New Privacy Policy

CLAUSES

Introduction

This Privacy Notice describes Our policies and procedures on the collection, use and disclosure of your information when you use our services and tells you about your privacy rights and how the law protects you.

We use your Personal data to provide and improve our services. By using our services, you agree to the collection and use of information in accordance with this Privacy Notice.

We will only use your personal data for the purpose for which it was collected, unless We reasonably consider that it is necessary to use it for another purpose that is compatible with the original purpose. If We need to use your personal data for an unrelated purpose, We will notify you and explain the legal basis that allows Us to do so.

Who We Are

Irene Forte Skincare, or Forte Organics Ltd (“We”, “Us”, “Our” “The Company”) is the data controller for the personal data collected through this website.

Registered Office	22 Chancery Lane, London, England, WC2A 1LS
Company Registration	10941882
ICO Registration Number	ZA728460
Contact Details	compliance@ireneforteskincare.com

Definitions

For the purposes of this Privacy Notice:

Cookies are small files that are placed on your computer, mobile device or any other device by a website, containing the details of your browsing history on that website among its many uses

Country refers to: United Kingdom

Device means any device that can access our services such as a computer, a mobile phone or a digital tablet

Personal Data is any information that relates to an identified or identifiable individual.

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit)

Website refers to https://ireneforteskincare.co.uk/.

You means the individual accessing or using our services, or the company, or other legal entity on behalf of which such individual is accessing or using our services, as applicable

Types of Personal Data Collected

While using Our services, We may ask you to provide Us with personal data that can be used to contact or identify you. Personal data collected and processed includes:

Identity data, including full name, username, title, date of birth, gender, or any other identifiers that may be used to identify you.
Contact details, including billing and delivery addresses, phone number and email address.
Financial and transaction details, including payment details, and information about the products or services you have purchased from Us.
Profile data, including your username and password, purchase history, interests, service preferences and feedback through mechanisms such as surveys.
Technical and usage data, including login data, browsers used, time zone settings, operating systems used and IP address.
Marketing and communications preference details, including your preferences in receiving marketing or other communications from us and other third parties.

We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

We do not routinely or intentionally collect any Special Category Data or information regarding criminal convictions or offences.

Additionally, Our website is not intended for children, and We do not knowingly collect data relating to children. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18 without verification of parental consent, We take steps to remove that information from Our servers.

Where We need to collect personal data by law, or under the terms of a contract We have with you, and you fail to provide that data when requested, We may not be able to perform the contract We have or are trying to enter into with you.

Lawful Basis for Processing

Under UK GDPR We process data where We have a lawful basis to do so. We rely on:

Consent: where users consent to the processing data (e.g. marketing, cookies, newsletters)
Contract: where processing is necessary to provide the requested services
Legitimate Interest: website operation, security, service improvement etc.
Legal Obligation: financial and regulatory reporting, law enforcement requests

How We Collect Your Personal Data

We may collect Personal Data directly from you when you interact with us, including when you:

Create or use an account on Our website
Place an order or make a purchase
Contact Us with an enquiry, complaint, availability query or other request;
Request or receive an e-receipt;
Make a return or exchange;
Participate in a survey, customer research, competition, prize draw, promotional activity, or submit feedback
Subscribe to a product or service, including marketing communications

We may also collect Personal Data automatically when you use Our Website, including Technical and Usage Data, through cookies and similar technologies, as described further in Our Cookie Policy.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To deliver and maintain our Service, including to register your account, manage payments and fees, and to monitor the usage of our services
To notify you about changes to Our service, such as new features
To allow you to participate in interactive features of our service, including prize draws, surveys, and customer feedback
To provide customer care and support, so that We can assist you with queries or issues you may be experiencing, including processing returns, refunds and exchanges.
To provide analysis or valuable information so that We can improve Our service, such as website streamlining or changes to accessibility
To detect prevent and address technical issues, including website glitches and display problems
For the performance of a contract, including the development, compliance and undertaking of the purchase contract for Our services
To contact you, by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation
To provide you, with news, general information about other goods, services and events which We offer that are similar to those that you have already used or enquired about unless you have opted not to receive such information
To manage your requests to us, including complaints, availability queries and data rights requests
For other purposes, We may use your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of Our promotional campaigns and to evaluate and improve Our services, products, marketing and your experience

Marketing

We aim to provide you with choices and control regarding how We process your personal data for the purposes of providing marketing communications.

We may use your identity, contact, technical, usage, and profile data to profile you for marketing personalisation, including to form a view on what We think you may want or need, or what may be of interest to you. This profiling helps us identify and decide which products, services and offers may be relevant for you.

We will only send you marketing communications where We have obtained your prior consent to do so, or where We are otherwise permitted by applicable data protection laws. Where We rely on your consent, you have the right to withdraw it at any time. You can opt out of receiving marketing communications by following the unsubscribe instructions included any marketing communications or by contacting Us using the details set out in this Privacy Notice.

You have the right to object to profiling for direct marketing purposes at any time. For more information about your right to object, please see the Your Rights section of this Privacy Notice or contact us using the details provided.

Withdrawing your consent will not affect the lawfulness of any processing carried out prior to the withdrawal of consent.

Data Sharing

We may disclose Personal Data to the following categories of recipients where necessary for the purposes described in this Privacy Notice, including:

Service providers and processors, including providers of website hosting, e-commerce, payment processing, delivery, customer service, analytics, information technology, CRM, marketing and communications services;
Business partners, suppliers and subcontractors who support the operation of Our business;
Companies within Our group, where necessary for IT, administration, reporting, management or other legitimate business purposes;
Professional advisers, including lawyers, accountants, auditors, insurers, bankers and consultants;
Advertising, analytics and technology providers, where applicable, to help Us operate Our Website, understand how it is used, measure marketing effectiveness and provide relevant advertising;
Government authorities, regulators, law enforcement agencies and other public bodies, where required or permitted by law;
Parties involved in a corporate transaction, such as a merger, acquisition, restructuring, sale or transfer of all or part of Our business or assets; and

Where We use a third-party processor to process Personal Data on Our behalf, We require that processor to process the Personal Data only for specified purposes and in accordance with Our instructions and all applicable data protection laws.

Disclosure of Your Personal Data

Law Enforcement

Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

The Company may disclose your Personal Data in the good faith belief that such action is necessary to:

Comply with a valid request made by a public authority such as a court or government agency
Comply with a legal obligation
Protect and defend the rights or property of the Company
Prevent or investigate possible wrongdoing in connection with the Service
Protect the personal safety of Users of the Service or the public
Protect against legal liability

Transfer of Your Personal Data

Your information may be transferred to, and maintained on, computers located outside of the location in which it was collected, and the data protection laws in those locations may differ from those from your jurisdiction.

If data is transferred outside the UK, We ensure appropriate safeguards are in place, such as:

Adequacy decisions
EU Standard Contractual Clauses
The UK Addendum to the EU Standard Contractual Clauses, and
Transfer Risk Assessments
Any other relevant Data Protection Framework, such as the UK Extension to the EU-US DPF

The Company will take all steps reasonably necessary to ensure that your data is treated securely, and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place ensuring the security of your Personal Data.

If you would like further information or have concerns about the international transfer of your personal data or the safeguards We have implemented, please contact Us using the contact details provided in this Privacy Notice.

Retention of Your Personal Data

The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Notice. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations. We may also use it to resolve disputes and enforce our legal agreements and policies. Once the data is no longer required for any purpose, it will be securely disposed of or destroyed.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We will generally retain certain customer information, including Identity, Contact, Financial and Transaction Data, for up to 7 years after you cease to be a customer, where necessary to meet our legal, and regulatory obligations and requirements. The applicable retention period will vary depending on the nature of the Personal Data and the purpose for which it is processed.

Additionally, in for research, statistical and analytical purposes, We may anonymise your personal data, in which case We may use this information indefinitely without further notice to you.

Security of Your Personal Data

All reasonable measures will be taken to ensure the security of your personal data. This includes, but is not limited to:

Role Based Access Controls, including limiting access to Personal Data to employees, contractors, agents and service providers who have a legitimate business need to access it
Data Breach management procedures
Staff training
Data encryption

Although We will do our best to protect your personal data, the transmission of information via the internet is never completely secure, and We cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.

Your Rights

The UK GDPR sets out the following key rights applicable to data subjects:

The right of access: to request copies of your data which is held by the company
The right to rectification: to request the company correct any inaccurate data it holds
The right to erasure (also known as the ‘right to be forgotten’): to request the data held by the company is erased
The right to restrict processing: to request that the company stops processing your data
The right to data portability: to request that your data is provided to you or another entity
The right to object: to provide your objection to the company’s processing of your data
Rights with respect to automated decision-making and profiling: to ensure that any automated decision making is carried out correctly and can be reviewed if required by a human alternative. We do not carry out solely automated decision-making that produces legal effects or similarly significantly affects you in connection with our marketing activities.

To exercise any of your rights, please contact Us using the contact details provided in this Privacy Notice. You may make a request by email or, where appropriate, in writing. We may need to request additional information from you to verify your identity before fulfilling your request. This is a security measure designed to ensure that Personal Data is not disclosed to someone who is not entitled to receive it.

In line with our obligations, we will respond to a valid request within one month of receiving it. Where a request is particularly complex or We receive a large number of requests, this period may be extended where permitted by law. If this is necessary, We will let you know within the one-month period.

Some of these rights may only be applicable under certain circumstances or have exceptions. To exercise any of your rights please contact us via the email address above. Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Notice of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our website and store certain information to improve and analyse Our services. Further information can be found in our Cookie Policy.

Complaints

If your complaint relates to the handling, sharing or processing of your personal data please contact us in the first instance. We would like the opportunity to investigate and put this right so please contact at compliance@ireneforteskincare.com in the first instance, and We will be more than happy to review your query. A copy of our Data Complaints Procedure can be provided upon request.

If you are unhappy with the outcome of your complaint, and following the exhaustion of the appeals process, you may escalate this to the Information Commissioners Office who can be contacted at:

www.ico.org.uk/for-the-public/

The Information Commissioners Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

0303 123 1113

www.ico.org.uk

casework@ico.org.uk

Changes to this Privacy Notice

This policy is reviewed at least annually and, following any significant changes to processing activity or following regulatory/legislative changes and may be updated. We will notify you of any changes by posting the new Privacy Notice on this page. You are advised to review this Privacy Notice periodically for any changes. Changes to this Privacy Notice are effective when they are posted on this page.

This Privacy Notice was last updated in October 2026.