Privacy & cookies
These policies apply to consumer purchases from KCJ Skin.
Company details & return address
KCJ Skin and kcjskin.nl are operated by the registered business below.
- Seller
- ATLN
- Business address
- Juliana van Stolberglaan 222, 2595 CN Den Haag, Nederland
- Return address
- Juliana van Stolberglaan 222, 2595 CN Den Haag, Nederland
- KvK number
- 42209289
- VAT number
- NL002511177B92
- Telephone
- +31 6 21321283
- info@kcjskin.nl
Accounts, support and orders
When you use an account, we process your email, profile, saved addresses, favourites and account activity to provide the service you request. Support and withdrawal messages include the contact and order information you submit. Supabase stores the application database in the EU; authorised staff handle support. Resend delivers sign-in and service emails. Account access and service requests rely on performance of a contract or steps at your request; security and handling enquiries also rely on our legitimate interests in protecting and operating the service. Order and accounting records may be required by law. Stripe handles payment details and provides transaction and order information. We do not store full card numbers in the storefront.
Google sign-in
If you choose Continue with Google, KCJ Skin receives your Google account identifier, email address and email-verification status, and basic profile details such as your name and profile-picture URL when available. We use these details to verify you, create or link your account, and fill your display name. We request only basic identity, email and profile access; this sign-in does not give us access to your Gmail messages, Google Drive files or contacts. Our sign-in service on Cloudflare processes Google’s response and passes the identity information to Supabase Auth, which verifies it and stores your linked identity and account metadata in our EU-hosted project. Google also processes your sign-in request under its privacy policy. The international-processing information below applies. We use Google sign-in data to provide and protect your account, not for advertising, sale or training AI models.
Your Google sign-in choices
Google sign-in is optional; you can use an email sign-in code instead. The account-service and security legal bases described above also apply to Google sign-in. We keep the linked identity and profile information as part of your account, subject to the account review, retention and deletion rules below. You can remove KCJ Skin’s connection in your Google Account settings and sign out of KCJ Skin separately. Removing the Google connection does not automatically erase your KCJ Skin account or records we already hold. Use your account’s privacy controls or contact info@kcjskin.nl to request deletion. Necessary legal records and provider logs or backups follow the limits described below.
Newsletter and consent
Newsletter emails require your separate, explicit consent when you sign up on the website. Buying or creating an account does not subscribe you. Withdraw consent using the unsubscribe link or account preferences without affecting earlier lawful processing. We keep the minimum consent and suppression information needed to evidence your choice and prevent unwanted mail.
Browser storage and cookies
Necessary storage remembers your bag, language and requested account session. Secure HttpOnly account cookies last up to one hour (access) and 30 days (refresh); the checkout receipt cookie lasts up to seven days. Guest favourites, routine plans and other saved browser data can remain in local storage until you clear them. Account and provider records are not erased by clearing your browser. Cloudflare Turnstile processes technical information for anti-abuse checks. Optional analytics is described below. Advertising features are disabled.
Optional Google Analytics
With your permission, we use Google Analytics to understand visits to public pages. Google receives the page address without search text, URL parameters or fragments, technical usage information and analytics cookie identifiers. Session and engagement events can accompany page views. We do not send form contents, account details or adviser conversations, and measurement is paused on private and unknown pages. Advertising features and enhanced measurement are disabled. You can refuse without losing store functions, or change and withdraw your choice using Cookie preferences in the footer. We remember this browser choice for 180 days when storage is available; analytics cookies are configured to expire after 180 days without renewal. Withdrawal stops future measurement, removes analytics cookies from this browser and may reload the page. It does not automatically erase previously collected data. On 2 November 2026, we set retention for Analytics user and event data to two months, with renewal on new activity off; Google applies changes after 24 hours. Standard aggregated reports are not subject to that retention setting. Google may process data outside the EEA. See Google’s privacy information and contact info@kcjskin.nl for questions or requests about your data.
AI adviser and hosting
The adviser sends your question, selected products and a limited recent conversation context to Cloudflare Workers AI. The current conversation can remain in this browser tab through session storage until it is cleared or the tab closes. We do not save a chat history in our application database. Vercel and Cloudflare serve and protect the website and process technical request data. Do not submit medical records, passwords or payment-card details. The adviser does not make legally significant decisions about you. Providers may process data outside the EEA. Resend states that it stores email content and delivery logs in the United States; Supabase may use globally located support staff even when the application database is hosted in the EU. The providers’ published data-processing terms describe transfer safeguards, including EU Standard Contractual Clauses where applicable. Ask info@kcjskin.nl for information and copies of the safeguards relevant to your data.
Retention and your rights
We review stored personal data manually each month and remove it when it is no longer needed, or record why it must be kept and when we will review it again. Required accounting records are generally kept for the applicable Dutch seven-year period; the period starts when the information ceases to be current. A ten-year period applies to transactions covered by Union/import OSS where applicable. This does not mean we keep every message for seven years. Optional account data is reviewed after 24 months without meaningful activity; we give 30 days' notice before closing an inactive account. Ordinary resolved enquiries are reviewed after 12 months and nonfinancial details of closed returns or complaints after 24 months. Unconfirmed newsletter signups are reviewed after 30 days; active subscriptions remain until withdrawal. We review consent evidence 24 months after unsubscribe and suppression information annually while marketing continues. Redundant sent-email copies are reviewed after 90 days, inactive rate-limit counters after 30 days and staff audit records after 12 months. Necessary contractual evidence and information for an active legal claim are kept separately for as long as the relevant obligation requires. Closing an account or clearing browser storage does not erase mandatory records. Provider logs and backups follow their applicable retention and deletion arrangements; contact info@kcjskin.nl for the arrangements relevant to your request. This is a manual review process, not an automatic purge. Ask info@kcjskin.nl for access, correction, erasure, restriction, portability or to object where the relevant right applies. We may ask proportionate verification, not a full identity document by default. We respond within one month; a lawful extension of up to two further months will be explained within the first month. You may complain to the Autoriteit Persoonsgegevens or your competent supervisory authority. Essential service data is needed to provide the requested account, order or support function.