Privacy Policy

1. Who we are

The controller of your personal data is Pokoi Cosmetics B.V. i.o., acting through Semi Huerfano, a sole proprietorship registered with the Dutch Chamber of Commerce under number 84081473 and trading as Pokoi Cosmetics, with its business address at Tollensstraat 27B, 1053 RS Amsterdam, the Netherlands, and VAT identification number NL003911787B43. For any enquiry, including privacy matters, email info@pokoi-cosmetics.com.

Pokoi Cosmetics B.V. is in the process of incorporation. Until incorporation is complete, Semi Huerfano is the controller. On incorporation, Pokoi Cosmetics B.V. becomes the controller. The purposes, legal bases and retention periods set out in this policy are unaffected.

We are not required to appoint a Data Protection Officer and have not appointed one. Privacy questions are handled directly by us.

2. What we collect

2.1 When you sign up for launch notifications

• your email address;
• the fact that you gave consent, and the wording you agreed to;
• the date and time of your submission.

Providing this is voluntary. The only consequence of not providing it is that we cannot notify you about the launch.

2.2 When you purchase a Reservation Fee

To take your payment, give you your discount entitlement and meet our legal obligations, we collect:

• your name;
• your email address;
• your billing address and country;
• the amount paid, the currency, the date and time, and the transaction reference;
• the payment method type (for example iDEAL or card) and, where our payment provider supplies it, the last four digits of a card;
• your Reservation Fee, the private Kickstarter access link issued to you, and whether you pledged during the campaign;
• your IP address at the time of payment, used by our payment provider for fraud prevention.

We never see or store your full card number, CVC or bank credentials. Those go directly to our payment provider, which is certified to handle them.

Providing this data is a contractual necessity: without it we cannot process your payment or issue your discount.

We do not collect special categories of personal data (such as health, ethnicity or biometric data), and we ask you not to send us any.

2.3 Automatically, when you visit

Our website is hosted by STRATO, in the Netherlands, whose servers record standard logs when a page is requested: the domain visited, the time of the request, the page or file requested, and the browser used.

STRATO stores visitor IP addresses for a maximum of seven days, in order to detect and defend against attacks on their servers, after which the addresses are anonymised. The logfiles that we can access show IP addresses and hostnames only in anonymised form – we never see or store your raw IP address from browsing this site.

Legal basis: our legitimate interest, and STRATO's, in the security and availability of the website (Art. 6(1)(f)). These logs are not used to profile visitors or to identify individuals.

2.4 Cookies and analytics

A full cookie list is in section 9.

Strictly necessary cookies – the one remembering your cookie choice, your session, and anything required to complete a payment securely – are set without consent, as permitted by Art. 11.7a of the Dutch Telecommunications Act.

If, and only if, you accept analytics cookies, we collect usage data through Google Analytics 4: pages viewed, time on site, approximate country-level location, and how you arrived. This data is pseudonymous, not anonymous – Google Analytics assigns your browser an identifier, and we prefer to state that accurately rather than overstate your anonymity.

Our Google Analytics configuration:

• a data processing agreement with Google is in place;
• IP-based location is resolved to country level only;
• Google Signals is switched off;
• ads personalisation and data sharing with other Google products are switched off;
• data retention is set to 14 months.

Analytics cookies are never set before you accept them. You can change or withdraw your choice at any time via "Cookie settings" in the footer, which is as easy to use as the original banner.

We do not use advertising pixels, remarketing tags, session recording or heatmap tools.

2.5 Fonts and embedded content

All fonts are hosted on our own server. No request is made to a third-party font provider, so no data about you is shared that way.

This website embeds a video hosted by YouTube (Google Ireland Limited). The video is loaded in YouTube's privacy-enhanced mode via youtube-nocookie.com, and it does not load at all until you choose to play it. Until then, only a static preview image served from our own server is shown, and no request is made to Google.

If you play the video, YouTube receives your IP address and information about your browser, and may set cookies on your device. That processing is governed by Google's privacy policy, and we have no access to the data. We rely on your consent for this (Art. 6(1)(a) GDPR), given by choosing to play the video.

Where we link out – for example to Kickstarter or our social profiles – those sites have their own privacy policies, which we do not control.

3. Why we use your data, and our legal basis

If you have purchased a Reservation Fee, we will email you about it – your confirmation, your access link, the reminder at least 24 hours before our campaign opens, notice that the campaign has opened and is closing, and anything else you need in order to use or cancel your reservation – regardless of whether you separately opted in to marketing. Those are service messages necessary to perform our contract with you, not marketing, and they have no unsubscribe link.

Separately, we may send occasional updates on how Pokoi is progressing. These are marketing, we send them only if you have opted in, and every one of them has an unsubscribe link. Opting in is entirely optional and is never a condition of buying a Reservation Fee. You can withdraw at any time without affecting your reservation or any of the service messages above.

We do not carry out automated decision-making or profiling producing legal or similarly significant effects. Stripe may run automated fraud checks on a transaction; if a payment is refused on that basis you can contact us at info@pokoi-cosmetics.com and we will look at it manually.

4. Who we share it with

We share your data only with the processors below, each acting on our instructions under a data processing agreement. We never sell your data.

Note that if you are a paying customer, your data is not added to our general newsletter list unless you separately opt in – purchase records are kept in our payment provider and accounting system.

We may also disclose data where legally required, for example in response to a valid order from a competent authority, or to our accountant or the Belastingdienst in connection with our tax obligations.

5. Transfers outside the EEA

Some processors are established in the United States, meaning your data is transferred outside the European Economic Area.

For Google LLC, transfers are covered by the EU–US Data Privacy Framework, under which Google is certified, and additionally by the European Commission's Standard Contractual Clauses.

Our email provider (Brevo) and our automation provider (Make.com) both process your data within the European Union, so no transfer outside the EEA takes place for those services.

Your payment is handled by Stripe Payments Europe Ltd, established in Ireland. Stripe transfers some data to its US parent, Stripe, Inc., under the European Commission's Standard Contractual Clauses and Stripe's certification under the EU–US Data Privacy Framework. Stripe's own privacy policy applies to the data it processes as a controller for its fraud-prevention and regulatory purposes, and is available at stripe.com/privacy.

You can request a copy of the safeguards we rely on by emailing info@pokoi-cosmetics.com.

6. How long we keep it

Email addresses from launch sign-ups: until our campaign has launched and related communications are complete, or until you withdraw consent – whichever comes first. In any event, deleted no later than six months after the campaign closes, unless you have separately opted in to hear from us on an ongoing basis.

Consent records: as long as we hold the email address, plus one year, so we can demonstrate the consent was valid.

Purchase and transaction records, including invoices: seven years from the end of the financial year in which the purchase was made. Dutch tax law (Art. 52 Algemene wet inzake rijksbelastingen) requires us to retain our financial administration for this period, and we cannot delete these records earlier even if you ask us to.

Your name, email and Reservation Fee record: until our Kickstarter campaign ends, and then for as long as needed to handle any resulting refund or complaint. The underlying transaction record remains subject to the seven-year period above.

Server logs: IP addresses are held by STRATO for a maximum of seven days and then anonymised. The anonymised logs available to us are retained for 30 days.

Analytics data: 14 months, per the Google Analytics retention setting.

7. How we protect it

We use HTTPS across the whole site, take payments only through a certified payment provider so that card data never reaches our systems, restrict access to customer records to those of us who need it, protect our accounts with two-factor authentication, and review our processors' security terms before using them. No system is perfectly secure, but if a breach ever occurs that is likely to put your rights at risk, we will notify you and the Autoriteit Persoonsgegevens as required.

8. Your rights

You have the right to:

• access the personal data we hold about you;
• rectify it if inaccurate;
• erase it;
• restrict or object to our processing;
• data portability – receive your data in a machine-readable format;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Two honest limits, so there are no surprises:

• Withdrawing marketing consent does not delete your purchase record. Where we hold data to perform our contract with you or to meet a legal obligation, the right to erasure does not apply for as long as that basis lasts (Art. 17(3)(b) GDPR).
• If you ask us to delete your discount entitlement, we will, but the entitlement goes with it and cannot be restored.

Withdrawing marketing consent is easy: every promotional email contains an unsubscribe link, you can change your cookie choice via "Cookie settings" in the footer, or email info@pokoi-cosmetics.com.

We respond within one month. There is no charge.

9. Cookies we use

10. Children

This website is not directed at children. We do not knowingly collect data from anyone under 16, and purchases may only be made by adults. If you believe a child has given us their data, email info@pokoi-cosmetics.com and we will delete it.

11. Complaints

If you are unhappy with how we handle your data, please tell us first at info@pokoi-cosmetics.com – we would rather fix it directly.

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

12. Changes to this policy

We may update this Privacy Policy. The current version is always at this address, with version number and last-updated date at the top. If we make a change that materially affects how we use data you have already given us, we will contact you before it takes effect.

13. Contact

Pokoi Cosmetics B.V. i.o. / Semi Huerfano Tollensstraat 27B, 1053 RS Amsterdam, the Netherlands KvK 84081473 – BTW-id NL003911787B43 info@pokoi-cosmetics.com