PRIVACY POLICY

Last updated: August 2026

DERMA DIRECT EUROPE B.V. respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit dermadirect.com, create an account, place an order, contact us, subscribe to marketing communications or otherwise interact with Derma Direct Europe.

It also explains your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation.

1. WHO WE ARE

DERMA DIRECT EUROPE B.V. is responsible for the processing of personal data described in this Privacy Policy.

Legal name: DERMA DIRECT EUROPE B.V.
Registered seat: Amsterdam, The Netherlands
Business address: Walborg 2 A, 1082 AM Amsterdam, The Netherlands
KVK number: 42139264
VAT number: [INSERT VAT NUMBER]
Website: dermadirect.com
Email: info@dermadirect.com

For the purposes of the GDPR, DERMA DIRECT EUROPE B.V. is the data controller where we determine the purposes and means of processing your personal data.

---

2. PERSONAL DATA WE COLLECT

Depending on how you interact with us, we may collect the following categories of personal data.

Identity and Business Information

This may include:

• name;
• business or trading name;
• company registration information;
• VAT identification number;
• professional qualifications;
• training or certification information; and
• other information required to verify eligibility to purchase professional products.

Contact Information

This may include:

• billing address;
• delivery address;
• email address;
• telephone number; and
• other contact information you provide.

Order and Transaction Information

This may include:

• products purchased;
• order history;
• order value;
• invoices;
• payment status;
• delivery information;
• refunds;
• promotional codes used; and
• communications relating to your orders.

Payment Information

Payments may be processed by third-party payment providers.

We may receive limited information about a payment, such as payment status, payment method and transaction reference.

We do not necessarily receive or store complete payment-card details where these are processed securely by our payment provider.

Account Information

If you create an account, we may process:

• account username;
• encrypted or otherwise protected login credentials;
• account preferences;
• order history;
• saved addresses;
• VAT information; and
• qualification or business-verification information.

Website and Technical Information

When you use our website, we may collect information such as:

• IP address;
• browser type;
• device information;
• operating system;
• pages visited;
• referring website;
• date and time of access;
• website interactions; and
• cookie and similar technology information.

Communications

We may retain communications you send to us, including enquiries, complaints, product enquiries and customer-service correspondence.

---

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

• directly from you when you create an account;
• when you place an order;
• when you contact customer service;
• when you submit professional qualifications or business information;
• when you subscribe to marketing communications;
• when you participate in a promotion;
• automatically when you use our website;
• from payment processors and delivery providers;
• from publicly available business registers; and
• from third-party services used for legitimate business, verification, fraud-prevention or compliance purposes.

---

4. HOW WE USE PERSONAL DATA

We may use your personal data to:

• create and manage customer accounts;
• process and fulfil orders;
• process payments;
• issue invoices and credit notes;
• verify VAT information;
• verify professional or business eligibility;
• communicate about orders;
• provide customer service;
• investigate complaints;
• prevent and detect fraud;
• protect the security of our website and systems;
• maintain appropriate transaction and accounting records;
• comply with tax, regulatory and legal obligations;
• manage product safety notices and recalls;
• improve our website, products and services;
• analyse website usage and business performance;
• administer promotions and discount programmes;
• send marketing communications where permitted; and
• establish, exercise or defend legal claims.

We will not use your personal data for purposes that are incompatible with the purposes for which it was collected unless permitted or required by law.

---

5. LEGAL BASES FOR PROCESSING

Under the GDPR, we must have a lawful basis for processing personal data.

Depending on the circumstances, we may rely upon:

Performance of a Contract

We process information necessary to:

• create and manage your account;
• process an order;
• take payment;
• arrange fulfilment;
• provide customer service; and
• perform our contractual obligations.

Legal Obligation

We may process personal data where necessary to comply with legal obligations, including:

• tax and VAT requirements;
• accounting requirements;
• regulatory obligations;
• product-safety obligations; and
• lawful requests from authorities.

Legitimate Interests

We may process personal data where necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms.

These interests may include:

• operating and improving our business;
• preventing fraud;
• protecting our systems;
• verifying business customers;
• maintaining appropriate business records;
• understanding how our website is used;
• protecting our legal rights; and
• communicating with existing business customers where legally permitted.

Consent

Where consent is required, such as for certain marketing communications or non-essential cookies, we will request your consent.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

---

6. PROFESSIONAL QUALIFICATION VERIFICATION

Certain products offered by Derma Direct Europe may only be supplied to appropriately trained or qualified professionals.

We may therefore request and retain information necessary to verify professional eligibility.

This may include copies or details of:

• training certificates;
• professional qualifications;
• insurance information;
• business information; and
• other appropriate evidence of professional status.

This information may be used to determine whether an account is eligible to purchase restricted or professional-use products.

---

7. VAT AND BUSINESS VERIFICATION

As a B2B supplier operating from the Netherlands and supplying customers across the European Union, we may process business and VAT information to determine the appropriate tax treatment of transactions.

This may include:

• company name;
• registered business address;
• VAT identification number;
• country of establishment; and
• results of VAT-number verification.

Where appropriate, VAT identification numbers may be verified through official VAT verification systems.

We may retain evidence of these checks where necessary for accounting, tax and compliance purposes.

---

8. PAYMENT PROVIDERS

Payments made through dermadirect.com may be processed by third-party payment service providers.

These providers may process information necessary to authorise and complete your payment.

Payment providers may operate as independent data controllers for certain processing activities and will process information in accordance with their own privacy policies.

We recommend reviewing the privacy information provided by the relevant payment provider.

---

9. DELIVERY AND FULFILMENT PROVIDERS

Where necessary to fulfil an order, we may share relevant personal data with:

• warehouses;
• fulfilment providers;
• courier companies;
• postal operators;
• logistics companies; and
• customs or other authorities where applicable.

Information shared will normally be limited to what is reasonably necessary to process and deliver the order.

This may include your name, business name, delivery address, telephone number, email address and relevant shipment information.

---

10. SERVICE PROVIDERS

We may use third-party organisations to help operate our business.

These may include providers of:

• website hosting;
• e-commerce technology;
• payment processing;
• accounting;
• customer relationship management;
• email services;
• SMS services;
• marketing platforms;
• analytics;
• fraud prevention;
• IT support;
• cybersecurity;
• warehousing;
• logistics; and
• professional advisory services.

Where a provider processes personal data on our behalf, we require appropriate contractual and security safeguards in accordance with applicable data protection law.

---

11. MARKETING COMMUNICATIONS

Where permitted by law, we may send information about:

• products;
• promotions;
• special offers;
• new product launches;
• account benefits; and
• other Derma Direct Europe news.

Where consent is legally required, we will obtain it before sending such communications.

You can unsubscribe from marketing communications at any time by using the unsubscribe option included in the communication or by contacting us.

Opting out of marketing does not prevent us from sending necessary transactional or service communications relating to your account or orders.

---

12. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function, including functionality relating to:

• shopping baskets;
• checkout;
• account login;
• security; and
• website preferences.

Other technologies may be used for analytics, personalisation or advertising where permitted.

Where required by law, non-essential cookies will not be placed until appropriate consent has been obtained.

Further information about the cookies and technologies used on dermadirect.com should be provided through our Cookie Policy and cookie consent tool.

---

13. SHARING PERSONAL DATA

We do not sell personal data.

We may disclose personal data where reasonably necessary to:

• payment providers;
• couriers and logistics providers;
• warehouses and fulfilment partners;
• IT and hosting providers;
• accounting providers;
• professional advisers;
• fraud-prevention providers;
• manufacturers where necessary for product complaints or safety matters;
• regulatory bodies;
• tax authorities;
• courts or law-enforcement authorities; and
• other parties where required or permitted by law.

We may also disclose relevant information in connection with a merger, acquisition, restructuring, financing or sale of all or part of our business, subject to appropriate safeguards.

---

14. INTERNATIONAL DATA TRANSFERS

Some organisations that provide services to us may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will take appropriate steps to ensure the transfer complies with applicable data protection legislation.

Depending on the circumstances, safeguards may include:

• an adequacy decision adopted by the European Commission;
• approved Standard Contractual Clauses;
• another legally recognised transfer mechanism; or
• another applicable GDPR derogation where appropriate.

---

15. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, regulatory and contractual requirements.

Different categories of information may therefore be retained for different periods.

Transaction, invoice and accounting information may be retained for the period required under applicable Dutch tax and accounting legislation.

Information may also be retained for longer where reasonably necessary in connection with an ongoing dispute, investigation, product-safety matter or legal claim.

When personal data is no longer required, it will be deleted, anonymised or otherwise securely disposed of where appropriate.

---

16. DATA SECURITY

We implement appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• destruction; and
• misuse.

Access to personal data is restricted to employees, contractors and service providers who reasonably require access for legitimate business purposes.

No internet-based service can guarantee absolute security, but we take reasonable measures appropriate to the nature of the personal data we process.

---

17. YOUR GDPR RIGHTS

Subject to the conditions and limitations established by applicable law, individuals may have the right to:

• access personal data we hold about them;
• rectify inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• object to certain processing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent; and
• object to certain direct marketing activities.

These rights are not absolute and may not apply in every circumstance.

For example, we may need to retain certain transaction information to satisfy legal, accounting or tax obligations even where deletion has been requested.

To exercise a data-protection right, contact:

info@dermadirect.com

We may need to verify your identity before processing a request.

---

18. AUTOMATED DECISION-MAKING

We may use automated systems to assist with fraud prevention, payment security, account security or transaction risk assessment.

Where we carry out solely automated decision-making that produces legal or similarly significant effects and Article 22 GDPR applies, we will provide the information and safeguards required by applicable law.

---

19. CHILDREN

Derma Direct Europe is a professional and business-to-business supplier.

Our services and professional-use products are not directed at children.

We do not knowingly intend to collect personal data from children through professional customer accounts.

---

20. DATA PROTECTION COMPLAINTS

If you have concerns about how we process your personal data, please contact us first so that we have an opportunity to investigate the matter.

You also have the right to lodge a complaint with the Dutch data protection supervisory authority:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

You may also have the right to contact the supervisory authority in the EU Member State where you live, work or where an alleged infringement occurred.

---

21. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites, services or platforms.

Those organisations are responsible for their own processing of personal data.

We encourage you to review the relevant third party’s privacy policy before providing personal information.

---

22. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to:

• our business;
• our website;
• service providers;
• technology;
• data-processing activities; or
• applicable law.

The current version will be published on dermadirect.com together with its latest update date.

Where appropriate, we may provide additional notice of material changes.

---

23. CONTACT US

For questions about this Privacy Policy or the way we process personal data, please contact:

DERMA DIRECT EUROPE B.V.
Walborg 2 A
1082 AM Amsterdam
The Netherlands

KVK: 42139264
VAT: [INSERT VAT NUMBER]
Website: dermadirect.com
Email: info@dermadirect.com