Privacy policy

This privacy policy explains which personal data we process when you visit our webshop or order from us, why we do so, who we share data with and what rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR).

1. Who we are

The controller responsible for processing your data is:
Cosmetique Totale B.V.
Kuiperserf 9, 2461 CV Ter Aar, the Netherlands
Chamber of Commerce (KvK) number: 56135157
Email: webshop@cosmetique-totale.nl
Phone: +31 85 902 20 80

This privacy policy applies to the webshop webshop.cosmetique-totale.com. A separate privacy policy on cosmetique-totale.com applies to our clinics and treatments. We do not link data from the webshop to your clinic record.

2. What data we use and why

Your order

Name, delivery and billing address, email address, phone number, your order and the payment status. We use this data to process and deliver your order, keep you informed and handle returns and complaints. Legal basis: performance of the contract.

Your payment details (such as your bank account or credit card) are processed by the payment provider you choose. We only receive confirmation of whether the payment succeeded.

Your customer account

If you create an account, we store your name, email address, addresses, order history and any store credit, so that you can track your orders and use your credit. Legal basis: performance of the contract.

Contacting customer service

If you contact us by email, phone or a form, we use the information you give us to help you. If you tell us something about your skin, for example for product advice or after a skin reaction, we use it only to answer your question. Legal basis: performance of the contract or your consent.

Registering a return and withdrawal

If you register a return or use the withdrawal form, we process your name, contact details, order number and the reason for your return. Legal basis: performance of the contract and legal obligation.

Newsletter

If you sign up for our newsletter, we use your email address and name to send you offers, news and skin advice. We may tailor the content to your previous orders. You can unsubscribe at any time using the link at the bottom of every email. Legal basis: consent.

Back-in-stock alerts

If you request an alert for a sold-out product, we use your email address only to tell you when it is back in stock. Legal basis: consent.

Reviews

After your order we may ask you by email to write a review. If you post a review, we show your first name or the name you provide, your rating and your text in the webshop. Legal basis: legitimate interest (review invitation) and consent (publishing your review).

Website visits, cookies and advertising

When you visit the webshop, we process technical data such as your IP address, device, browser and how you use the webshop. We use necessary cookies to make the webshop work, for example for your basket. Only if you give consent via the cookie banner do we also use cookies for statistics (Google Analytics, Microsoft Clarity) and advertising (Google Ads, Meta). You can read which cookies these are in our cookie policy. Legal basis: legitimate interest (necessary cookies) and consent (other cookies).

Fraud prevention and accounting

We use data to prevent misuse and fraud and to meet our statutory accounting and retention obligations. Legal basis: legitimate interest and legal obligation.

3. Who we share data with

We never sell your data. We only share it with parties we need to provide our service. We have agreements with processors on the security and use of your data.

  • Shopify: the platform our webshop runs on (orders, customer accounts, emails about your order).
  • Mollie, Shopify Payments, PayPal and Klarna: payment processing. If you choose Klarna, Klarna may carry out a credit check; Klarna is responsible for this itself.
  • PostNL: delivery of your parcel and tracking.
  • Segundo: sending our newsletter and marketing emails.
  • Judge.me: review invitations and displaying reviews.
  • Apps that run the webshop: including back-in-stock alerts, forms (such as registering a return and withdrawal), the search function and gift promotions in your basket.
  • Google, Meta and Microsoft: statistics and advertising, only after your consent via the cookie banner.

Sometimes we are legally required to share data, for example with the Dutch Tax Administration.

4. Data outside Europe

Some partners, such as Shopify, Google, Meta, Microsoft and PayPal, may process data outside the European Economic Area. This only happens with appropriate safeguards, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

5. How long we keep data

  • Orders and invoices: 7 years, because of the statutory tax retention obligation.
  • Your customer account: until you ask us to delete it.
  • Correspondence with customer service: up to 2 years after it has been dealt with.
  • Newsletter and stock alerts: until you unsubscribe.
  • Cookies: as stated in the cookie policy.

6. Security

We take appropriate technical and organisational measures to protect your data, such as a secure connection (https), secure payment environments and restricted access for staff.

7. Your rights

You have the right to:

  • access your data;
  • have incorrect data corrected;
  • have your data deleted, unless we are legally required to keep it;
  • have the processing restricted;
  • receive your data in a common file format (portability);
  • object to processing based on legitimate interest and to direct marketing;
  • withdraw your consent at any time. You can change your cookie consent via the cookie settings at the bottom of the webshop.

Send your request to webshop@cosmetique-totale.nl. We respond within one month. To prevent misuse, we may ask you to confirm your identity.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the data protection authority in your country of residence. We would of course appreciate hearing from you first.

8. Children

Our webshop is not intended for children under 16. We do not knowingly process data of children under 16 without the consent of a parent or guardian.

9. Changes

We may update this privacy policy. The latest version is always on this page.

Version 7 October 2026