Privacy Policy

We are the controller of the personal information described in this policy.

Kanti Skincare is the trading name of Kanti Skincare Ltd, a company registered in England and Wales. Where these policies say "Kanti", "we", "us" or "our", they mean that company.

• Registered office: Suite 14, St Hugh's House, Bootle, Liverpool, L20 3QQ
• Company number: 16205078
• We are not registered for VAT.
• Email: info@kantiskincare.com
• Phone: 07599 929305

For any question about this policy or your information, email info@kantiskincare.com.

• When you place an order: the products you bought, the prices paid, any discount code used, your delivery address, and the order and delivery status, including the courier and tracking number once dispatched. Our payment provider, Stripe, collects your name, email address and card details on its secure checkout page and passes your name and email to us so we can send you your order confirmation. We never receive or store your full card details.
• When you create an account or sign in: your email address, and your name if you choose to add it. We send you a one-time sign-in link instead of using a password.
• When you shop as a guest: we create an anonymous guest record linked to a cookie on your device so that your basket works. It does not contain your name or email address.
• When you subscribe to our emails: your email address, when you subscribed and where on the site you signed up. When we send you a marketing email, we record whether it was delivered, opened and whether a link in it was clicked.
• When you email us: your email address, and whatever you choose to tell us.
• Technical information: to protect our forms from automated abuse, your IP address is checked when you sign in or subscribe, and is processed by Cloudflare for the same purpose (see section 5). It is not stored in our database.

We do not use analytics, advertising or tracking cookies, and we do not sell your information.

Data protection law requires us to have a legal basis for each use of your information:

• To take, fulfil and deliver your order, send order and dispatch emails, and handle cancellations, returns and refunds: to perform our contract with you.
• To run your account and keep your basket working: to perform our contract with you, or to take steps at your request before entering into one.
• To keep records of sales for tax and accounting purposes: to comply with our legal obligations.
• To protect the site from fraud, spam and automated abuse, and to keep it secure: our legitimate interests in running a safe shop.
• To send you marketing emails: your consent, which you give when you subscribe and can withdraw at any time.
• To decide which marketing emails are relevant to you, for example by reference to whether you have bought from us before, which products you bought or how much you have spent with us in total: your consent to marketing, and our legitimate interest in not sending you irrelevant emails. This does not have any legal or similarly significant effect on you.
• To reply to your enquiries and deal with complaints: our legitimate interest in helping our customers, or our contract with you where it concerns an order.

Where we rely on legitimate interests, we have considered your rights and expectations, and you can object at any time (see section 7).

We only send marketing emails if you have subscribed. Every marketing email contains a link to unsubscribe, which takes effect immediately; you can also email us to unsubscribe. If an email to you bounces or is reported as spam, we stop sending marketing to that address.

Our marketing emails contain technology that tells us whether an email was opened and whether a link was clicked. We use this to understand which emails are useful and to keep our mailing list healthy. If you would rather we did not, you can unsubscribe, or set your email app to block images, which prevents open tracking.

Order confirmations, dispatch notices and sign-in links are service emails, not marketing. You will receive them whether or not you subscribe.

We use a small number of trusted service providers, who process information on our behalf and only on our instructions:

• Stripe (payment processing). Stripe is also an independent controller of payment information it collects, for fraud prevention and its own legal obligations, under its own privacy policy.
• Resend (sending sign-in, order and marketing emails, and reporting their delivery).
• Vercel (website hosting).
• Neon (database hosting, in London).
• Cloudflare Turnstile (protecting our sign-in and subscribe forms from automated abuse).
• Our delivery courier (your name and delivery address, to deliver your order).

We may also share information where the law requires it, for example with HMRC, or to protect our legal rights. If our business is ever sold or restructured, your information may pass to the new owner, who must use it in line with this policy.

Some of our providers (Stripe, Resend, Vercel and Cloudflare) are based in, or use servers in, the United States and other countries outside the UK. Where information is transferred outside the UK, it is protected by safeguards recognised under UK data protection law, such as the UK-US data bridge or the International Data Transfer Agreement and Addendum issued by the Information Commissioner's Office (ICO). You can ask us for more detail.

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use your information;
• object to our use of your information where we rely on legitimate interests, and to any use for direct marketing;
• ask us to transfer information you have given us to you or another organisation, in a commonly used format;
• withdraw your consent to marketing at any time. This does not affect anything we did before you withdrew it.

To use any of these rights, email info@kantiskincare.com. We will respond within one month, and may ask you to confirm your identity first. There is no charge.

Some rights have limits. For example, we must keep records of orders for tax purposes even if you ask us to delete your account, but we will delete everything else and stop using what we keep for any other purpose.

• Order records: six years from the end of the financial year in which the order was placed, as required for tax and accounting.
• Account information: for as long as you have an account. You can ask us to close it at any time.
• Guest basket records: until they are no longer needed to support an order, and in any case no longer than 12 months.
• Marketing subscription: until you unsubscribe. After that we keep your email address and the dates you subscribed and unsubscribed, so that we do not email you again by mistake and can show when you gave and withdrew consent.
• Email enquiries: up to 2 years after the matter is resolved.

We use only cookies that are strictly necessary for the site to work, so we do not ask for cookie consent:

• a sign-in session cookie, which keeps you signed in (lasts up to 30 days);
• a guest cookie, which keeps your basket working if you shop without signing in (lasts up to 30 days, and is removed when you sign in);
• short-lived security cookies set during sign-in, which protect against forged requests and return you to the page you came from.

Cloudflare Turnstile runs on our sign-in and subscribe forms to check that you are a person rather than an automated program. It may process information about your browser and device for that purpose only.

We do not use analytics, advertising or social media cookies.

Our site is served over an encrypted connection, payments are handled entirely by Stripe, and access to customer information is limited to the people who need it to run the shop.

If you are unhappy with how we have used your information, please tell us first by emailing info@kantiskincare.com. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

We will update this policy if what we do with your information changes. The date at the top shows when it was last updated. If a change is significant, we will tell you by email where we can.