Privacy policy

PRIVACY POLICY

17 September 2026

This Privacy Policy explains how we collect, use, share and protect your personal information when you visit drmelaxin.uk (the "Site"), buy from us, contact us, or otherwise interact with us online, including through our emails and social media (together, the "Services").

We are committed to handling your personal information in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR"), each as amended, including by the Data (Use and Access) Act 2025.

1. WHO WE ARE

The Site is operated by [BRAND501 Corp. – insert exact registered legal name], a company incorporated in the Republic of Korea (company registration number [●]), whose registered office is at [insert full registered address] ("Dr.Melaxin", "we", "us" or "our").

We are the "controller" of your personal information, which means we decide how and why it is used.

UK representative: Because we are established outside the UK, we have appointed [insert name of UK representative] as our representative in the UK under Article 27 of the UK GDPR. You can contact them at [insert UK postal address] or [insert email address].

Contact us: agent@brand501.com
Postal address: [insert full postal address, including street name and number], United Kingdom

We have not appointed a Data Protection Officer because we are not legally required to do so. Please send any privacy questions to the contact details above.

2. SCOPE OF THIS POLICY

This Policy applies to personal information we collect through the Site and the Services.

If you buy our products through third-party retailers or marketplaces (for example Amazon, TikTok Shop or Boots), those businesses collect your information under their own privacy notices. Where we receive your information from them (for example, to fulfil an order or answer a query), we will handle it in line with this Policy.

3. THE PERSONAL INFORMATION WE COLLECT

Information you give us:
• Identity and contact details: your name, postal address, email address and phone number.
• Order details: billing and delivery addresses, the products you buy, payment confirmation and order history. We do not store your full payment card details; these are handled by our payment providers.
• Account details: your login email and password (stored in encrypted form) and your preferences.
• Customer service information: anything you include when you contact us, including by email, live chat or social media.
• Reviews and content: product reviews, ratings, photos and other content you choose to submit.
• Marketing preferences: whether you want to receive marketing from us and how.
• Skin information: if you choose to tell us about your skin type or skin concerns (for example, through a skin quiz or when asking for product advice), we use this only to give you recommendations or to respond to you. Where this information reveals a health condition, we will only use it with your explicit consent, which you can withdraw at any time.

Information we collect automatically:
• Technical and usage information: your IP address, device and browser type, operating system, pages viewed, links clicked, referring website and how you interact with our Site and emails. We collect this using cookies, pixels and similar technologies (see Section 6).

Information we receive from third parties:
• Shopify, which provides our online store platform.
• Payment providers, who confirm whether a payment has been authorised and may share fraud-check results.
• Delivery and fulfilment partners, who share delivery status updates.
• Marketplaces and retailers, as described in Section 2.
• Advertising and social media platforms (such as Meta, Google and TikTok), which may share information about how you interacted with our adverts or content, in line with your settings on those platforms.
• Affiliate and creator partners, who may share information showing that you reached our Site through their link or code.

4. HOW AND WHY WE USE YOUR INFORMATION (AND OUR LAWFUL BASES)

Under UK data protection law, we must have a lawful basis for each way we use your personal information. The table below sets out our purposes and the lawful basis we rely on for each.

• To process your order, take payment, arrange delivery, and handle returns, exchanges and refunds.
  Lawful basis: performance of a contract with you; legal obligation (to keep tax and accounting records).

• To create and manage your account.
  Lawful basis: performance of a contract with you.

• To send you service messages about your order, delivery or account.
  Lawful basis: performance of a contract with you.

• To respond to your questions, requests and complaints.
  Lawful basis: performance of a contract with you; our legitimate interests in providing good customer service; legal obligation (for data protection requests and complaints).

• To send you marketing by email or text message about our products, offers and news.
  Lawful basis: your consent. Where you have bought from us before, we may email you about similar products unless you opt out (the "soft opt-in" under PECR), based on our legitimate interests in promoting our products. You can unsubscribe at any time using the link in every email or by replying STOP to texts.

• To show you personalised advertising on other websites and social media platforms, and to measure how well our adverts work.
  Lawful basis: your consent, which you give through our cookie banner.

• To understand how visitors use our Site and to improve it.
  Lawful basis: our legitimate interests in running and improving our Site; your consent where the law requires it for the cookies involved.

• To publish reviews and content you submit.
  Lawful basis: your consent; our legitimate interests in sharing genuine customer feedback.

• To run promotions, giveaways, surveys and product sampling.
  Lawful basis: performance of a contract (the promotion terms); our legitimate interests in engaging with our customers.

• To prevent fraud, keep our Site secure and protect our customers.
  Lawful basis: our legitimate interests in preventing fraud and misuse; legal obligation.

• To comply with the law, deal with legal claims, and in connection with any sale, merger, investment or restructuring of our business (including sharing information with prospective buyers or investors and their advisers under confidentiality obligations).
  Lawful basis: legal obligation; our legitimate interests in protecting and developing our business.

Legitimate interests: Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can ask us for more information about this balancing assessment, and you have the right to object (see Section 9).

Information you must provide: We need certain information (such as your name, delivery address and contact details) to process your order. If you do not provide it, we will not be able to complete your purchase. Providing information for marketing, reviews or skin quizzes is optional.

Automated decision-making: We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our payment providers may use automated checks to help detect fraud. If your order is declined as a result and you believe this is wrong, please contact us and we will arrange for a person to review it.

5. WHO WE SHARE YOUR INFORMATION WITH

We only share your personal information where necessary and, where we use service providers, under contracts that require them to protect it and use it only on our instructions.

• Service providers acting on our behalf: our e-commerce platform (Shopify), website hosting and IT providers, fulfilment and warehousing partners, delivery companies, email and SMS marketing platforms, customer service tools, review platforms and analytics providers.
• Payment providers: to process your payments and prevent fraud. Some payment providers act as independent controllers and use your information under their own privacy notices.
• Advertising and social media platforms: if you consent to advertising cookies, platforms such as Meta, Google and TikTok may receive information about your use of our Site. They use it under their own privacy notices.
• Our group companies: including our head office in the Republic of Korea, for business administration, customer service and reporting.
• Professional advisers: such as lawyers, accountants, auditors and insurers.
• Prospective buyers, investors and their advisers: in connection with a sale, merger, investment or restructuring of our business, under confidentiality obligations.
• Authorities and others where required by law: such as HM Revenue & Customs, the police, courts or regulators, or to protect our rights, our customers or others.

A list of our key service providers is available on request.

We do not sell your personal information.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies, pixels and similar technologies on our Site. These fall into the following categories:

• Strictly necessary: needed for the Site to work, for example to keep items in your basket and process checkout. These do not require your consent.
• Functional and analytics: help us remember your preferences and understand how the Site is used so we can improve it. Where the law requires your consent for these, we will ask for it; otherwise, you can object at any time through our cookie settings.
• Advertising: used by us and our advertising partners to show you relevant adverts and measure their effectiveness. We only use these with your consent.

When you first visit our Site, our cookie banner lets you accept or reject non-essential cookies. You can change your choices at any time here: [insert link to cookie preferences]. You can also block or delete cookies through your browser settings, although parts of the Site may not work properly if you do.

For information about the cookies used to power our Shopify store, see https://www.shopify.com/legal/cookies.

7. INTERNATIONAL TRANSFERS

Our head office is in the Republic of Korea, and some of our service providers are located outside the UK, including in the United States and the European Economic Area. This means your personal information may be transferred to, stored in, and accessed from those countries.

Where we transfer personal information outside the UK, we make sure it is protected by one of the following:
• UK adequacy regulations, which recognise that the destination country (such as the Republic of Korea or countries in the European Economic Area) provides an adequate level of protection;
• for recipients in the United States, the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it; or
• the UK International Data Transfer Agreement, or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum.

You can contact us for more information about the safeguards we use.

8. HOW LONG WE KEEP YOUR INFORMATION

We only keep your personal information for as long as we need it for the purposes described in this Policy. In particular:

• Order and transaction records: up to 6 years after the end of the financial year in which the transaction took place, to meet our tax (including VAT) and accounting obligations.
• Account information: for as long as your account is active. If your account is inactive for [24] months, or you ask us to close it, we will delete or anonymise your account information, except for records we must keep by law.
• Customer service records: up to [3] years after our last contact with you.
• Marketing information: until you unsubscribe or withdraw consent. After that, we keep a minimal record of your email address or phone number on a suppression list so that we do not contact you again.
• Reviews and content: for as long as they are published on our Site, or until you ask us to remove them.
• Cookie information: for the periods set out in our cookie settings.
• Information relevant to legal claims: up to 6 years after the matter ends, in line with legal limitation periods.

When we no longer need your information, we securely delete it or anonymise it so that it can no longer identify you.

9. YOUR RIGHTS

Under UK data protection law, you have the following rights:

• Right of access: to request a copy of the personal information we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete information.
• Right to erasure: to ask us to delete your information in certain circumstances.
• Right to restrict processing: to ask us to limit how we use your information in certain circumstances.
• Right to data portability: to receive information you have given us in a structured, commonly used, machine-readable format, or to ask us to transfer it to another organisation, where technically feasible.
• Right to object: to object to our use of your information where we rely on legitimate interests. You have an absolute right to object to direct marketing at any time.
• Rights related to automated decision-making: to request human review of, express your view on, and contest a significant decision made about you based solely on automated processing.
• Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

To exercise any of these rights, please contact us at agent@brand501.com. We will not charge a fee in most cases.

We will respond within one month of receiving your request. We may extend this by up to two further months if your request is complex or you have made a number of requests, and we will tell you if so. We may need to ask you for information to confirm your identity, or to clarify your request; in that case, the time limit starts once we receive what we need. When searching for information in response to an access request, we will carry out reasonable and proportionate searches.

These rights are not absolute, and in some cases we may be entitled to refuse your request, in which case we will explain why.

10. COMPLAINTS

If you are unhappy with how we have handled your personal information, you have the right to complain to us. You can do so by emailing agent@brand501.com or by using our online complaints form: [insert link to data protection complaints form].

We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay, keep you informed of our progress, and tell you the outcome.

You also have the right to complain to the UK Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the chance to address your concerns before you approach the ICO.

11. SECURITY

We use appropriate technical and organisational measures to protect your personal information against loss, misuse and unauthorised access, including encryption during payment and access controls. However, no method of transmission over the internet is completely secure. If you have an account, please keep your password confidential and contact us immediately if you think your account has been compromised.

If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the ICO within 72 hours where required and will inform you without undue delay where the law requires.

12. CHILDREN

Our Site and products are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. REVIEWS AND PUBLIC CONTENT

If you post a review or other content in a public area of our Site, it will be visible to anyone. Please do not include personal information you do not want to share publicly. You can ask us to remove content you have posted at any time.

14. THIRD-PARTY WEBSITES

Our Site may contain links to third-party websites and social media platforms. We are not responsible for their privacy practices, and we encourage you to read their privacy notices. Including a link does not mean we endorse that website.

15. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes to our practices or to the law. We will post the updated version on this page and change the "Last updated" date. If we make significant changes, we will tell you by email or through a notice on our Site where appropriate.

16. CONTACT US

If you have any questions about this Policy or how we handle your personal information, please contact us:

Email: agent@brand501.com
Post: [insert full postal address], United Kingdom
UK representative: [insert name, postal address and email address]