Privacy Policy

Last updated: July 13, 2026

This Privacy Policy explains how Galbraith Teck LLC, trading as Dr. Dermaluci Lab, collects, uses, shares and protects personal data when you visit www.dermalucilab.com, place or receive an order, contact us, subscribe to marketing, submit content or otherwise interact with Dr. Dermaluci Lab.

This Policy should be read together with our Cookie Policy and Terms & Conditions.

Nothing in this Policy limits any privacy right granted by mandatory applicable law.

1. WHO WE ARE

The controller responsible for the personal data described in this Policy is:

Galbraith Teck LLC
Trading as Dr. Dermaluci Lab
8206 Louisiana Blvd NE, Suite A358
Albuquerque, New Mexico 87113
United States

Italian VAT ID: IT03941810040
Email: info@dermalucilab.com
Telephone: +1 786 746 0983
Website: www.dermalucilab.com

Galbraith Teck LLC determines why and how personal data is processed in connection with the Website and its commercial activities.

2. EUROPEAN UNION REPRESENTATIVE

Our representative in the European Union under Article 27 GDPR is:

BCS EU Ltd
Blvd. Patriarh Evtimiy 49
1463 Sofia
Bulgaria
UIC: 206825820
Email: info@dermalucilab.com

Individuals in the European Economic Area may contact either Galbraith Teck LLC or the EU Representative regarding the processing of their personal data.

3. PERSONAL DATA WE COLLECT

Depending on how you interact with us, we may collect the following categories of personal data.

Identity and contact data

This may include:

· full name;

· billing and delivery address;

· email address;

· telephone number;

· country and language;

· details of another person receiving an order.

Order and transaction data

This may include:

· Products ordered;

· order value;

· discounts and promotional codes;

· delivery method;

· transaction identifiers;

· payment, delivery, return and refund status;

· invoice and tax information;

· order history.

Complete payment-card numbers and security codes are processed by our payment providers and are not normally stored by Dr. Dermaluci Lab.

Account data

Where customer-account functionality is used, we may process:

· account and authentication identifiers;

· saved addresses;

· order history;

· account preferences.

Communications and Customer Care data

This may include:

· emails, chat messages and contact-form submissions;

· enquiries, complaints and support requests;

· return and refund communications;

· photographs, videos or documents submitted in support of a request;

· records of our responses.

Marketing and preference data

This may include:

· email or SMS subscriptions;

· marketing consent;

· communication preferences;

· campaign interactions;

· unsubscribe and opt-out records.

Reviews and submitted content

This may include:

· reviews and ratings;

· photographs or videos;

· testimonials;

· social-media handles;

· other content submitted or authorised for publication.

Affiliate, ambassador and creator data

This may include:

· application and profile details;

· social-media accounts;

· referral links and discount codes;

· campaign performance;

· commission and payment information;

· programme communications.

Device and Website-usage data

This may include:

· IP address;

· browser, device and operating-system information;

· approximate location derived from IP address;

· pages viewed and links selected;

· cart and checkout activity;

· referral source;

· cookie, pixel and advertising identifiers;

· session and interaction information;

· security and fraud-prevention signals.

Product-safety information

If you report an adverse reaction, sensitivity or other product-safety concern, you may voluntarily provide information concerning symptoms, Product use, photographs or medical advice received.

We collect only the information reasonably necessary to investigate and manage the report.

4. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

· directly from you;

· automatically through cookies, pixels and similar technologies;

· through Shopify and the applications used to operate the store;

· from payment, delivery and fulfilment providers;

· from advertising, analytics and social-media platforms;

· from affiliate, ambassador or referral partners;

· from publicly available sources where lawful;

· from another person who provides your information as the recipient of an order.

Where another person provides your information, they are responsible for ensuring that they are permitted to do so.

5. WHY WE USE PERSONAL DATA

We process personal data only where an appropriate legal basis applies.

Where we rely on legitimate interests, those interests may include operating and improving the business, preventing fraud, protecting customers and the Website, managing commercial relationships and establishing or defending legal claims.

We consider whether the processing is necessary and proportionate and whether your rights override our interests.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. INFORMATION REQUIRED TO PROCESS AN ORDER

Certain personal data is necessary to enter into and perform a purchase contract, including:

· your name;

· contact details;

· billing and delivery information;

· payment information;

· information required to fulfil and deliver the order.

If you do not provide the required information, we may be unable to accept, process, deliver or provide support for the order.

Information provided for marketing, reviews, surveys, affiliate programmes or promotional activities is generally optional.

7. MARKETING, COOKIES AND ADVERTISING

We may send promotional emails or SMS messages where you have subscribed or where another lawful basis permits us to do so.

You may unsubscribe at any time by:

· using the unsubscribe link in an email;

· following the opt-out instructions in an SMS;

· changing available communication preferences;

· contacting info@dermalucilab.com.

We may retain limited suppression information after you unsubscribe so that your preference continues to be respected.

Order confirmations, delivery updates, safety notices and responses to Customer Care requests are service communications and are not marketing.

We also use cookies, pixels and similar technologies to:

· operate essential Website functions;

· remember preferences and cart contents;

· protect the Website and prevent fraud;

· measure Website performance;

· understand visitor activity;

· measure advertising and affiliate campaigns;

· personalise content or advertising where permitted.

Relevant providers may include Shopify, Google, Meta, TikTok, Microsoft and our email, analytics, advertising and affiliate service providers.

Where consent is legally required, non-essential analytics, advertising and personalisation technologies are used in accordance with the choices made through the cookie banner.

You can review or change available choices through the Website’s cookie settings. Further information is provided in our Cookie Policy.

8. WHEN WE SHARE PERSONAL DATA

We may share personal data with the following categories of recipients where reasonably necessary.

Ecommerce and technology providers

This includes Shopify and providers supporting Website hosting, checkout, customer accounts, translation, automation, security and technical maintenance.

Payment providers

Payment and transaction information may be processed by providers including Stripe and PayPal.

These providers may process certain information under their own legal obligations and privacy notices.

Fulfilment and delivery providers

We share the information required to prepare, dispatch, deliver, track or return an order with warehouses, fulfilment partners and carriers.

Marketing, analytics and advertising providers

Where permitted, information may be processed by providers supporting email and SMS marketing, Website analytics, campaign measurement, audience creation and advertising.

Review, affiliate and creator platforms

Information may be shared where necessary to administer reviews, referrals, affiliate commissions, ambassador programmes or creator campaigns.

Professional advisers and authorities

We may share information with accountants, legal advisers, auditors, insurers, regulators, courts, customs authorities, tax authorities or law-enforcement bodies where legally required or reasonably necessary.

Business transactions

If all or part of the business is sold, reorganised, financed or transferred, information may be disclosed to relevant advisers, prospective purchasers or successor entities subject to appropriate confidentiality and legal safeguards.

Some third parties, such as payment providers, social-media platforms and advertising providers, may act as independent controllers for certain processing and apply their own privacy notices.

9. INTERNATIONAL DATA TRANSFERS

The Shopify data-storage location for the store is currently set to the European Union.

However, personal data may still be accessed, transferred or processed in the United States, the United Kingdom, Canada or other countries where Galbraith Teck LLC, Shopify or other service providers operate.

Where required, we and our service providers rely on recognised transfer mechanisms, which may include:

· an adequacy decision;

· Standard Contractual Clauses;

· the UK International Data Transfer Agreement or UK Addendum;

· binding corporate rules;

· another safeguard or legal exception permitted by applicable law.

You may contact us for further information about the safeguards applicable to a particular transfer.

10. HOW LONG WE KEEP PERSONAL DATA

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy.

Retention periods are determined according to:

· the nature and sensitivity of the information;

· the purpose for which it was collected;

· the duration of the customer or commercial relationship;

· applicable tax, accounting and consumer-protection requirements;

· Product-safety and regulatory obligations;

· limitation periods for legal claims;

· fraud-prevention and security requirements.

In general:

· order, invoice, payment and tax records are retained for the period required by applicable law;

· Customer Care, complaint, delivery and refund records are retained until the matter is resolved and for an appropriate period afterwards;

· marketing information is retained until consent is withdrawn or the information is no longer required;

· suppression records may be retained to ensure that an opt-out continues to be respected;

· affiliate and creator records are retained for the relationship and any applicable accounting or legal period;

· Product-safety information may be retained for the period required to investigate and document the incident;

· cookie and analytics information is retained according to the relevant technology and settings described in the Cookie Policy.

When personal data is no longer required, it may be deleted, anonymised or securely isolated.

11. AUTOMATED PROCESSING

We may use automated tools to:

· identify potentially fraudulent or unauthorised transactions;

· analyse Website and campaign performance;

· create advertising audiences;

· personalise marketing or Product recommendations;

· attribute purchases to advertisements, affiliates or referral partners.

Payment, fraud-prevention and advertising providers may also perform automated processing under their own privacy notices.

We do not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards.

Where applicable law grants rights concerning such a decision, you may request information, express your point of view and request human review.

12. YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have the right to:

· request access to your personal data;

· request correction of inaccurate or incomplete data;

· request deletion;

· request restriction of processing;

· receive certain information in a portable format;

· object to processing based on legitimate interests;

· object at any time to direct marketing;

· withdraw consent at any time;

· request information about international-transfer safeguards;

· exercise rights concerning qualifying automated decisions;

· lodge a complaint with a competent supervisory authority.

To exercise a right, contact:

info@dermalucilab.com

Please describe the request clearly and provide sufficient information for us to identify the relevant records.

We may request reasonable proof of identity before completing the request. That information will be used only to verify the request.

Privacy rights may be subject to legal limitations. For example, we may retain information required for tax, fraud-prevention, Product-safety or legal-claim purposes even where deletion is requested.

We will respond within the period required by applicable law.

Complaints in the European Economic Area

You may lodge a complaint with the data-protection authority in the country where you:

· habitually reside;

· work;

· believe an infringement occurred.

Complaints in the United Kingdom

You may lodge a complaint with the UK Information Commissioner’s Office.

You may contact us before submitting a complaint, but you are not required to do so.

13. UNITED STATES PRIVACY RIGHTS

Residents of certain United States states may have additional rights under applicable state privacy laws, including rights to:

· access or correct personal data;

· request deletion;

· obtain a portable copy;

· opt out of qualifying targeted advertising, sale or sharing;

· appeal certain decisions concerning a privacy request;

· exercise privacy rights without unlawful discrimination.

Under certain state laws, the use of advertising cookies or pixels may qualify as a “sale,” “sharing” or targeted advertising even where no money is exchanged for personal data.

Where applicable, you may use the Data Sharing Opt-Out page available through the Website or contact info@dermalucilab.com.

14. PRODUCT-SAFETY AND HEALTH INFORMATION

We do not request health information as part of an ordinary purchase.

If you report an adverse reaction or safety concern, you may voluntarily provide health-related information.

We use that information only where reasonably necessary to:

· respond to you;

· investigate the reported incident;

· identify the Product and batch;

· comply with Product-safety or regulatory obligations;

· communicate with manufacturers, insurers or competent authorities;

· establish, exercise or defend legal claims.

Where the information constitutes special-category data, we process it only where both an appropriate general legal basis and an additional condition for sensitive data apply, including explicit consent where required.

Do not send unrelated medical records or unnecessary health information.

15. CHILDREN’S PRIVACY

The Website is not directed at children, and we do not knowingly collect personal data from children for marketing or advertising purposes.

If you believe that a child has provided personal data without appropriate authorisation, contact info@dermalucilab.com.

16. SECURITY

We use reasonable technical and organisational measures designed to protect personal data against:

· unauthorised access;

· unlawful use or disclosure;

· accidental loss;

· alteration;

· destruction.

No online system or transmission method can be guaranteed to be completely secure.

Customers are responsible for protecting access to their email accounts, devices and any customer-account authentication methods.

If you believe that personal data or an account has been compromised, contact us promptly.

17. THIRD-PARTY WEBSITES

The Website may contain links to third-party websites, social-media platforms or external services.

Those parties process personal data according to their own privacy notices. We are not responsible for the privacy practices of an independent third party.

You should review the relevant privacy information before providing personal data to an external service.

18. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in:

· applicable law;

· Website functionality;

· business operations;

· service providers;

· data-processing activities.

The updated Policy will be published on the Website with a revised “Last updated” date.

Where required by law, we will provide additional notice or obtain consent before a material change applies.

19. CONTACT

For privacy questions or requests, contact:

Galbraith Teck LLC
Trading as Dr. Dermaluci Lab
8206 Louisiana Blvd NE, Suite A358
Albuquerque, New Mexico 87113
United States

Email: info@dermalucilab.com Telephone: +1 786 746 0983 Website: www.dermalucilab.com