Privacy Policy

Last updated: 1 Jan, 2026

Preamble

INSTYTUTUM AG is a company registered in Switzerland with the main office at Gubelstrasse 12, 6300 Zug, company Enterprise Identification Number (UID): CHE-440.903.330 (“we”, “our”, “us”) that operates this Website https://instytutum.com/en/ (the “Website”).

Protection of your personal data is very important to us. We are committed to protecting the privacy of individuals who visit the Website and use its online facilities. In this Privacy Policy, we would like to inform you of all the details of the collection, processing, and use of personal data.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit our Website, use our services, make a purchase from the Website, or otherwise communicate with us (collectively, the "Services"). 

You can be a website visitor, a customer, or an AI skin analysis user:

• You are a website visitor when you merely browse the Website and provide us with your data via cookies or contact us via online chat, email, phone, our social media accounts (including Instagram, Facebook, and WhatsApp), or fill out online forms on the Website (including requests for consultations, subscriptions for newsletters, the “email us” form, the “leave a review” form, and other types of forms).

• You are a customer when you submit your personal data to register on the Website, provide your data when you make a purchase via our Website (including as a guest without registering on the Website), and contact us via available options for assistance.

• You are an AI skin analysis user when you submit your personal data for AI skin analysis.

We kindly ask you to read this Privacy Policy carefully to fully understand our practices in relation to your personal data.

Definitions

We use the following definitions in this Privacy Policy:

• “controller” means the natural or legal person who (either alone or jointly with others) determines the purposes and means of the processing of personal data.

• “processor” means a natural or legal person who processes personal data on behalf of the controller.

• “data subject” is an identified or identifiable natural person about whom we hold personal data.

• “personal data” means any information relating to you and helping identify you (directly or indirectly), such as a name, email, address, etc.

• “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• “GDPR”: European Union’s General Data Protection Regulation.

• “CCPA”: the California Consumer Privacy Act. 

• “CPRA”: the California Privacy Rights Act.

• “EU Data Act”: Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828.

• “AI Act”: a European Union regulation concerning artificial intelligence (AI).

• “Data Governance Act”: Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724.

Identity and contact details of the data controller

When processing your personal data in situations described in this Privacy Policy, we act as a controller under the GDPR and other applicable legislation.

INSTYTUTUM AG is a company incorporated and existing under the laws of the Swiss Confederation with Enterprise Identification Number (UID) CHE-440.903.330. 

• Our address: Gubelstrasse 12, 6300 Zug, Switzerland; 

• Our telephone number: +41 41 511 20 50; 

• Our email: [email protected].

Data collection

We collect your personal data when you:

• visit our Website; 

• contact us via online chat, email, phone, or our social media accounts;

• fill out online forms on the Website;

• register on the Website;

• make a purchase via our Website;

• subscribe to newsletters;

• request for assistance;

• leave a review;

• request for AI skin analysis;

• voluntarily provide your data, including any other instances on the Website where you knowingly choose to share your personal data.

Providing your contact details for registration, payment, and transaction information is necessary to enter into or perform a contract with you in the meaning of the GDPR. For example, if you refuse to provide your address when ordering our products, the products cannot be delivered to you.

We collect website visitor data, customer data, and AI skin analysis user data in connection with our Website and Services: 

When we act as a data controller: 

• we DO NOT sell your data; 

• we DO NOT use automated decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects a data subject.

Email Retargeting (U.S. CAN-SPAM Compliance)

We may send commercial emails, product updates, remarketing and retargeting messages to email addresses obtained through our website, CRM or marketing partners. All emails to U.S. recipients are sent in compliance with the CAN-SPAM Act and include: our sender identification, a valid physical address, a clear subject line, and an accessible unsubscribe option. You may opt out of future emails at any time by using the unsubscribe link included in each message.

Legal bases for processing

We process your personal data in accordance with the GDPR. The GDPR provides an exclusive list of lawful bases, allowing us to process your personal data. During personal data processing, we rely only on four of them, namely:

Article 6.1(a): consent 

We collect the information you choose to give us, and we process it with your consent. We collect special categories of your personal data (in particular, data concerning your health for performing AI skin analysis) with your explicit consent (Article 9.1(a)). 

You may withdraw your consent to the processing of your personal data at any time. 

Please remember that the withdrawal of consent does NOT automatically mean that the processing before the withdrawal is considered unlawful. You may withdraw consent to the processing of your personal data by sending us an email at [email protected] or by contacting us in any other way convenient for you. 

Article 6.1(f): legitimate interest 

We process your personal data to protect our legitimate interests, such as: 

• preventing fraud, 

• ensuring the security of our Website, and 

• ensuring the functionality of our Website. 

We only collect and use the strictly necessary data to achieve these purposes and do not override your fundamental rights and freedoms.

Article 6.1(b): performance of a contract 

When you provide us with personal data to purchase the products on our Website, this can be considered as a request to form a contract or to perform a contract between you and us. However, we may ask you for clear consent in case of doubt.

Article 6.1(c): legal obligation

We process your personal data to fulfill our legal obligations, such as complying with tax or regulatory requirements. In case you send us a request to exercise your rights under the GDPR, we may ask you for some personal data we already have to identify you and achieve compliance with the applicable law.

Use of your personal data

When acting as a data controller, we use your personal data for the purposes listed in the table below, where we also detail the type of personal data processed and the legal bases we rely on to do so.

AI skin analysis

Applying for AI skin analysis, you voluntarily share with us data concerning your health, in particular information about your skin sensitivity, pregnancy or breastfeeding. Based on this information and your photos, we obtain the results of your skin analysis and share it and a personalised skincare routine program with you.

According to Article 9 of the GDPR, data concerning health is a special category of data, and its processing is allowed under certain conditions. For this reason, we obtain your explicit consent for this processing.

You may withdraw your consent anytime by submitting a request at [email protected].

We retain relevant data only for the purpose of providing you with this service. All data provided in the request for AI skin analysis is deleted one year after the analysis results are delivered to you or earlier upon your request. You may submit a request for erasure of this data anytime at [email protected]. 
For the use of the service, you must confirm that you are at least 18 years old.

Please note that this service does not provide medical advice, diagnosis, or treatment. Recommendations are cosmetic in nature and should not be considered a substitute for professional medical advice. 

Our AI skin analysis tool qualifies as an “AI System” under the AI Act. We therefore provide the following mandatory information:

• The AI tool used for skin analysis performs automated pattern recognition on images you voluntarily upload.

• The tool does not perform biometric identification or categorisation, and it is not used to make medical or legal decisions.

• Human oversight is ensured at all times: our specialists may review the AI recommendations, and you may request a manual review at any time.

• The output is advisory only and intended exclusively for cosmetic guidance, not diagnosis.

• You have the right to opt out of AI processing and request a non-AI alternative (manual review or general product recommendations).

• You will always be clearly informed when interacting with an AI system, and you may refuse to submit photos or health-related data.

For data generated through your interaction with our AI skin analysis service, we apply the principles of the Data Act:

• You may request access to all data you provided as well as system-generated data resulting from the AI analysis.

• Upon your request, this data can be transmitted to another company or service provider in a structured, commonly used, and machine-readable format.

• We do not share system-generated AI analysis data with third parties except where necessary to provide the service or with your explicit consent.

• We do not use your data for training AI models without your explicit, informed consent where required.
  

We do not use your personal data (including uploaded photos or health-related information) to train, refine, or improve AI models unless you provide separate explicit consent.

Training always uses either synthetic data, anonymised datasets, or data for which explicit training consent was obtained.

The AI system provides advisory cosmetic recommendations only. These recommendations are not binding, and no decision producing legal or similarly significant effects is made solely on the basis of automated processing.

Data sharing and disclosure

We may share your personal data as a data controller with joint controllers, other controllers, and data processors in accordance with the provisions specified hereafter.

Sharing personal data with joint controllers (other controllers)

We act as the joint controller while cooperating with Facebook (Meta Platforms Ireland Limited), for example, when using Facebook Pixel. With respect to this case of personal data processing, we are the party to the Facebook Controller Addendum.

Google LLC and we act as independent controllers of personal data across Google LLC’s digital marketing services, such as Google Ads. To learn more, please visit our Cookies Policy.

When we act as a joint controller for a particular processing of personal data, a data subject may exercise his/her rights under the GDPR in respect of and against both joint controllers.

Sharing personal data with data processors

We may disclose your personal data to data processors who perform services on our behalf based on our instructions (“service providers”) insofar as reasonably necessary for managing risks, obtaining professional advice, and providing services.

We may share your delivery address and telephone number with our warehouse, carriers, forwarders, customs brokers, and shipping service providers to complete, fulfill, manage, and communicate with you about your orders.

Also, we may share and disclose your personal data to other service providers:

• Google Ireland Limited (Ireland) – including Google Cloud SQL, Google Cloud Storage, Google Pub/Sub, Google CDN, BigQuery, Google Analytics, Google Tag Manager, Google Search Console, Google Ads, Google OAuth, and Google reCAPTCHA. You may read its privacy policy here;

• Microsoft Ireland Operations Limited (Ireland) – Microsoft OAuth authentication services. You may read its privacy policy here;

• Apple Inc. (USA) – Apple Sign-In (OAuth) authentication services. You may read its privacy policy here;

• Apple Payments Inc. (USA) – Apple Pay payment services. You may read its privacy policy here;

• Zoho Corporation B.V. (Netherlands) – Zoho CRM customer relationship management services. You may read its privacy policy here;

• Mailgun Technologies, Inc. (USA) – transactional and service-related email delivery.

• LLC “ESPUTNYK” (Ukraine) – eSputnik marketing automation and email marketing services. You may read its privacy policy here; 

• Meta Platforms Ireland Ltd. (Ireland) – Facebook and Instagram advertising and social media integration services.You may read its privacy policy here; 

• WhatsApp Ireland Limited (Ireland) – customer communication services. You may read its privacy policy here;

• WayForPay LLC (Ukraine) – online payment processing services. You may read its privacy policy here;

• Stripe Payments Europe Ltd. (Ireland) – online payment processing services. You may read its privacy policy here;

• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – payment processing services. You may read its privacy policy here;

• Foloosi Payment Services (UAE) – online payment processing services. You may read its privacy policy here;

• Nova Poshta LLC (Ukraine) – shipping and delivery services. You may read its privacy policy here;

• Sentry (Functional Software, Inc., USA) – application monitoring and error tracking services. You may read its privacy policy here;

• Hotjar Ltd. (Malta) – website analytics and user behaviour analysis services. You may read its privacy policy here;

• CookieHub ehf. (Iceland) – cookie consent management services. You may read its privacy policy here;

• Cloudflare, Inc. (USA) – content delivery network (CDN) and website security services. You may read its privacy policy here;

• External carriers, freight forwarders, and customs brokers – logistics and customs clearance services, where applicable.

Links to Third-Party Websites

This Privacy Policy is applicable only to this Website, but not any other sites, therefore, we strongly recommend reviewing the privacy policies of any websites that you may reach by following hyperlinks presented on this Website. We have no control over the content and practices of other websites, and therefore, we are not responsible for any actions or policies of third-party websites.

We do not make your personal data available for “data altruism” or re-use by public bodies under the Data Governance Act unless you provide explicit authorisation through a separate consent form.

Data transfer to third countries

We may transfer your personal data to countries outside the European Union (EU) and the European Economic Area (EEA) that are not deemed to provide an adequate level of data protection under Article 45 of the GDPR (adequacy decision). 

In such cases, we will ensure that appropriate safeguards are implemented in accordance with the GDPR to protect your personal data, in particular, the standard contractual clauses adopted by the European Commission. When we transfer your personal data to third parties, we always comply with the requirements of the GDPR. Where possible, we always enter into Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) with these third parties to ensure that your personal data is adequately protected.

We put supplementary technical and organizational measures in place when transferring data outside the EU and the EEA. e.g., prior assessment of the service supplier’s reliability and personal data protection practices, encryption of the transferred personal data, prompt reacting to any threats to confidentiality, integrity, and availability of the personal data, conducting transfer impact assessments (TIA) when necessary, etc.

When transferring personal data outside the EU/EEA, we:

• Conduct a Transfer Impact Assessment (TIA) following EDPB Recommendations 01/2020;

• Apply supplementary encryption and pseudonymisation measures to reduce the identifiability of data;

• Contractually require third-country recipients to notify us of any government access requests and challenge them when legally permissible.

Data retention

As a data controller, we store and process your personal data until we no longer need it for any of the purposes defined in this Privacy Policy, unless a longer retention period is required or expressly permitted by law. We may not delete or anonymize your data if we are required to retain it to comply with the law or legal process.

Regarding data stored in the customer's account, we will delete your personal data if you request deletion of the account or if the account is inactive for 3 years from the time of the last order.

You may request us to delete your personal data by using this link: I would like to delete all my personal data. 

Additionally, you may send us an email to [email protected] or contact us in any other way that is convenient for you.

Your rights under the GDPR

In this Section, we have summarised the rights that you have under the GDPR. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

You may exercise the following rights by submitting a data subject request at  [email protected].

Please note that we may need to confirm your identity to process your requests to exercise your rights under the GDPR. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

Data protection authority under the GDPR

We kindly invite you to share your concerns with us in the first place regarding any issue related to your personal data processing. You may use the following channel to address your inquiries: [email protected].

In some cases, you have the right to lodge a complaint about our use of your personal data with a data protection authority. For more information, please contact your national data protection authority. We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved between you and us. You can find a full list of EU supervisory authorities through this link.

Your rights under the CCPA

If you are a California resident, to the extent provided for by the California Consumer Privacy Act (CCPA) and subject to applicable exceptions, you have the following rights in relation to the personal information we have about you:

• Right to obtain information. You can request information about what personal information has been collected about you and how we have used that personal information during the preceding 12 months.

• Right of access. You can request a copy of the personal information that we have collected about you during the preceding 12 months.

• Right to deletion. You can request that we delete the personal information that we have collected from you unless it is necessary for us to maintain your personal information in certain cases under the CCPA, such as protection against malicious, deceptive, fraudulent, or illegal activity.

• Right to be free from discrimination relating to the exercise of any of your privacy rights.

The California Privacy Rights Act (CPRA) amended the CCPA and added additional privacy protection rights for California residents, as follows:

• Right to correct inaccurate personal information. You can request that we correct the inaccurate personal information about you.

• Right to limit the use and disclosure of sensitive personal information. This right allows you to limit the use and disclosure of your sensitive personal information by the company. We don’t intentionally collect any sensitive personal information about you.

Data subject age

We undertake the best possible efforts to secure the processing of personal data belonging to underage. 

Generally, we do not knowingly collect personal data from persons under 16. By submitting your personal data to us, you acknowledge that you have reached the age of 16, and under the laws of your country of residence, you have all rights to provide us with your personal data for processing. If you have any reason to believe that a child under 16 has provided his/her personal data to us, please contact us at [email protected].

For the purpose of AI skin analysis, we DO NOT collect personal data from persons under 18.

Security and integrity of the data

Protecting the information you give us or that we receive about you is our priority. 

We have implemented appropriate organizational, technical, administrative, and physical security measures to ensure the ongoing confidentiality, integrity, availability, and resiliency of systems and services that process personal information and will restore the availability and access to information in case of a physical or technical incident on time.

In particular, the database is located on a private network segment. Moreover,  we have implemented TLS 1.3 (Transport Layer Security) and use Cloudflare to protect the Website's security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify:

• the competent supervisory authority within 72 hours, and

• you without undue delay when the breach is likely to result in a high risk.

Complaints

If you have complaints about how we process your personal data, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live, you may have the right to appeal our decision by contacting us using the contact details set out below or lodge your complaint with your local data protection authority.

Because we offer services to individuals in the EU, we have appointed an EU representative pursuant to Article 27 GDPR:

(name, address, email)

If, based on the nature and scale of processing (including AI skin analysis), we meet the criteria of Art. 37 GDPR, we will appoint a Data Protection Officer. Updated contact details will be included here and in the imprint.

Amendments

We may update this Privacy Policy from time to time due to the implementation of new updates, technologies, law requirements, or for other purposes by publishing a new version on our Website.

Such change(s) will be effective immediately upon posting the change or modification on this Website. We encourage you to review this Privacy Policy to check for any changes regularly. 

If the modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change. For example, we may send you an email or generate a pop-up or similar notification when you access the Website for the first time after such material changes are made or provide you with information in any other way. Your continued use of our Website after the revised Privacy Policy has become effective constitutes your acceptance of the new terms of the Privacy Policy. 

How to contact us

For questions regarding the processing of your personal data, please contact us:

INSTYTUTUM AG, 

Our address: Gubelstrasse 12, 6300 Zug, Switzerland; 

Our telephone: +41 41 511 20 50; 

Our email: [email protected]. 

We always welcome and greatly appreciate your feedback, any comments, or suggestions that may contribute to a better quality of our work.

Thank you for choosing INSTYTUTUM AG!