Privacy Policy

Welcome to NBOA Skincare.

This Privacy Policy explains how NBOA Skincare, referred to in this policy as “we”, “our” or “us”, collects, uses, stores and protects your personal information when you visit our website, purchase our products, create an account, contact us or otherwise interact with our business.

We are committed to handling personal information responsibly and in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable privacy and electronic communications laws.

NBOA Skincare is the business responsible for determining how and why your personal information is processed when you use our website or purchase from us.

The information we collect depends on how you interact with our website and services.

Information you provide directly

• Your name
• Your billing and delivery addresses
• Your email address
• Your telephone number
• Your account login details
• Your order and purchase history
• Your marketing preferences
• Product reviews or feedback you choose to submit
• Information included in customer service enquiries
• Any other information you voluntarily provide to us

Information collected automatically

• Your IP address
• Your browser type and version
• Your device type
• Your operating system
• Your time zone and approximate location
• The pages you visit
• The time you spend on our website
• The website or advertisement that referred you to us
• Shopping basket and checkout activity
• Cookie and analytics information

We may use your personal information to:

• Process and fulfil your orders
• Accept and verify payments
• Arrange delivery of purchased products
• Send order and delivery updates
• Create and manage your customer account
• Provide customer service and respond to enquiries
• Manage returns, refunds and complaints
• Prevent fraud and protect our website
• Comply with accounting, tax and legal obligations
• Improve our website, services and customer experience
• Understand how visitors use our website
• Measure the effectiveness of our marketing
• Send marketing emails where you have opted in

UK data protection law requires us to have a lawful reason for processing personal information. Depending on the circumstances, we rely on one or more of the following legal bases:

• Performance of a contract: where processing is necessary to accept, process, deliver or manage your order.
• Legal obligation: where we must keep information or disclose it to comply with the law.
• Legitimate interests: where processing is reasonably necessary to operate, protect or improve our business and does not override your rights.
• Consent: where you have actively agreed to receive marketing or allow optional cookies and tracking technologies.

Payments made through our website are processed by trusted third-party payment providers, including Stripe and any other payment provider we may make available from time to time.

We do not store or have direct access to your complete debit or credit card details. Payment information is handled by the relevant provider using its own secure systems, encryption and fraud prevention procedures.

Payment providers may process information such as your name, billing address, payment details, transaction value, device information and fraud prevention data in accordance with their own privacy policies.

To deliver your order, we share the information reasonably required by our chosen postal, courier or fulfilment partners.

This may include:

• Your name
• Your delivery address
• Your email address where delivery updates are available
• Your telephone number where required for delivery
• Your order or tracking reference

We may use Royal Mail, DPD or another suitable delivery provider. Our chosen provider may change depending on the destination, service availability, parcel requirements or business needs.

Where you create a customer account, we may store information such as your name, contact details, saved addresses, previous orders, account preferences and login credentials.

You are responsible for keeping your password and account information confidential. Please contact us promptly if you believe your account has been accessed without permission.

Where you have chosen to receive marketing emails, we may send you information about:

• New product launches
• Promotions and offers
• Skincare information and educational content
• NBOA Skincare news and updates
• Product availability

You can withdraw your consent at any time by using the unsubscribe link included in our marketing emails or by contacting us.

Unsubscribing from marketing will not prevent us from sending necessary service messages relating to an order, payment, delivery, account or customer service enquiry.

Our website uses cookies and similar technologies. Cookies are small files stored on your device that allow websites to function, remember preferences and understand how visitors use them.

Cookies may help us:

• Keep products in your shopping basket
• Maintain secure customer logins
• Remember your preferences
• Operate the checkout process
• Protect the website against fraud and misuse
• Measure website performance
• Understand visitor behaviour
• Measure advertising effectiveness

Where required, our cookie banner will allow you to accept, reject or manage optional cookies. Essential cookies required to operate the website may remain active because the store cannot function properly without them.

You can also manage cookies through your browser settings, although disabling certain cookies may affect the operation of our website, basket, checkout or customer account features.

We use analytics services, including Google Analytics, to help us understand how visitors find and use our website.

Analytics may provide information about pages viewed, visit duration, approximate location, device type, browser type, referrals, website interactions and purchasing journeys.

Where required by law, non-essential analytics technologies will only be activated after you have provided consent through our cookie banner.

We may use advertising and measurement technologies provided by trusted platforms, including Meta, to measure the effectiveness of campaigns and understand whether advertisements result in website visits or purchases.

These technologies may use cookies, pixels or similar identifiers. Where consent is legally required, they will only operate after you have approved the relevant cookie category.

We do not sell your personal information.

We may share personal information with trusted organisations that help us operate our business, including:

• Payment processors
• Postal, courier and fulfilment providers
• Website hosting and security providers
• Website developers and technical support providers
• Email and marketing service providers
• Analytics and advertising providers
• Accountants, insurers, lawyers and professional advisers
• Government bodies, regulators or law enforcement authorities

Service providers should only use personal information for the purpose for which it was shared and must protect it appropriately.

We may also disclose information where necessary to establish, exercise or defend legal claims, prevent fraud, enforce our terms or protect the rights and safety of our business and customers.

We use appropriate technical and organisational measures intended to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures may include:

• SSL encryption
• Secure website hosting
• Password protection and access controls
• Website and software updates
• Firewall and malware protection
• Secure third-party payment processing
• Restricted access to customer information

No internet transmission or storage system can be guaranteed to be completely secure. However, we take reasonable steps to reduce risk and protect the information entrusted to us.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

The length of time information is retained may depend on:

• Accounting and tax requirements
• Consumer protection obligations
• Order fulfilment and customer service needs
• Fraud prevention and security
• Warranty, complaint or dispute periods
• The establishment or defence of legal claims

When personal information is no longer required, it will be securely deleted, anonymised or otherwise removed from active use where reasonably possible.

Depending on the circumstances, UK data protection law may give you the right to:

• Request access to personal information we hold about you
• Request correction of incomplete or inaccurate information
• Request deletion of your personal information
• Request restriction of processing
• Object to certain processing activities
• Withdraw consent where processing is based on consent
• Request transfer of eligible information in a portable format
• Complain to the Information Commissioner's Office

Some rights are subject to legal conditions and exceptions. For example, we may need to retain order information to comply with tax, accounting or legal obligations even where deletion has been requested.

We may ask you to verify your identity before responding to a request. We will normally respond within one month, although the law allows additional time for particularly complex requests.

Our website is intended for general consumers and is not designed to knowingly collect personal information from children under the age of 13 without appropriate parental or guardian involvement.

If you believe a child has provided personal information to us without appropriate permission, please contact us so we can investigate and take suitable action.

Some service providers we use may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place. These may include adequacy regulations, approved contractual protections or other legally recognised transfer mechanisms.

Our website may contain links to websites or services operated by third parties.

We do not control those websites and are not responsible for their content, security or privacy practices. We encourage you to review the privacy information provided by a third-party website before submitting personal information to it.

We may update this Privacy Policy from time to time to reflect changes to our business, services, technology, providers or legal obligations.

The latest version will be published on this page with an updated revision date. We encourage you to review this page periodically.