Privacy Policy

ARTICLE 1: PREAMBLE

The purpose of this privacy policy is to inform website users about:

The way in which their personal data is collected.
Personal data refers to any information that can identify a user. This may include: first and last names, age, postal or email address, location, or IP address (non-exhaustive list);
The rights they have regarding this data;
The person responsible for the processing of personal data collected and processed;
The recipients of this personal data;
The site's cookie policy.

ARTICLE 2: PRINCIPLES RELATING TO THE COLLECTION AND PROCESSING OF PERSONAL DATA

In accordance with Article 5 of European Regulation 2016/679 (GDPR), personal data is:

Processed lawfully, fairly and transparently with respect to the person concerned;
Collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes;
Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
Accurate and, where necessary, kept up to date. All reasonable steps must be taken to ensure that inaccurate data is erased or rectified without delay;
Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed;
Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage, by means of appropriate technical or organizational measures.

The processing is lawful only if, and to the extent that, at least one of the following conditions is met:

The person concerned has consented to the processing of their personal data for one or more specific purposes;
The processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
The processing is necessary for compliance with a legal obligation to which the controller is subject;
The processing is necessary to protect the vital interests of the data subject or of another natural person;
The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority;
The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject override those interests, in particular where the data subject is a child.

ARTICLE 3: PERSONAL DATA COLLECTED AND PROCESSED DURING NAVIGATION ON THE SITE

Article 3.1: Data collected

The personal data collected as part of our business is as follows:
[to be completed according to the types of data collected]

The collection and processing of this data serves the following purposes:
(examples: contract management, customer account management, service quality monitoring, sending newsletters, etc.)

Article 3.2: Data Collection Methods

When you use our site, the following data is automatically collected:
[To be completed as appropriate: IP address, browser type, pages viewed, etc.]

Other personal data may be collected when you perform certain actions on the platform:
[to be completed according to the operations performed by the user]

This data is stored by the data controller under reasonable security conditions for a period of 2 years .

The company may retain certain data beyond this period in order to comply with its legal or regulatory obligations.

Article 3.3: Data Hosting

The site is hosted by Shopify .
Contact: contact@LymphaBrush.com

[Article 3.4: Transmission of data to third parties]

If necessary, the data may be transmitted to our partners, listed below:
[To be completed if applicable]

[Article 3.5: Cookie Policy]

If the site uses cookies, their use is specified here:
[To be completed according to the site's cookie policy]

ARTICLE 4: DATA CONTROLLER AND DATA PROTECTION OFFICER

Article 4.1: Data Controller

Personal data is collected by LymphaBrush .

The data controller can be contacted:

By email: contact@ LymphaBrush .com

Article 4.2: Data Protection Officer

The data protection officer (DPO) of the company or data controller is: contact@ LymphaBrush .com

If, after contacting us, you believe that your "Data Protection" rights are not being respected, you can file a complaint with the CNIL .

ARTICLE 5: USER RIGHTS REGARDING DATA COLLECTION AND PROCESSING

Any user whose personal data is being processed may exercise the following rights, in accordance with European Regulation 2016/679 (GDPR) and the French Data Protection Act (n° 78-17 of 6 January 1978) :

Right of access, rectification and erasure of data (articles 15, 16 and 17 of the GDPR);
Right to data portability (Article 20 of the GDPR);
Right to restriction of processing (Article 18 of the GDPR) and right to object (Article 21 of the GDPR);
Right not to be subject to a decision based solely on automated processing;
Right to define the fate of one's data after one's death;
Right to lodge a complaint with the competent supervisory authority (Article 77 of the GDPR).

To exercise your rights, please send your request to Dermezza , by email at contact@ Dermezza.com .

In order to respond to your request, you may be asked to provide certain identification information (name, surname, email address, account or subscriber number, etc.).

To learn more about your rights, visit www.cnil.fr .

ARTICLE 6: CONDITIONS FOR MODIFICATION OF THE PRIVACY POLICY

The website publisher Dermezza reserves the right to modify this policy at any time to ensure its compliance with applicable legislation.

Any modification will not affect purchases already made on the site, which will remain subject to the policy in effect at the time of purchase and accepted by the user.

Users are encouraged to review this policy regularly, without formal notification being required.

This policy, published on October 15 , 2025, was updated on October 15, 2025 .