Privacy Policy

AlmaDerm Natural Cosmetic (hereinafter: "we", "our", "AlmaDerm"), based in Bosnia and Herzegovina, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal data when you use our websites (almaderm.ba) and related services.

This policy applies to all users of our website, regardless of their location — including Bosnia and Herzegovina, the European Union, the United Arab Emirates and all other countries to which we deliver our products. It also covers our sales pages (offers), the loyalty programme in our shop and the B2B partner programme.

We collect the following types of data:

• Personal data: name, surname, email address, phone number, shipping and billing address.
• Transaction data: order details, payments, purchase history and applied coupons.
• Technical data: IP address, browser type, operating system, device information and the country you access from (for determining currency and shipping zone). With consent to analytics cookies, also a device fingerprint: a combination of browser and device data by which we recognise the same device even after cookies are deleted.
• Cookies: website usage data through cookies and similar technologies (see Cookies section).
• Communication data: messages via contact form, live chat, email correspondence regarding orders.
• Skin data (optional): if you use our skin analysis (selfie or quiz), we process data about the appearance and condition of your skin — exclusively with your explicit consent.
• Email data: whether you opened our email and which link you clicked (our emails contain an invisible image and tracked links), so we can measure and improve our messages.
• Unfinished orders on our sales pages (offers): if you enter your phone number (and name) in the order form but do not send the order, we save them and may call you to help you complete it. If you send the order, we delete that record.
• In-store customers: if you are enrolled in the loyalty programme in our shop, we link your name, email, phone, purchases and points with the web shop (SmartPOS system) so your points are valid in both places.
• People registered by a B2B partner: name, email and possibly phone, country and company details, provided to us by the partner who registered you. We inform you about this in our first email.

Skin analysis is voluntary and cosmetic (not medical) in nature. Data about the condition of your skin may be considered a special category of data, so we process it only on the basis of your EXPLICIT consent (Article 11 of the BiH Law on Personal Data Protection).

Your photo is analyzed in real time and is NEVER stored (neither on disk nor in a database) — we keep only the textual cosmetic result (e.g. skin type) to track progress and recommend products. For the analysis, the photo is temporarily sent to an AI partner (OpenAI/Anthropic, USA). For the skin quiz, your answers are sent to the AI partner OpenAI (USA) without your name or email to prepare a recommendation, and are stored with your email. You can withdraw consent and delete the data at any time via info@almaderm.ba or by deleting your account.

We process your data based on the following legal grounds:

• Contract performance: order processing, delivery, account management.
• Consent: marketing communications, newsletter, cookies (except essential ones).
• Legitimate interest: fraud prevention, service improvement, analytics.
• Legal obligation: retention of invoices and receipts in accordance with tax regulations.
• Explicit consent for special categories: to process skin data (skin analysis) we ask for your separate, explicit consent (Article 11).

We use your data for:

• Processing, delivering and tracking your orders.
• Communication regarding orders (email, phone call, SMS, WhatsApp status notifications).
• Personalizing user experience (product recommendations, currency rates).
• Marketing — newsletters, special offers, reminders (e.g. to restock products you bought) and product news. We send them when you sign up for the newsletter or leave us your email: with an order, at registration, in the chat, in a review, when signing up for a product alert or in the in-store loyalty programme. If you enter your email at checkout but do not complete the order, we may also send you a reminder with your cart. Every such email lets you unsubscribe with one click.
• Analytics and improvement of our website and services.
• Fraud prevention, abuse protection and ensuring the security of our website.
• Protection against cash-on-delivery abuse: if a customer refuses several cash-on-delivery parcels in a row, the system automatically disables cash on delivery for them (they can then order only by card and by covering the cost of the returned parcels), and after further refusals it blocks ordering altogether. We recognise the customer by phone number or email, and a successfully collected parcel resets the count. If you think the decision is wrong, write to info@almaderm.ba: a person will review it, and you can state your view and contest it.
• Internal customer analysis: for customers subscribed to our offers, we use the AI partner OpenAI to create a short overview of purchases and interests (e.g. what might suit you), so that we can send you better suggestions. This analysis has no legal or similarly significant effects on you. You can object to it at any time, and unsubscribing from our offers stops it.
• Fulfilling legal obligations (tax records, accounting).

We do not sell or rent your data. We share it only with the partners listed below, and only the data needed for the stated purpose:

• Courier and postal services (e.g. BH Pošta, regional couriers, Aramex and Express One for international delivery): for delivering your orders (name, address, phone).
• Warehouse and delivery partner in the UAE (Nimish): for orders in the UAE, receives the name, email, phone, delivery address and order items.
• Payment processors (Stripe): for secure card payment processing. We do not store card details on our servers.
• Buy-now-pay-later payment processors (Tabby): when you choose "buy now, pay later", we forward the data needed to process it (name, email, phone, order history).
• Point-of-sale and loyalty system (SmartPOS): email, order number and amount, and points, so that points from the web shop are valid in our shop and vice versa.
• Analytics and advertising tools in your browser (Google Analytics/GTM, Google Ads, Meta Pixel, TikTok Pixel) run only with your consent (see section 9). In addition, we send Meta data about every order via the Conversions API (from our server), even if you rejected cookies, because we treat placing an order as voluntarily providing your data (see section 9). On our sales pages (offers), Meta also receives data about your visit and the order-form steps if you came from a Meta ad or have previously accepted marketing cookies, and Google receives the order amount and number if you came from a Google ad. Before sending to Meta, your email, phone, first name, last name, city and postal code are converted into an unreadable code (hashed); the IP address and browser data are sent as they are, as Meta requires.
• AI partners (OpenAI, Anthropic): they process the text of your chat messages; for skin analysis, the photo (which is NOT stored); for the skin quiz, your answers without your name or email; for the internal analysis of customers subscribed to our offers, name, country, city, language, purchases, viewed products, abandoned carts and skin type, without email and without chat text. They process the data on servers in the USA.
• Email delivery platform (Mailgun): for sending order confirmations, newsletters and other emails.
• Cloudflare: protection and acceleration of the website. All traffic to the website passes through their network, so they see your IP address and browser data.
• Google Maps: the map on the Contact page loads only when you click “Show map”; Google then receives your IP address.
• Hosting provider (Hetzner, Germany): for data storage and processing on secure servers within the EU.

All our partners are obligated to protect your data in accordance with applicable data protection laws.

Our servers are located in Germany (Hetzner, Nuremberg), within the European Union. Some partners process data outside BiH and the EU: in the USA (e.g. Google, Meta, TikTok, OpenAI, Anthropic, Cloudflare) and in the UAE (Aramex, Tabby and Nimish, for orders in the UAE). We send them only the data needed for the purpose described in section 5. You can request information on the safeguards for a particular partner at info@almaderm.ba.

For customers from the UAE and other countries outside BiH: your data is processed on EU servers according to EU data protection standards, which are among the strictest in the world.

We use SSL/TLS encryption to protect all data transmitted between your browser and our website. Passwords are cryptographically protected (hashed) and we never store credit card information on our servers.

Additional security measures include: regular software updates, protection against unauthorized access, restricted access to personal data limited to authorized personnel only, and data backups.

Regardless of your location, you have the following rights regarding your personal data:

• Right of access: You can request a copy of all personal data we hold about you.
• Right to rectification: You can request correction of inaccurate or incomplete data.
• Right to erasure: You can request deletion of your data ("right to be forgotten"), except where retention is legally required.
• Right to restriction: You can request restriction of processing of your data in certain situations.
• Right to withdraw consent: You can withdraw consent (e.g. for cookies, the newsletter or skin analysis) at any time; this does not affect processing carried out before the withdrawal.
• Right to portability: You can request transfer of your data in a structured, readable format.
• Right to object: You can object to processing based on legitimate interest, including profiling. You can object to direct marketing and profiling for direct marketing at any time, without giving reasons: with one click on “Unsubscribe” in any of our emails or at info@almaderm.ba.
• Right regarding an automated decision: if the system has automatically disabled cash on delivery for you (see section 4), you can ask for a person to review the decision, state your view and contest it.
• Right to lodge a complaint with the supervisory authority: If you believe we are processing your data unlawfully, you can lodge a complaint with the Personal Data Protection Agency of BiH (AZLP, www.azlp.ba).

To exercise any of these rights, contact us at info@almaderm.ba. We will respond to your request within 30 days.

We use cookies to enable our website to function and to improve your experience.

Essential cookies (cart, session, currency, login) do not require consent as they are necessary for the website to function. Analytics cookies (Google Analytics and our own visit tracking) and marketing cookies (Meta Pixel, TikTok Pixel) are used only with your consent (via the cookie bar or as described below).

You can manage cookie preferences through the banner on our website or in your browser settings. Disabling certain cookies may affect website functionality.

By voluntarily providing your data (e.g. your email via the newsletter, chat or checkout) you consent to being tracked via cookies and to us using that data to improve our service and send you personalized offers.

Choosing 'Accept All' on the cookie bar also enables marketing cookies, which includes tracking on other websites (e.g. Facebook, Instagram, Google) to show you relevant ads (remarketing).

We record consents as proof (what you accepted, when and from which IP address) when we can recognise you: when you leave your email or if you have previously accepted tracking. Your first choice on the cookie bar is stored only in your browser. You can withdraw consent at any time via the cookie settings or by contacting info@almaderm.ba.

We retain your personal data for as long as necessary to fulfill the purpose for which it was collected, or as required by law.

Order data is retained for a minimum of 6 years (legal requirement for tax documentation). User accounts remain active until you deactivate them. Marketing preferences are retained until you withdraw consent. Technical logs are automatically deleted after 90 days. Anonymous visitor sessions and abandoned-cart data are deleted once the 90-day period expires, and analytics data of registered users and customers once 6 years expire (aligned with the order retention period), as part of our regular data-retention review; aggregate anonymous statistics (containing no personal data) are kept indefinitely. Unfinished orders from our sales pages are deleted once 30 days have passed since they were entered, chat conversations once 12 months have passed since the last message, and quiz and skin-analysis results once 24 months have passed since they were created, as part of the same regular review; at your request or when you withdraw consent, we delete them sooner.

Our services are not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will promptly delete it.

We reserve the right to update this Privacy Policy. You will be notified of significant changes via email or a notice on our website. The date of the last update is indicated at the top of the page.