Privacy policy


Last updated: June 2026

This Privacy Policy explains how TAK ZONE LIMITED trading as Celsia Skin (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit celsiaskin.co.uk or place an order with us.

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about this policy or how we handle your data, please contact us at support@celsiaskin.co.uk.

1. What personal data we collect

We collect the following categories of personal data:

  • Identity and contact data: your name, email address, delivery address, billing address, and phone number
  • Product-user date of birth: when your order contains consultation-line, medical-grade skincare, we collect the date of birth of the person who will use the products, to verify they are 18 or over and to support safe, suitable product recommendations. This is stored with the order record. Legal basis: legal obligation and legitimate interests — UK GDPR Articles 6(1)(c) and 6(1)(f).
  • Order and transaction data: items purchased, order value, order history, and payment information (we do not store card numbers — these are processed directly and securely by our payment provider)
  • Communications data: the content of messages you send us by email or contact form
  • Technical and usage data: IP address, browser type, device type, pages visited, time spent on site, and referring URL — collected via cookies and analytics tools only where you have given consent
  • Marketing preferences: whether you have opted in to receive marketing emails from us
  • Cookie consent records: a record of the cookie choices you made via our consent banner

2. How we use your data and our legal basis

Purpose Legal basis (UK GDPR Article 6)
Processing and fulfilling your order, including dispatch and delivery Contract — Article 6(1)(b)
Sending order confirmations, dispatch notifications, and tracking updates Contract — Article 6(1)(b)
Processing returns and refunds Contract and legal obligation — Article 6(1)(b) and 6(1)(c)
Maintaining financial, tax, and accounting records Legal obligation — Article 6(1)(c)
Preventing fraud and ensuring payment security Legitimate interests — Article 6(1)(f)
Responding to customer service enquiries Legitimate interests — Article 6(1)(f)
Improving our website and understanding how visitors use it Consent — Article 6(1)(a) — only where you have accepted analytics cookies
Sending marketing emails about products, promotions, and skincare advice Consent — Article 6(1)(a) — only where you have opted in

3. Who we share your data with

We do not sell your personal data. We share it only where necessary with the following categories of recipient:

  • Shopify Inc. — our e-commerce platform provider, which hosts our store, processes orders, and powers our email marketing (Shopify Email) on our behalf. Shopify acts as our data processor and maintains appropriate UK-compliant data transfer safeguards. Shopify’s privacy policy is available at shopify.com/legal/privacy.
  • Payment processors — Shopify Payments (powered by Stripe) handles card transactions securely. Payment processors act as independent data controllers for the purpose of processing your payment. We never see or store your full card details.
  • Product suppliers and fulfilment partners — your delivery name and address are shared with our authorised product suppliers solely to pick, pack, and dispatch your order to you.
  • Courier and delivery companies — your name and delivery address are passed to the carrier responsible for delivering your order, along with any tracking reference.
  • Google LLC — where you have consented to analytics cookies, anonymised browsing data is shared with Google Analytics to help us understand how visitors use our site. Google’s privacy policy is available at policies.google.com/privacy.
  • Consentmo — our cookie consent management provider, which records and stores your cookie preferences on our behalf.
  • Legal and regulatory authorities — where we are required to do so by law, court order, or to protect the rights and safety of others.

4. International data transfers

Some of our service providers are based outside the UK. For example:

  • Shopify Inc. is headquartered in Canada, which has UK adequacy status — meaning UK data can be transferred there lawfully.
  • Google LLC is based in the United States. Where data is transferred, appropriate safeguards such as UK Standard Contractual Clauses apply.

We only transfer data outside the UK where we are satisfied that an adequate level of protection is in place.

5. How long we keep your data

  • Order and transaction records: 7 years from the date of purchase, as required by UK tax law
  • Customer accounts: for as long as your account is active, or until you request deletion
  • Marketing consent and communications: until you withdraw consent or unsubscribe, whichever comes first
  • Cookie consent records: 12 months
  • Website analytics data: up to 14 months
  • Customer service correspondence: up to 3 years

6. Cookies

We use cookies and similar tracking technologies on our website. Strictly necessary cookies are always active and cannot be turned off, as they are essential for the store to function (for example, your shopping cart and secure checkout). All other cookies — including analytics and marketing cookies — are only placed with your consent.

You can manage or withdraw your cookie consent at any time using the cookie preferences link in our website footer. For a full list of cookies we use and their purposes, please see our Cookie Policy.

7. Your rights under UK GDPR

You have the following rights in relation to your personal data. To exercise any of them, email us at support@celsiaskin.co.uk. We will respond within one calendar month.

  • Right of access — request a copy of the personal data we hold about you (a “Subject Access Request”)
  • Right to rectification — ask us to correct inaccurate or incomplete data
  • Right to erasure — ask us to delete your data where there is no longer a lawful basis to hold it
  • Right to restrict processing — ask us to pause certain uses of your data in specific circumstances
  • Right to data portability — receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract
  • Right to object — object to processing based on legitimate interests, or to direct marketing at any time
  • Right to withdraw consent — where we rely on your consent to process data, you may withdraw it at any time without affecting the lawfulness of prior processing

9. Consultation declarations & withdrawing consent (opt-out)

When you purchase consultation-line, medical-grade skincare, we record the declarations you accept (for example, confirmation of a prior professional consultation and your agreement to patch test) together with the date of acceptance. These are stored on your customer account and attached to your orders as a record of safe and suitable supply.

You can withdraw your consent at any time. To opt out, email support@celsiaskin.co.uk from your account email with the subject "Withdraw declarations" and we will remove the declarations from your account within one calendar month. Please note that withdrawing your declarations means consultation-line products can no longer be purchased on your account until a new consultation or declaration is completed, and records already attached to past orders may be retained where we have a legal basis to do so (for example, evidence of compliant supply).

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page will always reflect the most recent revision. Where changes are material, we will notify you by posting a notice on our website or, where appropriate, by email.

11. Contact us

For any questions or requests relating to this Privacy Policy or your personal data, please contact us: