Privacy policy

PRIVACY POLICY

Neoderma Switzerland GmbH

Version 1.0 — effective 30 September 2026

1. Introduction

This Privacy Policy explains how Neoderma Switzerland GmbH ("Neoderma", "we", "us") collects, uses, shares and protects your personal data when you visit www.neoderma.com (the "Website"), place an order, create an account, subscribe to our communications or contact our customer service.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where you are located in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) also applies, and this Policy states the additional information it requires.

This Policy applies to the Website and to our communications with you. It does not apply to websites of retailers, professional partners or other third parties that we may link to.

2. Who we are and how to contact us

The controller responsible for your personal data is:

Neoderma Switzerland GmbH
Grabenstrasse 3
6300 Zug
Switzerland
privacy@neoderma.ch

Our representative in the European Union under Article 27 GDPR is:

Neoderma Global Limited
69 Vithleem Street
Strovolos, 2033 Nicosia
Cyprus
legal@neoderma.com

For any question about this Policy or about your personal data, or to exercise your rights, write to privacy@neoderma.ch or to the postal address above.

3. What personal data we collect and how

We collect personal data that you give us, data generated when you use the Website, and data we receive from our service providers.

Data you give us

• Identity and contact data: name, delivery and billing address, email address, telephone number.

• Order data: products ordered, order value, currency, delivery method, order history.

• Payment data: the payment method you choose and the transaction reference. Card numbers, Twint and PayPal credentials are entered directly with the payment provider and are not stored by us.

• Account data: login credentials, saved addresses, preferences, if you create an account.

• Communication data: the content of your emails, messages and support requests, including any photographs you send us in connection with a return or a product complaint.

• Marketing preferences: your consent to receive our newsletter or SMS, and your interests if you tell us.

• Information about your skin, if you choose to share it with our customer service to obtain product advice. We use it only to answer your enquiry and do not store it beyond the enquiry unless you ask us to.

Data generated when you use the Website

• Technical data: IP address, browser type and version, operating system, device identifiers, language settings, referring website.

• Usage data: pages viewed, products viewed, time on page, searches, clicks, basket contents, checkout progress.

• Location data: your country, derived from your IP address, used to show you the correct market, currency and language.

• Cookie data, as described in section 8.

Data we receive from others

• From payment providers: confirmation or refusal of payment and fraud-prevention indicators.

• From carriers: delivery status and delivery confirmation.

• From social networks and advertising platforms: whether you reached us through one of their advertisements, where you have allowed this through your settings on those platforms.

We do not knowingly collect data from persons under 18.

4. Why we use your personal data and the legal basis

We use your personal data for the purposes below. For visitors in the EU or EEA, the legal basis under the GDPR is stated in each case.

Under Swiss law, we process personal data lawfully where it is proportionate, transparent and for the purposes stated when the data was collected. Where we rely on your consent, you may withdraw it at any time with effect for the future.

5. Who we share your personal data with

We share personal data only where necessary for the purposes above, with the following categories of recipients.

Service providers acting on our instructions

We keep this list current. Where we add a provider, we update this Policy before the provider processes your data.

Group companies

Neoderma Global Limited (Cyprus) handles returns from outside Switzerland and acts as our EU representative. Neoderma Amsterdam B.V. (Netherlands) supports order fulfilment and professional-channel operations. Each processes your data only for these purposes and under our instructions.

Authorities and other third parties

We disclose personal data where required by law, court order or authority request, including customs authorities for cross-border deliveries; to our professional advisers bound by confidentiality; and, in the event of a merger, acquisition or sale of assets, to the acquiring party, who will be bound by this Policy.

We do not sell personal data.

6. International transfers

Your data is processed in Switzerland and in the European Union, both of which offer an adequate level of data protection under each other's laws. Some of our providers process data in the United States and Canada. Canada benefits from adequacy decisions under both Swiss and EU law. For transfers to the United States, we rely on the provider's certification under the Swiss-US Data Privacy Framework and the EU-US Data Privacy Framework, or on the standard contractual clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner, supplemented where necessary by additional safeguards. A copy of the relevant safeguard is available on request at privacy@neoderma.ch.

7. How long we keep your personal data

We keep personal data no longer than necessary for the purpose for which it was collected, and as required by law.

• Order, invoice and payment records: ten years from the end of the financial year in which the order was placed, as required by Swiss accounting and tax law.

• Account data: for as long as your account is active, then deleted or anonymised twelve months after your last login unless a legal retention period applies.

• Customer service correspondence: three years from the last exchange, longer if needed for a warranty claim or dispute.

• Newsletter and marketing consents: until you withdraw consent, then three years from your last interaction with us to document the consent history, after which the data is deleted.

• Website analytics and advertising data: according to the retention settings of each tool, currently a maximum of 14 months for analytics, and as stated in our Cookie Policy.

• Data relating to a legal claim: until the claim is finally resolved.

8. Cookies and similar technologies

The Website uses cookies and similar technologies. Cookies are small text files placed on your device that allow the Website to function, remember your choices, measure use and, with your consent, show you relevant advertising.

We distinguish:

• Strictly necessary cookies, which enable the basket, checkout, login, market and language selection, security and the cookie consent record itself. These cannot be switched off.

• Analytics cookies, which help us understand how the Website is used. Set only with your consent.

• Marketing cookies, set by advertising and social-media platforms to show you relevant advertisements and measure campaigns. Set only with your consent.

When you first visit the Website, our consent banner allows you to accept all cookies, reject all non-essential cookies, or choose by category. You can change your choice at any time through the "Privacy settings" link in the footer. Our Cookie Policy lists each cookie, its provider, purpose and duration.

9. Marketing communications

We send you our newsletter or SMS only with your consent, given when you subscribe or place an order. You can withdraw consent at any time by using the unsubscribe link in each email, replying STOP to an SMS, adjusting your account preferences, or writing to privacy@neoderma.ch. Withdrawing consent does not affect service messages about your orders, deliveries and returns, which we send as part of performing the contract.

With your consent, we use your order history and your interaction with our emails to select the content and offers we send you. We may also use your hashed email address to show you our advertising on social networks and to exclude existing customers from acquisition campaigns.

10. Customer service and AI-assisted tools

Our customer service uses AI-assisted tools within our support platform to help answer enquiries faster, for example by suggesting or providing answers to common questions about orders, products and returns. These tools process the content of your message and your order data for that purpose only. Our team reviews conversations and remains responsible for every answer; you can ask to speak to a person at any time. No decision producing legal effects or similarly significant effects for you is taken solely by automated means.

11. How we protect your personal data

The Website is served over encrypted connections. Payments are handled by providers certified under the Payment Card Industry Data Security Standard; we do not see or store full card numbers. Access to personal data within Neoderma is limited to staff and providers who need it for the purposes in this Policy and who are bound by confidentiality. Our providers are contractually required to protect your data with appropriate technical and organisational measures. Despite these measures, no transmission over the internet is entirely secure, and we cannot guarantee absolute security.

12. Your rights

Under Swiss law and, where applicable, the GDPR, you have the right to:

• ask whether we process personal data about you and receive a copy of it, with the information listed in this Policy;

• have inaccurate or incomplete data corrected;

• have your data erased, where there is no legal reason for us to keep it;

• restrict our processing of your data in certain circumstances;

• receive the data you gave us in a structured, commonly used, machine-readable format, or have it transmitted to another controller, where technically feasible;

• object to processing based on our legitimate interests, and at any time to processing for direct marketing;

• withdraw any consent you have given, with effect for the future.

To exercise these rights, write to privacy@neoderma.ch or to the postal address in section 2. We may ask you to confirm your identity. We respond within 30 days; where a request is complex, we tell you if we need longer. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

If you consider that our processing of your data infringes data protection law, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you are in the EU or EEA, you may lodge a complaint with the supervisory authority of your country of residence or place of work.

13. Changes to this Policy

We may update this Policy when our processing, our providers or the law change. The version in force is always available on the Website and shows its effective date. Where a change materially affects you, we inform you by email or by a notice on the Website before it takes effect.