Privacy Policy

Last updated: 4 August 2026

1. Who We Are

Olune Aesthetic Supply is a trading name of Olune Ltd.

For the purposes of UK data protection law, Olune Ltd is the data controller responsible for the personal information covered by this Privacy Policy.

2. Information We Collect

We may collect the following categories of personal information.

Identity and professional information

• Your full name and job title.
• Your profession or professional role.
• Your clinic, salon, pharmacy or business name.
• Professional registration or membership details.
• Practitioner, healthcare professional or prescriber status.
• Professional certificates or supporting verification documents.
• Company registration, VAT or other business information.

Contact information

• Email address.
• Telephone or mobile number.
• Billing address.
• Delivery address.
• Business contact details.

Account information

• Username and encrypted password.
• Account preferences and saved addresses.
• Professional verification status.
• Account activity and order history.

Order and transaction information

• Products purchased or requested.
• Order dates, values and payment status.
• Delivery, return and refund information.
• Invoices and transaction records.
• Communications relating to your order.

We do not normally receive or store your complete payment-card information. Payment details are processed securely by the relevant third-party payment provider.

Communications

We may keep records of communications you send to us through email, telephone, WhatsApp, social media, website forms, live chat or other customer-support channels.

Marketing information

• Your marketing subscription status.
• Your communication preferences.
• Records of when and how you subscribed.
• Email opens, clicks and interactions where enabled.
• Your product and category interests.
• Records of unsubscribe or objection requests.

Technical and website information

• Internet Protocol address.
• Browser type and version.
• Device type and operating system.
• Approximate location based on your IP address.
• Pages viewed and website interactions.
• Referral source and session information.
• Cookie identifiers and analytics information.

3. How We Collect Your Information

We may collect personal information:

• Directly from you when you create an account, complete a professional verification form, place an order or contact us.
• When you subscribe to our marketing communications.
• Automatically when you browse or interact with our website.
• Through cookies and similar technologies.
• From payment processors, couriers, website providers and other service providers.
• From publicly available professional registers or Companies House records where verification is necessary.
• From your clinic, employer or business where they create or manage an account on your behalf.

4. How and Why We Use Your Information

Processing and fulfilling orders

We use personal information to:

• Accept and process your order.
• Take or confirm payment.
• Issue invoices and order confirmations.
• Package, dispatch and deliver products.
• Provide delivery and tracking updates.
• Manage returns, refunds and complaints.
• Respond to order-related enquiries.

Our lawful bases are generally the performance of a contract and compliance with our legal obligations.

Creating and managing customer accounts

We use your information to:

• Create and administer your account.
• Provide access to account features.
• Save your account preferences and addresses.
• Display previous orders.
• Protect account security.
• Provide customer support.

Our lawful basis is generally the performance of a contract.

Verifying professional customers

Some products, prices or areas of our website may only be available to verified practitioners, clinics, healthcare professionals, prescribers or professional businesses.

We may use professional and business information to:

• Confirm your identity.
• Verify your professional or business status.
• Review supporting certificates or documentation.
• Confirm your eligibility to purchase practitioner-only products.
• Prevent unauthorised access to restricted product ranges.
• Comply with applicable supplier or distribution requirements.
• Maintain appropriate sales and verification records.
• Protect our customers, suppliers and business.

Depending on the circumstances, our lawful bases are performance of a contract, compliance with a legal obligation and our legitimate interests in operating a responsible and secure professional-supply business.

Verification by Olune Aesthetic Supply does not represent an endorsement, certification or guarantee of a practitioner’s competence, regulatory status or clinical services.

Providing customer service

We may use your information to:

• Answer product, account and delivery questions.
• Respond to complaints.
• Investigate damaged, missing or delayed orders.
• Manage returns and refunds.
• Maintain a record of customer-service interactions.

Our lawful bases are the performance of a contract and our legitimate interests in providing effective customer service.

Preventing fraud and protecting our business

We may process personal information to:

• Detect and prevent fraudulent transactions.
• Identify suspicious or unauthorised account activity.
• Protect our website, systems and users.
• Enforce our terms and conditions.
• Investigate security incidents.
• Establish, exercise or defend legal claims.

Our lawful bases are our legitimate interests and, where applicable, compliance with legal obligations.

Improving our website, products and services

We may analyse website and purchasing information to:

• Understand how visitors use our website.
• Improve website navigation and performance.
• Identify popular products and categories.
• Resolve technical problems.
• Improve our customer experience.
• Develop our product range and business.

We rely on consent where required, including for certain analytics cookies. In other circumstances, we may rely on our legitimate interests in improving our business and services.

Sending service communications

We may contact you about:

• Your customer account.
• Your professional verification application.
• An order, payment, delivery, return or refund.
• Account or website security.
• Important changes to our services, policies or terms.

These are operational or service messages and are not marketing communications.

Sending marketing communications

Where permitted by law, we may send information about:

• New aesthetic and skincare products.
• Practitioner-only products and ranges.
• Training and educational opportunities.
• Professional offers and promotions.
• Product availability and restocks.
• Clinical insights and relevant business updates.

We normally rely on your consent to send electronic marketing. Where legally permitted, we may rely on the existing-customer soft opt-in for similar products or services.

You may unsubscribe at any time by selecting the unsubscribe link in an email or by contacting info@olune.co.uk.

Unsubscribing from marketing will not prevent us from sending essential account, order or service communications.

5. Our Lawful Bases

Depending on the relevant activity, we may rely on:

• Contract: processing is necessary to provide products or services that you have requested.
• Legal obligation: processing is necessary to meet our tax, accounting, regulatory or other legal obligations.
• Legitimate interests: processing is necessary to operate, secure, protect or improve our business, provided that your interests and rights do not override those interests.
• Consent: you have clearly agreed to a specific activity, such as receiving marketing emails or allowing non-essential cookies.

6. Professional Verification Documents

When you submit professional certificates, registration details or other evidence, we use this information for customer verification, account administration and compliance purposes.

We may:

• Check information against publicly available professional registers.
• Contact you if additional information or clarification is required.
• Restrict or refuse account access if verification cannot be completed.
• Request updated information where existing evidence has expired.
• Keep an appropriate record of the verification decision.

7. Special Category Information

We do not ordinarily require health information or other special-category personal information from our customers.

Please do not submit patient health information, treatment records or identifiable clinical photographs through our website, email, WhatsApp or customer-service channels unless we have specifically requested the information and provided an appropriate method for sending it.

Where unnecessary special-category information is received unintentionally, we may securely delete it.

8. Who We Share Your Information With

We may share relevant personal information with trusted third parties, including:

• Website hosting and technical-service providers.
• WordPress, WooCommerce and related website providers.
• Payment processors and banking providers.
• Postal, courier, fulfilment and delivery companies.
• Email and marketing-platform providers.
• Cloud storage, security and IT-support providers.
• Analytics and website-performance providers.
• Customer-service and communication providers.
• Product suppliers where necessary to fulfil an order.
• Accountants, insurers, auditors and professional advisers.
• Regulators, public authorities, law-enforcement bodies or courts where disclosure is required or permitted by law.
• A potential purchaser, investor or adviser in connection with a business reorganisation, investment or sale.

We only share information reasonably necessary for the relevant service or purpose.

Where a provider processes personal information on our behalf, we require it to protect the information and process it in accordance with applicable law and our instructions.

We do not sell your personal information.

9. Payments

Payments are handled by independent payment-service providers. The relevant provider may collect:

• Cardholder name.
• Billing address.
• Payment-card information.
• Transaction details.
• Device and security information.
• Fraud-prevention information.

Payment providers process personal information according to their own privacy policies and legal obligations.

Olune Aesthetic Supply does not normally store complete payment-card numbers or card-security codes.

10. Deliveries

We share the information needed to fulfil and deliver your order with the relevant courier, postal or fulfilment provider. This may include:

• Recipient name.
• Delivery address.
• Email address.
• Telephone number.
• Order or tracking reference.
• Delivery instructions.

11. International Transfers

Some of our service providers may store or process personal information outside the United Kingdom.

Where an international transfer takes place, we take reasonable steps to ensure that an appropriate legal safeguard is used. This may include:

• Transfers to countries covered by UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The UK Addendum to approved contractual clauses.
• Another safeguard permitted under UK data protection law.

You may contact us for more information about the safeguards used for relevant international transfers.

12. How Long We Keep Your Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, regulatory, fraud-prevention and dispute-resolution requirements.

Type of information	Indicative retention period
Orders, invoices and accounting records	Normally up to six years after the relevant financial period
Customer account information	While the account is active and for an appropriate period afterwards
Professional verification records	While the account remains verified and for an appropriate compliance period afterwards
Customer-service communications	Normally up to three years after the matter is closed
Marketing preferences and consent records	While you are subscribed and for an appropriate period after unsubscribing
Incomplete or unsuccessful verification applications	Normally up to 12 months unless a longer period is reasonably required
Security and fraud-prevention records	For as long as reasonably necessary to manage the relevant risk
Cookie and analytics information	According to the duration of the relevant cookie or service setting

We may retain information for longer where required by law or where necessary to prevent fraud, resolve a dispute or establish, exercise or defend legal claims.

13. Cookies and Similar Technologies

Our website may use cookies and similar technologies for:

• Website functionality.
• Shopping baskets and checkout.
• Customer account login.
• Website and account security.
• Remembering user preferences.
• Website analytics and performance measurement.
• Marketing or advertising where enabled.

Strictly necessary cookies may be used without consent where they are required to provide a website function or service that you have requested.

We request consent before placing non-essential cookies where consent is legally required. You should be able to accept, reject or manage non-essential cookies through the cookie controls displayed on our website.

You can also manage cookies through your browser settings. Blocking necessary cookies may prevent some website features, including the shopping basket or account login, from working properly.

14. Data Security

We use reasonable technical and organisational measures intended to protect personal information from:

• Unauthorised access.
• Accidental loss.
• Misuse or alteration.
• Unauthorised disclosure.
• Destruction.

Measures may include:

• Encrypted website connections.
• Controlled access to systems and accounts.
• Secure website hosting.
• Security and activity monitoring.
• Software updates and backups.
• Confidentiality obligations for staff and service providers.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

You are responsible for keeping your account password confidential. Please contact us promptly if you believe that your account has been compromised.

15. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Object to the use of your information for direct marketing.
• Receive certain information in a portable format.
• Withdraw your consent at any time.
• Complain to the Information Commissioner’s Office.

These rights do not apply in every circumstance and may be subject to legal exemptions.

16. How to Exercise Your Rights

To exercise a data-protection right or ask a question about your information, contact:

We may ask for information to verify your identity before responding to your request.

We normally respond within one month. In certain circumstances, the response period may be extended where permitted by law.

17. Complaints

Please contact us first so that we have an opportunity to investigate and resolve your concern.

You also have the right to make a complaint to the UK’s data-protection regulator:

Information Commissioner’s Office
Website: ico.org.uk

18. Automated Decision-Making

We do not currently make decisions that produce legal or similarly significant effects on customers solely by automated means.

Automated systems may be used to identify potentially fraudulent transactions, suspicious orders or unusual account activity. Where appropriate, flagged activity may be reviewed before significant action is taken.

19. Third-Party Links

Our website may include links to third-party websites, payment providers, social-media platforms or other services.

We are not responsible for how those third parties process personal information. You should review the privacy policy of the relevant third party before providing it with your information.

20. Children

Our website, professional accounts and products are intended for adults.

You must be at least 18 years old to create an account or place an order. We do not knowingly collect personal information from children.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• Our business or services.
• The technologies and service providers that we use.
• Our processing activities.
• Applicable laws or regulatory guidance.

The latest version will be published on this page with an updated revision date. Where appropriate, significant changes may also be communicated through our website or by email.

22. Contact Us

For questions about this Privacy Policy or the way we handle personal information, contact: