PRIVACY POLICY

This is a Privacy Notice of 111 Skin Limited (‘we’, ‘us’, and ‘our’).

This Privacy Notice informs you who we are, how we collect, use, secure and share personal information collected by us when you visit our website, enquire about or buy goods, products, and/or services from us, send to, or receive from us, communications, (including marketing messages), register or attend our events or webinars, visit our offices or media pages, and through any other interactions we have with you. This Privacy Notice also informs you how you can exercise your rights.

This notice does not describe our processing of personal data relating to people who apply for jobs with us.  Neither does this notice describe our processing of personal data relating to our employees.  Our processing for employment-related purposes is set out in a separate notice that we make available to our employees.

This notice does not explain our processing of personal data as a processor on behalf of our business customers who use our services. Typically, for example, we will be the processor of any personal data which the business customers end users will submit to our services through the use of our services. Also, if we visit the sites of our business customers or otherwise access their systems and data to perform installation and other consultancy services, we may have incidental access to their personal data. In this case, they will be the controller and we will act as their processor. This processing is instead described in and governed by contracts between us and our business customers.

111 Skin Limited (‘111 Skin’, ‘we’, ‘us’, and ‘our’), is committed to respecting and protecting the privacy of individuals and to fully complying with all the requirements of the UK GDPR and all other applicable data protection laws and regulations.

If you have any questions or concerns about our use of your personal information, please contact us using the contact details provided elsewhere in this Privacy Notice.

Data Protection Officer

We have appointed a Data Protection Officer (DPO). If you wish to contact our DPO you can do so via: Privacy@111skin.com

This Privacy Notice applies to all our data subjects (an individual about whom we hold personal information) except Job Applicants/Candidates and our employees.

What is personal information?

Personal information is anything that enables you to be identified or identifiable. Personal information is also called “personal data”. We collectively refer to handling, collecting, protecting, storing or otherwise using your personal information as ‘processing’.

If you fail to provide personal information

Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you or provide you with goods/products/services you have requested.

Collecting (obtaining) your Personal Information

Most of the personal information we process is provided to us directly by you, for example for one or more of the following reasons:

• searching and browsing our website for content
• subscribing to or ordering newsletters and/or publications
• completing forms on our website
• ordering products from us, or otherwise contacting us
• submitting CVs or work history information
• providing us with business cards or other contact information

Our website

Our website may link to third-party sites not controlled by us and which do not operate under our privacy practices. When you link to third-party sites, our privacy practices no longer apply. We encourage you to review each third-party site's privacy policy before disclosing any personally identifiable information.

We do not intend to collect special category (also known as sensitive) personal information through our website(s) (unless we are legally required to do so). Examples of special category information are race or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; physical or mental health; genetic data; biometric data; sexual life or sexual orientation; and criminal records. We ask that you do not provide us with special category personal information when using our website. 

We may also obtain your personal information indirectly, such as from:

• Public registers/records.
• Websites.
• Social media
• Lead generation providers
• Data brokers
• Using CCTV or other monitoring devices.
• When your contact details are given to us as a referee or for use in an emergency.

The personal information we collect about you

We may collect and otherwise process different kinds of personal data about you which we have grouped together as follows:

• Contact Data includes postal and email address and telephone numbers.
• Identity Data includes names and similar identifiers, marital status, title, date of birth and gender.
• Financial Data includes bank account and payment card details.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our partners and your communication preferences.
• Transaction Data includes details about payments to and from you and other details of products, goods and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website and services.
• Usage Data includes information about how you use our products, services and website.

Lawful Bases (legal grounds) for Processing Personal Information

Our legal basis for collecting and using your personal information will depend on the personal information concerned and the specific context in which we collect it.

We will normally collect personal data from you on one or more of the following lawful bases:

• Consent: We may process your personal information after you have consented (agreed) to us doing so. Your consent may have been obtained by us, or by third parties on our behalf. You have the right to withdraw your consent at any time.
  
• Contract: We may process your personal information when we need to deliver a contractual service to you or because you have asked us to do something before entering into a contract (e.g., provide a quote).
  
• Legal obligation: We may process your personal information when we need to comply with a legal obligation.
• Legitimate interest: We may process your personal information when we need to for our or another’s legitimate interests, where these interests are not overridden by your rights.

Purpose(s) for Processing Personal Information

We have set out below a description of all the ways we plan to use your personal information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Please note that we may process your personal information for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground(s) we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity	Type of data	Lawful basis for processing
To register a new client/customer	Contact Identity	Contract
To process and deliver an order or request	Contact Identity  Financial  Transaction  Marketing and Communications	Contract Legitimate interest (to recover debts due to us and to protect our business and your account from fraud and other illegal activities)
To manage our customer and business relationships	Contact Identity  Marketing and Communications	Contract Legal obligation Legitimate interest (to keep our records updated and to study how customers and business contacts and partners use our products/goods/services)
To provide marketing materials	Contact Identity  Usage  Marketing and Communications	Consent Legitimate interest (to provide customers and contacts with information about our products/goods/services)
To promote prize draws and competitions.	Contact Identity  Usage  Marketing and Communications	Contract Legitimate interests (to study how customers use our products/goods/services, to develop them and grow our business)
To administer and manage our website	Contact Identity  Technical	Legitimate interest (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
To ensure you are able to attend an event.	Contact Identity  Marketing and Communications	Consent Contract Legitimate interest (to promote and develop our products/goods/services and grow our business)
To develop our businesses and services	Contact Data  Identity Data  Financial Data  Marketing and Communications Data  Transaction Data  Technical Data  Usage Data	Legitimate interests (to develop our products/goods/services and grow our business)
For the safety and security of our staff, visitors and others.	Contact Data  Identity Data	Legitimate interests (to protect and keep safe develop our staff, visitors and other individuals that we have a responsibility for)
To comply with our legal obligations	Contact Data  Identity Data  Financial Data  Marketing and Communications Data  Transaction Data  Technical Data  Usage Data	Legal obligation

We store the information described in the section ‘The personal information we collect about you’ in servers located in the UK. These servers may be accessed by personnel of third-party organisations that we share personal data with (see ‘Sharing your Personal Information‘) that are based in the USA.

Using your Personal Information for Marketing Purposes

We will only use your personal information for marketing purposes in accordance with applicable legal requirements.

This means that if you are a consumer customer, we will only provide you with marketing materials if you have given us your prior consent (subscribed), unless we can rely of the ‘soft opt-in’.

If you choose to unsubscribe:

·         we may retain some of your personal information to identify you, so that we can continue to honour your request and ensure that we do not continue to provide you with marketing materials.

We will not share your information with any third parties for the purposes of direct marketing.

Postal Marketing

We may use your personal information to send you information by post about products, services, launches, offers and brand news that we believe may be relevant to you based on your relationship with us.

We rely on our legitimate interests to promote our products and services to existing customers where we believe such communications are relevant and proportionate.

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Sharing your Personal Information

We may share your personal information with other companies or organisations in our group.

We may share your personal information with third parties (other organisations or individuals) for:

• The purpose(s) for which the information was submitted;
• The purposes listed under ‘Purpose(s) for Processing Personal Information’;
• Other internal or administrative purposes;
• As agreed between us or when explicitly requested by you;
• When required to deliver products, services or information requested by you;
• As otherwise set out in this Privacy Notice.

We share personal information with third parties that act as data processors to provide elements of our service by processing personal information on our instructions (see ‘Data Processors’ below).

The third-party providers may use their own third-party subcontractors that have access to personal data (sub-processors). It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality, to process personal information only as instructed by us, and to flow those same obligations down to their sub-processors.

We may also transfer, share or disclose personal information to third-party service providers of identity management, website hosting and management, data analysis, data backup, security and storage services.

We may share your personal information with third parties in connection with our corporate transactions, (e.g., mergers and/or acquisitions), as a result of which your personal information may be assigned to a third party.

We may share your personal information with law enforcement, regulatory and other government agencies and professional bodies, as required by and/or in accordance with applicable law or regulation.

We may also share your information in the event of the non-payment of a debt. As a result, we may share personal data with the litigation and recovery specialists we instruct in order for them to identify assets and undertake recovery action.

In some circumstances we are legally obliged to share information. For example, under a court order.

It is our policy to only share your personal information with third parties that are legally or contractually bound to protect your personal information to the same standards as we are, and that will flow those same standards to their subcontractors. 

Data processors

Where we use data processors, we have contracts in place with them to ensure that they cannot do anything with personal information we have shared with them unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct them to.

These data processors commit to processing information in compliance with applicable data protection laws and to implementing appropriate security measures to protect your information.

These data processors may use sub-contractors (known as sub-processors) that have access to your personal data. If they do, they are required to have contracts in place with those sub-processors to ensure that they cannot do anything with personal information shared with them beyond what we have instructed our data processors to do with it.

We may also disclose personal information to Klarna MAS (‘Klarna’), as part of tracking sales that come from an influencer network that we are partnering with. For more information about how Klarna will process that personal information, see Klarna’s consumer privacy notice: Klarna: Klarna’s Privacy Notice

Transfers of personal information for UK and EU subjects

We may transfer your personal information internationally only where permitted under applicable UK and EU data protection laws and where appropriate safeguards are in place. Such transfers may be made:

• To you, where you are located outside the UK or European Economic Area (EEA);
• To a recipient located in a country that benefits from an adequacy decision issued by the UK Government and/or the European Commission, confirming that the country provides an adequate level of protection for personal data;
• To a recipient subject to appropriate transfer safeguards, including an International Data Transfer Agreement (IDTA) or the European Commission's Standard Contractual Clauses (SCCs) together with any supplementary measures required under applicable law such as the UK International Data Transfer Addendum;
• To organisations certified under recognised transfer frameworks, including, where applicable, the EU-U.S. Data Privacy Framework (EU-U.S. DPF) incorporating the UK Extension to the EU-U.S. Data Privacy Framework, if relevant or any successor framework approved by the relevant authorities;
• Where another lawful transfer mechanism or derogation applies under applicable UK or EU data protection laws; or
• Where the information has been anonymised so that it can no longer be used to identify an individual.

Transfers of personal information for US and Chinese data subjects

Where we collect personal data from individuals located in the United States or China, we may transfer that data to service providers and group companies located in other jurisdictions. We will ensure that any such transfers are carried out in accordance with applicable data protection laws, including any applicable requirements under United Staes or Chinese law relating to cross-border transfers of personal information, and that appropriate safeguards are implemented to protect the personal data.

The countries/areas to which we routinely transfer personal data to* are:

EU/EEA: To a recipient located in a country which provides an adequate level of protection for your personal information.

USA: To a recipient certified under the UK- US Data Bridge, which provides an adequate level of protection for your personal information; or to a recipient not certified under the UK- US Data Bridge, in which case the transfer is made using an International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses

*This does not mean that your personal data will definitely be transferred to any of these countries.

Retention (Storage) of Personal Information

We will retain your personal information only for as long as we need it for the purpose(s) for which it was collected, or as required to do so by law.

To determine the appropriate retention period for your personal information, we consider the amount, nature, and sensitivity of it, the potential risk of harm from unauthorised use or disclosure of it, the purposes for which we process it and whether we can achieve those purposes through other means, as well as applicable legal requirements.

Examples of the periods for which personal information will be stored*

Personal data	Retention period
Client/customer records	As required by any applicable statutory retention period, or where no statutory retention period applies, six years after contractual relationship ends, or six years from our last date of contact, whichever is the latest.
Business contacts records	As required by any applicable statutory retention period, or where no statutory retention period applies, six years after business relationship ends.

*The above list, which gives examples and does not identify each and every, period for which individuals' personal data will be stored. Further information about our retention of Personal Information is set out in our Retention Policy. If you would like a copy of our Retention Policy, please contact us.

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information and are managed in accordance with applicable privacy laws, including the General Data Protection Regulation (GDPR), UK GDPR, the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), the Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable regional privacy regulations. To protect your privacy and prevent unauthorized requests, we require identity verification before processing any request. Additional information may be requested where necessary to verify your identity or to fulfil your request.

Requests will be processed within the timeframes required by applicable law. Any information provided will be used solely to process your request and will not be used, disclosed, or retained for any other purpose, except as required by law.

• Your right of access: You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. 
  
• Your right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. 
  
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
  
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your information in certain circumstances. 
  
• Your right to object to processing: You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests. 
  
• Your right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. 
  

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

If you wish to exercise any of your rights, please contact privacy@111skin.com

Do Not Sell or Share My Personal Information

Under certain U.S. privacy laws, including the CCPA and CPRA, you have the right to opt out of the sale or sharing of your personal information. We may share limited personal information with advertising, analytics, and technology partners in order to operate our website, measure performance, and deliver relevant advertising experiences. This may include information used for targeted advertising, attribution, or analytics purposes, as defined under applicable law.

If you wish to opt out of the sale or sharing of your personal information, you may submit a request to privacy@111skin.com

Security

We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal data. Please be aware that, we cannot guarantee the security of all personal information transmitted to or by us.

SMS

If you provide your details for our SMS marketing service we use this information to send you text notifications (for your order, including abandoned checkout reminders), text marketing offers, and transactional texts including requests for reviews from us, where you have provided your consent for us to do so.

Opt-in data and consent for text messaging will not be shared with any third parties except for messaging partners, for the purpose of enabling and operating our text messaging program.

Our website uses cookies to keep track of items you put into your shopping cart, including when you have abandoned your checkout. This information is used to determine when to send cart reminder messages via SMS.

Social Media

We use the following social media platform(s):

• Facebook
• Instagram
• TikTok

We may use these social media platform(s) to process your personal data for some of the purposes set out elsewhere in this Privacy Notice.

Artificial Intelligence (AI)

We use Artificial Intelligence (AI), which means that AI may be used to process your personal data.

When we use AI, we do so in compliance with applicable data protection legislation; and regulatory guidance. 

Chatbots (Virtual Assistants)

We use an AI chatbot, which means that if you interact with our Virtual Assistant, for example when you visit our website or contact us, you will be doing so with an AI system without human intervention.

Automated Decision Making

We will not use your personal information for automated decision making or profiling

Profiling

Profiling is where we look at people’s interests, habits and behaviour, for example, profiling for direct marketing often also involves predictions or assumptions about people. It can help us target our direct marketing messages to people who are more likely to buy our product or support our cause. It can also make our messages more relevant to the people that receive them.

We will use your purchase history of our products/services to tell you about our offers and products/services that we think you will be most interested in.

Children’s personal information

We do not provide services directly to children or proactively collect their personal information.

Visiting our premises

When you visit our premises you may provide your name and other personal information for security and safety reasons. 

CCTV

Closed-circuit television (CCTV) operates at our premises for security and safety reasons. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests. 

Wi Fi

We provide Wi-Fi on site for the use of visitors. We’ll provide you with the address and password. We record the device address and will automatically allocate you an IP address whilst on site. We also log traffic information in the form of sites visited duration and date sent/received. The purpose for processing this information is to provide you with access to the internet whilst visiting our site. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.

Attending an event of ours

If you wish to attend one of our events, you will be asked to provide your contact information including your organisation’s name and, if offered a place, information about any dietary requirements or access provisions you may need. We may also ask for payment if there is a charge to attend.

We use this information to facilitate the event and provide you with an acceptable service. We also need this information so we can respond to you.

Our purpose for collecting this information is so we can facilitate the event and provide you with an acceptable service. The lawful basis we rely on for processing your personal data is your consent under article 6(1)(a) of the UK GDPR. When we collect any information about dietary or access requirements we also need your consent (under article 9(2)(a)) as this type of information is classed as special category data.

 

Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

Our contact details

We can be contacted as follows:

• Call: 0208 103 9111
• Form:  https://111skin.co.uk/pages/contact-us 
• Email: privacy@111skin.com
• Post:  5/6 Bywell Place, Fitzrovia, London, W1T 3DN, United Kingdom

Cookies

We use a cookies tool on our website to gain consent for the optional cookies we use. Cookies that are necessary for functionality, security and accessibility are set and are not deleted by the tool. For information about the cookies and any other similar technologies we use, please see our cookies policy.

Data Protection Complaints

We work to high standards when it comes to processing your personal information. If you have any queries or concerns about our handling of your personal information, please contact us directly privacy@111skin.com

We will confirm receipt and our next steps within 30 days, and all queries will be investigated without undue delay. In all cases we will provide you with an outcome that explains what steps we have taken following your concern.

United Kingdom:                                         

Should you remain dissatisfied following our response, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office (ICO), the UK data protection regulator. Please follow this link to see how to do that.

For Other Territories:

You have the right to lodge a complaint with your local data protection regulator, where there is one.

Updating

We may update this Privacy notice at any time by publishing an updated version here. So that you know when we make changes, we will amend the revision date at the bottom of this page. The new modified or amended privacy policy will apply from that revision date.

This Privacy Notice was last updated on 13/10/2026.