Privacy Notice

• Business name: Kryskin Beauty and Wellness Products Trading
• Address: Block 1 Lot 69, Navona, Barangay Lumbia, Cagayan de Oro City, Philippines
• DTI business name registration no.: 8464571
• Data Protection Officer: Kristine L. Tyson
• Privacy email: [email protected]
• Phone: 09260048341

Write to our Data Protection Officer for any question or request about your personal information.

• Your first name, last name, email address and mobile number.
• The recipient's name and mobile number, and the delivery address: region, province, city or municipality, barangay, street, postal code and landmark.
• Your note for delivery, if you write one.
• What you ordered, the prices, the shipping fee, the total and the payment method.
• Your answers to the two tick boxes at checkout: that you have read this notice and our Terms (we record the date of the version you saw), and whether you asked for news and offers.

If you order for someone else, please give their name, number and address only with their permission.

We do not ask for information about your health. Please do not write health information in the note for delivery.

You may order as a guest, or open a customer account. With an account we also keep:

• your email address, name and mobile number;
• up to 10 saved delivery addresses;
• the list of your orders;
• your choice about news and offers, and each time you changed it.

There is no password. You sign in with a 6-digit code that we email to you each time. The code works for 10 minutes and only in the browser that asked for it.

When you send us a message (the "Tell us" form on this website, Messenger, email or a call), we keep what you wrote, the name and the email or mobile number you gave, and the order number if you gave one, so we can answer you and look into it. If you are signed in when you use the form, we link the message to your account, and to your order when it is yours if we ever let the assistants see messages.

If you message our Facebook Page or Instagram account, our chat tool (Pancake) copies your message, your name as shown on Facebook or Instagram, and a link to the chat into our customer-care records. Pictures and files stay in the chat tool. We keep these records for 24 months, or erase them sooner if you ask.

Please do not write health information, passwords or card numbers in a message.

• Your internet (IP) address. Our server uses it to stop fake and repeated orders. We do not keep the address itself with your order, only a scrambled fingerprint of it, which cannot be turned back into the address.
• The result of the bot check (see the next section).
• Your shopping bag. It is saved on your own device (in the browser's local storage) and is sent to us only when you go to checkout.
• What you type at checkout. Until you place the order it stays in that one browser tab and is gone when you close the tab.
• After you order as a guest, a cookie that opens your private order page. It works for that one order only and lasts 60 days.
• When you sign in to an account, a sign-in cookie. It ends after 30 days without use, and after 90 days at the most.

These cookies are needed for the website to work, so they do not need your consent. The one exception is Meta, and only if you say Yes (see "Meta ads: only if you say Yes" below). Apart from that, we do not use advertising cookies or tracking pixels, and we do not let other companies follow you on this website. We count visits and page views in total, without cookies and without anything that identifies you. If this changes, we will update this notice first, and ask for your consent where the law requires it.

To stop computer programs (bots) from placing fake orders and from misusing sign-in codes, our checkout and sign-in pages use Cloudflare Turnstile, a service of Cloudflare, Inc.

Turnstile looks at technical signals from your browser and device, such as your IP address and browser details, to tell people from bots. Usually you see nothing, or a small box to tick. Cloudflare handles this information under its own privacy policy (cloudflare.com/privacypolicy). We receive only the result of the check.

We would like to show Kryskin ads on Facebook and Instagram to people who visited our shop, and to see whether those ads work. For this we use two tools from Meta Platforms, Inc.: the Meta Pixel on our website, and Meta's Conversions API, which our own server uses to tell Meta about an order.

We use them only after you say Yes in the bar that asks "May we tell Meta (Facebook and Instagram) what you look at and buy here…?". If you say No, or do not choose, nothing is sent to Meta. If you do not see the question, this is switched off and nothing is sent.

If you say Yes:

• On our home page and our policy pages, the Meta Pixel loads from Meta and tells Meta which page you opened, which products you looked at, and what you added to your bag (the product code and its price). It never runs on the checkout, order, account or "Track your order" pages.
• The Pixel sets Meta's own cookies in your browser: _fbp, and _fbc if you came from a Meta ad. They last up to 90 days.
• When you place an order, our server tells Meta about the purchase: a random reference for the order (not your order number), the total, the product codes and the number of items, your email address and mobile number in scrambled form (so Meta can only match them to an account that already has them), your internet (IP) address, your browser's name, and Meta's two cookies.
• We never send Meta your name, your address, your delivery note, or anything about your health.

Meta uses this information under its own privacy policy (facebook.com/privacy/policy) to show and measure ads, and may connect it to your Facebook or Instagram account if you have one. Meta may handle it outside the Philippines.

Your choice is kept in a cookie called kryskin-consent for 180 days, and with each order you place. You can change it at any time with "Cookie choices" at the bottom of every page. If you change to No, we remove Meta's cookies from our website and send nothing more. What was already sent to Meta stays with Meta; you can see it and remove it in your Facebook or Instagram settings under "Your activity off Meta technologies".

We use Meta only with your consent.

The Data Privacy Act allows us to use your personal information for these purposes:

• To process your order, confirm it with you by text or call, pack it, deliver it and collect the payment. This is needed to carry out our sale to you.
• To send you emails about your order: received, shipped (with the tracking number), delivered, cancelled, and refund issued. These are needed for your order and are not marketing.
• To run your account and send your sign-in codes, if you have an account.
• To keep sales records and issue receipts, because tax and accounting laws require it.
• To handle returns, refunds, complaints and questions.
• To protect our customers and our shop from fraud, fake orders and attacks on the website. This is our legitimate interest, and we keep it to what is necessary.
• To show you Kryskin ads on Facebook and Instagram and to see whether they work, only if you say Yes in the bar about Meta (see "Meta ads" above). This is based on your consent.
• To send you news and offers, only if you asked for them and confirmed (see the next section). This is based on your consent.

We do not use your information to make automated decisions about you that have legal or similar effects.

We send news and offers by email only if you tick "Send me Kryskin news and offers" and then confirm by pressing the link in the email we send you. Until you confirm, we send no marketing email at all.

Every marketing email has a link to stop them. You can also stop them from your account, or by writing to us. Stopping them, or never ticking the box, does not affect your orders in any way.

We share only what each one needs:

• Our courier and fulfilment partners, the delivery companies we choose for your order, to pack and deliver it and collect cash on delivery: the recipient's name, mobile number and delivery address, the items, and the amount to collect.
• Resend, the service that delivers our emails: your email address, your first name and what the email says about your order.
• Cloudflare, for the bot check (see above), to protect the website from attacks, and to keep our backup copies.
• Meta Platforms, Inc. (Facebook and Instagram), only if you say Yes in the bar about Meta: what is listed under "Meta ads" above.
• Hostinger, which runs this website and the database that holds our records, on a server in Malaysia.
• Our accountant and auditors, for the sales records they must check.
• Government offices and courts, only when the law requires it or a lawful order asks for it.

Some of these providers store information outside the Philippines. We choose providers that protect it with security measures and written agreements, as the Data Privacy Act requires, and we remain responsible for your information while they handle it.

We never sell your personal information, and we never give it to other companies for their own marketing.

• The website uses encrypted connections (HTTPS).
• Inside Kryskin, only the people who need your information for their work can see it. Every staff account uses two-step sign-in, some roles see contact details hidden, and important actions are written to a log that cannot be changed.
• The private link to a guest order works only with its secret key, and the page shows the recipient's first name, city and province, never the full address.
• Our order emails show your first name, the order number, the items and the totals, never your address or your note.

If a security breach puts you at real risk, we will tell you and the National Privacy Commission within 72 hours of learning about it, as the law requires.

• Orders: each order keeps its own copy of the name, contact details and delivery address given for it. We keep orders for 10 years, because tax and accounting laws require us to keep sales records. After that we delete them or make them anonymous.
• Your agreement to our notices, and your choice about news and offers: as long as the orders they belong to, so we can show what you agreed to.
• Your choice about Meta: in your browser for 180 days, and with each order as part of your agreement record. The internet address and browser name we send to Meta for an order: erased from our records once the message is sent, and at the latest 1 day after the order, and at once if you delete your account.
• Your account: until you delete it.
• Messages you send us (the "Tell us" form on this website, Messenger, email or a call) and our notes about them: 24 months from when the message came in, or from when we closed the matter if that is later, because the Consumer Act gives two years to bring a claim. Then we erase the words, your name and your contact details.
• The private link to a guest order stops working 30 days after the order is completed, cancelled or returned.
• Your bag and what you type at checkout stay on your own device, as described above.

You can delete your account at any time from My account. We email you a code to confirm it is you. Then we erase your name, email and mobile number from the account, delete your saved addresses, erase the messages linked to your account or sent from your email address and our notes about them, and sign you out on every device. For any other message you sent us (for example by phone), ask us and we will erase it.

Your past orders stay in our sales records with their own copy of the details given for them, for the period in the section above, because the law requires us to keep them.

Under the Data Privacy Act you have the right:

• to be told how your personal information is used (this notice);
• to see the personal information we hold about you and get a copy of it;
• to have wrong or old information corrected;
• to object to a use of your information, and to withdraw your consent at any time;
• to have your information deleted or blocked when it is no longer needed, or was collected or used unlawfully;
• to receive your information in a common electronic format (data portability);
• to be paid damages if you are harmed by unlawful use of your information;
• to file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, write to our Data Protection Officer at [email protected]. We may ask you to confirm who you are before we act, so that nobody else can see or change your information.

Our products and this website are for adults. We do not knowingly collect information from anyone under 18. If you think a child has given us their information, please write to us and we will delete it.

When we change this notice we change the date at the top of this page. If a change is important, we will also show it on the website before it takes effect. The version you agreed to when you placed an order is kept with that order.