Privacy policy
Last updated 11 August 2026.
Who we are
Welcombe Skincare Ltd, trading as Biotaderm, is the data controller for the personal information described here. We are registered in England and Wales under company number 13451607, at Darracott Farm, Welcombe, Devon EX39 6HG.
We are registered with the Information Commissioner's Office under reference ZB377476.
Richard Bence is our data protection contact. Email gdpr@biotaderm.com, or write to the address above.
What we collect, why, and on what basis
We collect five kinds of information. For each one, the law requires us to tell you what our lawful basis is, so that is set out plainly rather than as a list of possibilities.
Information you give us when you order. Your name, delivery and billing address, email address, phone number if you give one, and what you bought. We need this to make and send you the goods. Our lawful basis is performance of a contract with you.
Payment information. Your card details go directly to Shopify Payments and the card networks. We never see or hold your full card number. Our lawful basis is performance of a contract, and for fraud screening, our legitimate interests in not being defrauded.
Your email address, when you subscribe to marketing. We send you occasional emails about products, ingredients and what we are making. Our lawful basis is your consent, which you give by ticking the box or joining the Founders Club, and which you can withdraw at any time using the unsubscribe link in every email or by emailing us. Withdrawing consent does not affect anything we sent before you withdrew it.
If you have bought from us, we may also email you about similar products under the "soft opt-in" in regulation 22 of PECR. Every one of those emails carries an unsubscribe link too, and you can opt out at the point of purchase.
Information about your device and how you use the site. When you visit, our systems record your IP address, browser type and version, operating system, device type, time zone, which pages you looked at, how long you stayed and what you searched for. If something on the site breaks, we may also record what you were doing when it happened.
Strictly necessary cookies are used on the basis of our legitimate interests in running a working shop. Analytics and advertising cookies are used only with your consent, given through the cookie banner, and you can change your mind at any time.
Information you send us. If you email us, use the contact form, or make a Two-Week Trial claim, we keep what you sent and our reply. Our lawful basis is legitimate interests in answering you and keeping a record of what was agreed.
Advertising
We advertise on Google. If you accept advertising cookies, Google can tell us that an advert led to a visit or a purchase, and can show our adverts to people who have visited the site before. This works from a code that Google's own systems recognise, not from your name or email address.
Our lawful basis is your consent. If you refuse advertising cookies, or later withdraw, none of this happens and the shop works exactly as it did before.
We never sell your personal information. We do not give your name, email address or order history to anyone for their own marketing.
Who we share it with
We use a small number of service providers, and they process your information on our instructions only.
- Shopify hosts the shop and processes orders and payments. Shopify's privacy policy
- Omnisend sends our marketing and transactional emails, and, if you accept cookies, recognises you so we can send a reminder about an unfinished basket. Omnisend's privacy policy
- Google Analytics 4 tells us how the site is used, and only runs if you accept analytics cookies. How Google uses information from sites that use its services
- Google Ads measures our advertising, and only runs if you accept advertising cookies.
- Royal Mail receives your name and address so they can deliver the parcel.
We also disclose information where the law requires it, for example in response to a court order.
Where your information goes
We store and process your information in the United Kingdom. Some of the companies above are based outside it, or move data outside it.
Where that happens we transfer your information under Article 45 of the UK GDPR and the Data Protection Act 2018, relying either on a UK adequacy decision for the destination country, or, where there is none, on approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. The point of those safeguards is that your information keeps the protection it has here.
How long we keep it
Order records, including your name, address and what you bought, are kept for seven years from the end of the financial year in which you ordered, because HMRC requires it.
Marketing consent and your email address are kept until you unsubscribe, and then we keep a minimal record of the fact you unsubscribed so we do not email you again by mistake.
Correspondence is kept for six years from the last message. That matches the period in which someone could bring a claim about an order, so we keep what we would need to answer it.
Analytics data is kept for 14 months in Google Analytics and then deleted. Advertising data is kept by Google according to its own retention periods.
We remember your cookie choice for six months, after which we ask you again. We keep a record of the choice you made for two years, so that we can show what you agreed to and when.
When we no longer need your information for the reasons above, we delete it, or strip out everything that identifies you so that what remains is anonymous.
Keeping your information safe
We protect the information we hold using measures appropriate to the risk: encrypted connections, access limited to people who need it, and reputable providers who publish their own security standards.
No method of sending or storing information electronically is completely secure, and we will not pretend otherwise. What we can tell you is that we do not hold your card details, that access to customer records is restricted, and that we review this as the business grows.
If you hold an account with us, the password is yours to choose and yours to keep safe.
If something goes wrong
If personal information we hold is lost, stolen or exposed, we will investigate immediately. Where the law requires it, we will report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it, and where the breach is likely to put you at high risk we will tell you directly and explain what happened.
Your rights
Under UK GDPR you have the following rights over your information. All of them are free, and we will respond within one month.
To be told what we do. This policy is how we do that.
To see what we hold. You can ask for a copy of the personal information we hold about you. This is a subject access request.
To have it corrected. If anything we hold is wrong, out of date or incomplete, tell us and we will put it right or complete it.
To have it deleted. In many cases you can ask us to erase your information, for example where we no longer need it, or where we relied on your consent and you have withdrawn it. This right is not absolute. Where the law requires us to keep something, such as order records for HMRC, we will keep that and delete the rest.
To restrict what we do with it. You can ask us to pause processing while we check something is accurate, or while we consider an objection you have raised.
To object. You can object to anything we do on the basis of legitimate interests. If you do, we have to stop unless we can show compelling grounds that override your interests. You can always object to direct marketing, and we will stop.
To take it with you. You can ask for the information you gave us in a common machine-readable format, such as a CSV file, and ask us to send it to another organisation where that is technically possible.
To withdraw consent. Where we rely on your consent, you can withdraw it at any time. That does not undo anything that has already happened.
To use any of these, email gdpr@biotaderm.com. We may ask you to confirm who you are before we act, which protects you rather than us.
Children
The site is not intended for anyone under 16, we do not market to anyone under 16, and we do not knowingly collect information about children. If you think your child has given us information, email us and we will delete it.
Automated decisions
We do not make automated decisions that have a legal or similarly significant effect on you. Shopify runs limited automated fraud checks, such as temporarily blocking IP addresses associated with repeated failed payments. These do not have a significant effect on you.
Cookies
We use cookies and similar technologies to run the shop, understand how the site is used, and measure our advertising. Strictly necessary cookies run automatically. Everything else runs only if you agree.
You choose when you first arrive, and you can change your mind at any time using the Cookie settings link in the footer.
Our cookie policy lists every cookie we use, what it does and how long it lasts.
Links to other sites
Our site links to places we do not run, including our own social media pages and the ingredient references we cite. Once you follow a link, this policy stops applying and theirs starts. We have no control over what they do and cannot take responsibility for it.
If the business changes hands
If Welcombe Skincare Ltd is sold, merges with another company, or transfers its business, customer information would pass to the buyer as part of that. Anyone acquiring it would be bound by this policy until they told you otherwise, and where the law requires it we would tell you first.
Changes
We may update this policy. The date at the top tells you when it last changed, and the version that applies to you is the one published when you visited. If a change is significant we will tell subscribers by email.
Complaints
Email gdpr@biotaderm.com first and we will try to put it right. We would rather hear from you than have you go elsewhere first.
If you are not satisfied, you have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone 0303 123 1113
ico.org.uk/make-a-complaint