Privacy policy

Rooy Development, trading as N/FORM, of Brandemeer 17a, 8918 CT Leeuwarden, Netherlands, Chamber of Commerce 76990605, is the controller of the personal information described in this policy.

All privacy enquiries, including requests to exercise the rights set out in section 9, must be sent to [email protected].

• Contact information: your email address, and your name and shipping address when you place an order.
• Account information: your sign-in status, saved preferences and membership settings.
• Assessment information: the answers you give in the skin quiz and the routine generated from them. The quiz collects self-reported information about skin condition and routine habits. It does not request a diagnosis, medical history, prescription information or photographs.
• Transaction information: orders, parcels, membership settings, credit ledger entries, refunds and guarantee requests.
• Payment information: the payment method reference returned to us by our payment processor. Card numbers, security codes and expiry dates are submitted directly to the processor and are not received or stored by us.
• Usage information: pages viewed, quiz steps completed, products viewed, items added to the bag and purchases made, together with an identifier assigned to your browser, your IP address, device and browser type, and referring URL.
• Correspondence: the content of support messages you send to us and our replies.

We do not knowingly collect information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or information concerning health or sexual orientation.

• To create and maintain your account and to authenticate you.
• To generate the routine and Skin Plan you request.
• To process, fulfil, ship, invoice and refund orders, and to calculate applicable tax and shipping.
• To operate memberships, including parcel previews, skips, pauses, cancellations, credit and guarantee claims.
• To send transactional messages, including sign-in links, order confirmations, parcel previews, receipts, shipping notices and refund confirmations.
• To send marketing messages where you have asked to receive them.
• To measure the performance of the site and of our advertising, and to improve both.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To comply with legal, accounting and tax obligations and to establish, exercise or defend legal claims.

Where the General Data Protection Regulation applies, we rely on the following legal bases.

• Performance of a contract, for account creation, order processing, fulfilment, membership administration, refunds and transactional messages.
• Legal obligation, for tax, accounting and consumer-law record keeping.
• Consent, for marketing email and for the assessment information you choose to provide in the quiz. Consent may be withdrawn at any time, without affecting processing carried out before withdrawal.
• Legitimate interests, for site security, fraud prevention, service improvement and measurement of our advertising, balanced against your interests and rights.

We do not sell personal information for money. We disclose personal information to the following categories of recipient, each of which processes it on our instructions and under a written agreement.

• Payment processing: Stripe, for payment authorisation, saved payment method references and refunds.
• Fulfilment and shipping: our fulfilment partner and its carriers receive the name, shipping address and order contents required to pack and deliver the order.
• Customer data platform: Bluebarry receives the usage information described in section 2, and your email address once you have provided it, for customer profile and measurement purposes.
• Transactional email: Resend delivers our transactional and marketing messages.
• Advertising and measurement: Meta Platforms receives page view, checkout and purchase events, browser identifiers and contact information hashed in your browser, for advertising measurement and matching.
• Professional advisers, auditors and insurers, where required.
• Public authorities, courts and law enforcement, where disclosure is required by law or necessary to establish, exercise or defend legal claims.
• An acquirer or successor, in connection with a merger, acquisition, financing or sale of assets, subject to this policy.

Payments are processed by Stripe. Card details are transmitted from the payment form directly to Stripe and do not reach our servers. We retain only the reference Stripe issues for a saved payment method, so that a membership parcel can be charged without re-entry of the card. Refunds are issued through Stripe to the original payment method. Stripe processes this information as a controller in its own right under its own privacy policy.

We and the recipients named in section 5 use cookies, browser storage and similar identifiers for the following purposes.

• Strictly necessary: session and authentication cookies, and browser storage holding your quiz progress, your Skin Plan and your bag so that you can return to them.
• Analytics and measurement: identifiers that record the usage information described in section 2.
• Advertising: identifiers set by Meta Platforms to measure and attribute advertising.

Analytics and advertising identifiers are set when you use the site. You may block or delete cookies through your browser settings, and you may limit advertising personalisation through the settings of the platform concerned. Blocking strictly necessary cookies will prevent parts of the site from functioning.

Marketing email is separate from your account. We send it only where you have asked to receive it, and every message contains an unsubscribe link. Withdrawing marketing consent does not stop the transactional messages that an order or a membership requires.

• Order, invoice, payment and tax records: 7 years from the end of the financial year in which the transaction occurred, as required by applicable tax law.
• Account and assessment information: for as long as your account remains open, and for 90 days after you ask us to close or delete it, except where a longer period is required by law.
• Support correspondence: 24 months from the last message in the exchange.
• Usage information and advertising identifiers: up to 25 months.
• Marketing consent records: for as long as the consent is relied on, and thereafter as required to evidence it.

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls, and the exclusion of card data from our systems. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security.

Subject to the conditions and exceptions of the law that applies to you, you may exercise the following rights.

• Access: to obtain confirmation of whether we process personal information about you, and a copy of it.
• Rectification: to have inaccurate information corrected. Your shipping address can also be updated from your account.
• Erasure: to have personal information deleted, except where we are required or entitled to retain it.
• Restriction and objection: to restrict processing, or to object to processing carried out on the basis of legitimate interests, including profiling.
• Portability: to receive information you provided to us in a structured, commonly used, machine-readable format.
• Withdrawal of consent: to withdraw consent at any time where processing is based on consent.
• Complaint: to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

California residents. Under the California Consumer Privacy Act, as amended, you may request disclosure of the categories and specific pieces of personal information collected, the categories of sources, the business purposes for collection, and the categories of third parties to whom it is disclosed; you may request deletion and correction; and you may opt out of the sharing of personal information for cross-context behavioural advertising. We do not sell personal information for monetary consideration. We do not knowingly use or disclose sensitive personal information for purposes requiring an opt-out right. We will not discriminate against you for exercising these rights. Requests may be made at the address in section 1 and are answered within 45 days, extendable by a further 45 days where reasonably necessary.

EU, EEA and UK residents. Requests are answered within one month of receipt, extendable by two further months where the request is complex or where several requests have been made.

Requests must be made from the email address on your account, or accompanied by information sufficient to verify your identity. An authorised agent must provide written authorisation. Matters that move money or change an order are governed by the terms of sale.

The site is not directed at children under 16 years of age and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 16, we will delete it. A parent or guardian may contact us at the address in section 1.

Personal information is processed in the European Economic Area and in the United States. Where personal information is transferred out of the European Economic Area or the United Kingdom to a country that has not received an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses, together with the UK Addendum where applicable, and subject to the supplementary measures those clauses require. A copy of the relevant safeguards may be requested at the address in section 1.

We may amend this policy. The revision date at the top of this page states when it was last amended. Material changes will be notified by email or by a notice on the site before they take effect. Continued use of the site after a change takes effect constitutes acceptance of the amended policy.

Rooy Development
Brandemeer 17a
8918 CT Leeuwarden
Netherlands
Chamber of Commerce 76990605
[email protected]