Privacy policy
Last updated: 8 October 2026
This Privacy Policy explains how AG France SASU (brand Skinormil Dermaceutique) collects and uses your personal data when you visit skinormil.com or skinormil.fr, place an order, or subscribe to our communications, in accordance with the General Data Protection Regulation (GDPR – EU 2016/679) and the French Data Protection Act.
1. Data controller
AG France SASU, 7 Place de la Source, 92140 Clamart, France – RCS Nanterre 537 555 310.
Contact for any data protection question: hello@skinormil.com – +33 1 84 16 56 48.
2. Data we collect
Identity and contact details: name, postal address, email, telephone number.
Order data: products purchased, order history, delivery information, returns and exchanges.
Payment data: processed directly by our payment providers; we never receive your full card number.
Account and loyalty data: login details, preferences, loyalty points, referrals, date of birth if you choose to give it.
Communications: messages you send to customer service, reviews you publish.
Browsing data: IP address, device and browser information, pages viewed, cookies (see section 7).
We do not ask for health data. Please do not send us medical information that is not necessary to handle your request.
3. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Processing and delivering your orders, payments, returns, customer service | Performance of the contract |
| Invoicing and accounting | Legal obligation |
| Customer account and loyalty programme | Performance of the contract |
| Newsletters and promotional emails | Your consent, or our legitimate interest for existing customers about similar products (you can object at any time) |
| Basket and checkout reminders, post-purchase emails | Legitimate interest |
| Audience measurement and advertising cookies | Your consent |
| Fraud prevention and website security | Legitimate interest |
4. Who receives your data
Your data are only accessible to authorised AG France staff and to the service providers we use, acting on our instructions:
Shopify (website hosting, checkout and order management)
Payment providers (Shopify Payments, PayPal, Apple Pay, Google Pay)
Chronopost and other carriers (delivery)
Klaviyo (emails and newsletters)
BON Loyalty (loyalty and referral programme)
Review and analytics tools installed on the website, where applicable
We never sell your personal data. We may disclose data if required by law or by a competent authority. Shopify also processes certain data as an independent controller for its own services; see the Shopify Privacy Portal. You can object to the sharing of your data for targeted advertising here.
5. Transfers outside the European Union
Some providers (for example Shopify or Klaviyo) may process data outside the EU, in particular in the United States or Canada. These transfers are covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.
6. How long we keep your data
Customer data: for the duration of the commercial relationship, then 3 years after your last purchase or contact for marketing purposes.
Prospects (newsletter subscribers who never ordered): 3 years after the last contact or until you unsubscribe.
Invoices and accounting documents: 10 years (legal obligation).
Cookies: 13 months maximum; your consent choice is kept for 6 months.
7. Cookies
Strictly necessary cookies (basket, security, language) are always active. Audience measurement, personalisation and advertising cookies are only placed with your consent, which you can give or withdraw at any time via the cookie banner or the "Cookie preferences" link at the bottom of the website.
8. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, to withdraw your consent at any time, and to give instructions about what happens to your data after your death. You can unsubscribe from our emails at any time using the link at the bottom of each email.
To exercise your rights, write to hello@skinormil.com or to the postal address above. We reply within one month. We may ask for proof of identity if there is reasonable doubt.
If you consider that your rights have not been respected, you can lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 – www.cnil.fr, or with the data protection authority of your country of residence.
9. Security
We use appropriate technical and organisational measures to protect your data (encrypted HTTPS connection, PCI-DSS certified payment, restricted access). Please keep your account password confidential.
10. Minors
Our website is intended for adults. We do not knowingly collect data from children under 15 without the consent of a parent or guardian.
11. Changes
We may update this policy. The date at the top shows the latest version. In case of significant changes, we will inform you by email or on the website.