and promotions
What we do: Publish reviews, conduct research, administer competitions and prevent abuse.
Lawful basis: Consent where appropriate; contract for promotion terms; legitimate interests.

Legal and corporate matters
What we do: Maintain records, meet tax/accounting obligations, establish or defend claims, respond to authorities and support a sale or restructuring.
Lawful basis: Legal obligation; legitimate interests.

Where we rely on legitimate interests, we consider whether the use is necessary, proportionate and balanced against your rights. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out lawfully.

6. Health information and suspected adverse reactions

Information about your health, skin condition, allergies, pregnancy, medication or symptoms is special category data. We collect it only when you choose to provide it and it is relevant to product guidance, a safety report, a complaint or a return. We limit access and use it only for the stated purpose, product-safety monitoring, quality investigation, legal compliance and the establishment or defence of legal claims where applicable.

We do not use health or skin-condition information to target advertising or infer sensitive marketing segments unless we have obtained valid explicit consent for that specific use. You may ask us to handle a return without giving unnecessary medical detail; however, we may need limited information to investigate a safety concern or comply with legal duties.

7. Marketing and your right to object

We may send electronic marketing where you have consented or where the law permits us to use the existing-customer 'soft opt-in' for similar products and services. Every marketing email will provide an unsubscribe option. You can also update preferences through your account or contact us.

YOUR RIGHT TO OBJECT TO DIRECT MARKETING: You can object at any time. We will stop using your personal information for direct marketing. We may keep minimal details on a suppression list so that we can respect your choice and avoid contacting you again.

Unsubscribing from marketing does not stop service messages needed for orders, subscriptions, safety notices, account security or other non-marketing purposes.

8. Cookies, analytics and online advertising

Our Shopify website and approved partners may use cookies, pixels, tags, local storage and similar technologies. Strictly necessary technologies support functions such as checkout, security, account access and cookie preferences. With your consent where required, we may also use functional, analytics and advertising technologies.

Non-essential cookies and similar technologies will not be placed or accessed before the required consent is obtained. You can accept, reject or change choices through the cookie banner or preference centre. Withdrawing consent does not affect prior lawful processing. Our separate Cookie Policy should identify the technologies in use, providers, purposes and durations.

9. Who we share information with

We share only what is reasonably necessary with the following categories of recipients:

• E-commerce and hosting providers, including Shopify and approved Shopify applications.
• Payment, banking, fraud-prevention and authentication providers selected at checkout.
• Warehousing, fulfilment and delivery partners, including ShipBob where used, Royal Mail, DPD and international carriers.
• Customer-service providers, including Freshdesk, and communications providers that route customer messages.
• Loyalty and subscription providers, including LoyaltyLion and any approved subscription application.
• Email, survey, review, analytics, advertising and social-media partners, such as Google and Meta, subject to cookie and marketing choices.
• Marketplaces and channel partners, including TikTok Shop and service partners supporting that channel, where you use those services.
• Professional advisers, insurers, auditors, technology/security suppliers, regulators, courts, law-enforcement bodies and public authorities where lawful and necessary.

Some recipients, such as payment providers, marketplaces and social-media platforms, may act as independent controllers for their own purposes. Their privacy notices also apply to their processing.

10. International transfers

Some providers or their support teams may process personal information outside the United Kingdom. Before making a restricted transfer, we use a mechanism recognised by UK law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. Where required, we carry out a transfer risk assessment and apply supplementary protections.

You may contact us for further information about the relevant safeguard and how to obtain a copy, subject to necessary redactions for confidentiality and security.

11. How long we keep information

We retain personal information only for as long as necessary for the purpose collected, including legal, accounting, safety and dispute requirements. Our usual periods or criteria are:

Orders, payments, refunds and tax records
Normally six years after the end of the relevant financial year, or longer where legally required or needed for a claim.

Customer account
While active, then normally up to two years after inactivity, unless transaction or legal records must be kept longer.

Customer-service and complaints
Normally three years after closure; longer if linked to a legal, safety or recurring quality matter.

Product-safety/adverse-reaction records
For the period required by applicable cosmetics and product-safety obligations and as needed to investigate, monitor trends or defend claims; this may be up to ten years or longer in specific cases.

Marketing records
Until consent is withdrawn, you object, or the data becomes inactive under our retention rules. Suppression records may be kept as long as necessary to respect an opt-out.

Cookie and analytics data
For the period stated in the Cookie Policy or preference centre, subject to consent and provider settings.

Competition and survey data
For the duration of the activity and a reasonable period afterwards for administration, audit and dispute handling.

We may retain information for longer where required by law, a regulator, litigation hold or an unresolved complaint. We may anonymise information so it no longer identifies you and use that anonymous information for statistics and business analysis.

12. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include access controls, encryption in transit, supplier checks, staff confidentiality and incident-management procedures. No internet service is completely secure, so please protect your account credentials and contact us promptly if you suspect unauthorised access.

13. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• access your personal information and receive a copy;
• correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests and object absolutely to direct marketing;
• receive certain information in a portable, machine-readable format and ask us to transfer it where technically feasible;
• withdraw consent at any time where processing is based on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where the law permits and safeguards apply.

Rights are not absolute and may not apply in every case. Requests are normally free of charge. We will respond without undue delay and usually within one calendar month after receiving the request and any information reasonably needed to verify identity. We will explain if an extension or lawful exemption applies.

14. Automated decisions and profiling

We may use limited profiling to understand customer interests, measure marketing and recommend products, subject to your marketing and cookie choices. We do not intend to make decisions based solely on automated processing that have legal or similarly significant effects on you. Fraud-prevention providers may produce automated risk indicators; where a significant decision is made, applicable rights and safeguards will be provided.

15. Data protection complaints

If you are concerned about how we use your personal information, please raise a complaint through https://support.skinshop.co.uk and mark it 'Privacy Complaint', or write to the Privacy Team at our registered office. Please explain what happened, the information involved and the outcome you are seeking.

We will acknowledge a data protection complaint within 30 days of receipt. Without undue delay, we will take appropriate steps to investigate, keep you informed and tell you the outcome. We will keep an appropriate record of the complaint and our response.

You may also complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. We would appreciate the opportunity to address your concern first, but this does not affect your right to contact the ICO.

16. Other websites and third-party services

Our website may link to third-party websites, platforms or services. We do not control their privacy practices. Please read their privacy notices before providing personal information. Where you purchase through a marketplace, both the marketplace's notice and this notice may apply to different parts of the transaction.

17. Changes to this Privacy Policy

We may update this policy to reflect changes in law, technology, suppliers or our services. We will publish the updated version and effective date on the website. If a change materially affects how we use personal information, we will provide a more prominent notice or seek consent where required.