Privacy Policy

1. Who we are

Tellus ("we", "our", "us") is the controller of personal data collected through telluskin.com.

• Registered (legal) name: Luan Rocha Loures Marczak
• KvK (Chamber of Commerce) number: 42099140
• Registered address: Tempeliersstraat 52-RD, 2012 EG, Haarlem, Netherlands.
• Contact for privacy questions: tellus.skin@gmail.com

We are a small business and are not required to appoint a Data Protection Officer. You can reach us about any data question at the address above.

2. What we collect

• Order details — name, delivery address, email and phone number. Used to process, fulfil and deliver your order and to contact you about it.
• Payment information — handled by our payment provider. We do not store full card details ourselves.
• Account details (if and when accounts are introduced) — email and a hashed password, so you can log in and view past orders.
• Marketing contact — your email address, only if you opt in, used to send occasional updates. You can withdraw consent or unsubscribe at any time (see Section 7).
• Customer-service messages — anything you send us when you contact us, including any information you choose to share about a skin reaction or product concern.
• Reviews — if you submit a product review, the content and the name you choose to display.
• Technical data — IP address, browser and device information, used to keep the site secure and to measure aggregate traffic.

3. Why we use your data and our legal basis

• To fulfil your order (process payment, ship, handle returns and customer service) — because it is necessary to perform our contract with you. Providing this data is required to place an order; without it we cannot fulfil it.
• To send marketing emails — on the basis of your consent.
• To publish reviews you submit — on the basis of your consent.
• To keep the website secure, prevent fraud, and understand aggregate traffic — on the basis of our legitimate interest in running a safe, functioning store.
• To meet legal obligations — such as tax and accounting record-keeping.

4. Who we share it with

We share personal data only with service providers who help us run the store, and only as far as needed:

• Our fulfilment supplier, SelfNamed (SIA Cosmetics NORD), based in Latvia (EU), which produces and ships your order and therefore receives your name and delivery address. It processes this data through its own systems, which include the Shopify e-commerce platform.
• Our payment provider, to process payments securely.
• Shipping and delivery carriers, to deliver your order.
• Our email and marketing tools, to send order-related and (where you have consented) marketing messages.
• Our reviews tool, to collect and display product reviews.
• Analytics tools (only where you have consented to non-essential cookies).
• Authorities, advisors or accountants, where we are legally required to share data.

We never sell your personal data.

5. International data transfers

Some of our service providers — for example our email/marketing and analytics tools — may be based outside the European Economic Area (EEA), including in the United States. Where we transfer your data outside the EEA, we rely on an appropriate safeguard recognised under the GDPR: either a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses. You can ask us for more detail about the safeguards in place.

6. How long we keep it

• Order and transaction records — kept for 7 years to meet Dutch tax obligations.
• Account data — kept for as long as your account is active; deleted on request or after a long period of inactivity.
• Marketing data — kept until you withdraw consent or unsubscribe.
• Technical logs — kept for up to 12 months.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time (for example, to marketing emails) — this does not affect processing that took place before you withdrew it.

To exercise any of these, email tellus.skin@gmail.com. We will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

8. Cookies

We use strictly necessary cookies to make the site work (for example, to remember your cart). We only set analytics or marketing cookies after you have given consent through our cookie banner. Full details are in our Cookie Policy.

9. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. No online service can be guaranteed completely secure, but we work to keep your data safe.

10. Children

Our website and products are intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

12. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, with the "last updated" date shown above.

13. Contact

Questions about your data? Email tellus.skin@gmail.com.