Privacy Policy

SYNERGIE SKIN

PRIVACY POLICY

In this Privacy Policy, ‘Synergie’ ‘us’ ‘we’ or ‘our’ means Synergie Skin Pty Ltd (ACN 119 198 560; ABN 84 119 198 560). We are committed to respecting your privacy. Our Privacy Policy sets out how we collect, use, store and disclose your Personal Data.

We will protect you with regard to the processing of your Personal Data and we will comply with the rules relating to the free movement of Personal Data. Our purpose is to protect your fundamental rights and freedoms, and your right to the protection of Personal Data.

Synergie respects the privacy of individuals and is committed to its obligations under the Privacy Act 1988 of the Commonwealth of Australia (Privacy Act), the Australian Privacy Principles (APP) and the General Data Protection Regulation of the European Union (GDPR).

“Personal Data” means “Personal Information” as defined under Section 6 of the Privacy Act and “Personal Data” as defined under Article 4(1) of the GDPR which includes name, emails, phone numbers and other information relating to an identified or identifiable natural person. Any terms used in this Privacy Policy that are defined in the GDPR, have the same meaning as defined in the GDPR including but not limited to “Personal Data”, “Commissioner”, “Controller”, “Processor”, “Union” and “Member State”.

By using our website or services, you acknowledge that we will collect, use and disclose your Personal Data as described in this Privacy Policy and any relevant collection notice. Where required by law, we will seek your consent, including express consent for sensitive or health information. We may update our Privacy Policy from time to time when our information handling practices change. Updates will be publicised on our website and through our email lists. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy.

Your Personal Data includes any information or opinion about you, or from you which is reasonably identifiable. For example, this may include your name, age, gender, postcode, contact details, identification number, location data, online identifier or any reference which is specific to your physical, physiological, genetic, mental, economic, cultural or social identity.

OUR PRIVACY OBLIGATION

Privacy Act and APP – A copy of the Privacy Act, APP and guidance from the Office of the Australian Information Commissioner are available from the website of the Office of the Australian Information Commissioner at oaic.gov.au.
GDPR – A copy of the REGULATION (EU) 2016/679, the privacy principles and guidance from the European Parliament and of the Council are available from the website at eur-lex.europa.eu.

KEY PRINCIPLES

We value your Personal Data entrusted to us and we are committed to processing your Personal Data in a fair, transparent and secure way. The key principles Synergie applies are as follows:

Lawfulness: we will only collect your Personal Data in a fair, lawful and transparent manner.
Data minimisation: we will limit the collection of your Personal Data to what is directly relevant and necessary for the purposes for which they have been collected.
Purpose limitation: we will only collect your Personal Data for specified, explicit and legitimate purposes and not process your Personal Data further in a way incompatible with those purposes.
Accuracy: we will keep your Personal Data accurate and up to date. Personal Data has to be accurate and kept up to date, for that reason we will ensure that any inaccurate Personal Data (to our knowledge) will be erased or rectified without delay.
Data security and protection: we will implement technical and organisational measures to ensure an appropriate level of data security and protection considering, among others, the nature of your Personal Data to be protected. Such measures provide for the prevention of any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration and any other unlawful form of processing.
Access and rectification: we will process your Personal Data in line with your legal rights.
Protection for international transfers: we will ensure that any of your Personal Data transferred outside Australia and the European Economic Area (if applicable) is adequately protected.
Safeguards towards third parties: we will ensure that Personal Data access by (and transfers to) third parties are carried out in accordance with applicable law and with suitable contractual safeguards.
Lawfulness of direct marketing and cookies: when we send you promotional materials or place cookies on your computer, we will ensure that we do so in accordance with applicable law.

HOW LONG WE KEEP DATA

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We will securely destroy your personal data in accordance with applicable laws and regulations.

If you would like further information about our specific retention periods for your personal information, please contact us using the contact details located at the end of this policy.

Chatbot data retention: Where you interact with our AI chatbot, conversation data (including message content, attachments, session identifiers and device information) may be retained for service delivery, quality assurance, analytics and debugging. Identifiable chatbot data is typically deleted after 13 months, unless a shorter or longer period is required to comply with our legal obligations or to resolve disputes. Photographs you upload may be deleted sooner, for example within 7 to 10 days, subject to our provider's final configuration. You can request deletion of your chatbot conversations at any time by contacting us using the details at the end of this policy.

WHAT PERSONAL DATA DO WE COLLECT?

We may collect the following types of Personal Data:

name
mailing or street address;
billing or shipping address;
email address;
telephone number and other contact details;
gender, age or date of birth;
product preference;
details of previous participation in our events and activities or similar events and activities held by another party;
purchasing or transaction history;
payment and banking details, including credit card information;
your device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information;
details of the goods and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those goods and services and respond to your enquiries;
any additional information relating to you that you provide to us directly through our website or app, paper forms at our exhibitions or exhibition order forms or indirectly through your use of our website, app or online presence or through other websites or accounts from which you permit us to collect information;
information you provide to us through customer surveys; or
any other Personal Data that may be required in order to facilitate your dealings with us.

Where you interact with our AI chatbot on our website, we may also collect the following Personal Data:

name and email address;
age and gender;
skin type, skin concerns and products you currently use;
allergies, medications and pregnancy status (see the section on sensitive information below);
photographs or images of your face or skin that you choose to upload;
order details, including order status, shipping and tracking information, where order lookup is enabled;
conversation content and any attachments you submit; and
session identifiers, IP address and device information.

If you upload images to our chatbot, you must only upload clear images of your own face or skin. You must not upload images of any other person, and you must not upload any graphic, offensive or otherwise inappropriate images.

HOW DO WE COLLECT PERSONAL DATA?

We only collect specified and explicit Personal Data for legitimate purposes to the extent that permits identification of data subjects and is necessary for our purpose. Such Personal Data will be kept in an appropriate way to ensure security of your privacy.

We will only process your Personal Data where we have a legal ground to do so, for example when you have given your consent to process it, when it is necessary for the performance of a contract, when required for compliance with a legal obligation, when it is necessary to protect your vital interest, when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller and finally, when it is necessary for the purposes of legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of Personal Data, in particular where the data subject is a child. We will ensure that your Personal Data is processed lawfully, fairly and in a transparent manner. We may collect these types of Personal Data either directly from you, or from third parties. We may collect this information in a number of ways, including:

When you visit and/ or register on our website or app;
When you enter a competition or promotion;
When you respond to a survey;
When you join our mailing list;
When you engage us to perform services to you;
When you communicate with us through correspondence, chats, email, or when you share information with us from other social applications (such as LinkedIn, Facebook or Twitter), services or websites;
When you interact with our sites, services, content and advertising;
When you invest in our business or enquire as to a potential purchase in our business;
from third parties such as our related entities, business or commercial partners, credit reporting bodies, wholesale or other customers, or your representatives; or
from publicly available sources of information.

We may also generate Personal Data about our customers from information that we have. For example, by analysing our records of a customer’s use of our products or services or the customer’s previous dealings with us.

We may also collect personal information from when you use or access our website or our social media pages. This may be done through the use of web analytics tools, ‘cookies’ or other similar tracking technologies that allow us to track and analyse your website usage.

WHY DO WE COLLECT, USE AND DISCLOSE PERSONAL DATA?

We may collect, hold, use and disclose your Personal Data for the following purposes:

to verify your identity and to assist us to provide, develop and improve our goods and services to you, such as conducting our events and activities, extending and processing invitations to attend or participate in our events and activities, managing admission to our events and activities, marketing and sales, debtor and creditor transactions, sponsorship, promotions, direct marketing and corporate membership administration;
to enable you to access and use our website and services;
to operate, protect, improve and optimise our website and services, business and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;
to make tailored recommendations, for your benefit;
to provide goods or services to you or to receive good and services from you;
to invite you to exclusive events organised for our customers;
to develop and improve our products, services and business;
to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
to send you marketing and promotional messages and other information that may be of interest to you;
for our internal administration purpose;
to comply with our legal obligations, address any issues or to resolve any disputes that we may have with any of our users, and enforce our agreements with third parties.
We may also disclose your Personal Data to a trusted third party who also holds other information about you. This third party may combine that information in order to enable it and us to develop anonymised consumer insights so that we can better understand your preferences and interests, personalise your experience and enhance the products and services that you receive.

Individuals are not obliged to give us their Personal Data. However, if they choose not to provide us with all or part of the Personal Data requested, we may not be able to extend or process invitations to them to attend or participate in our events or activities, admit them to attend or permit them to participate in our events or activities, provide them with a full range of our goods and services, or inform them about the events and activities conducted by us, the goods and services offered by us or the goods and services of other organisations.

Legal bases for processing Personal Data under the GDPR/UK GDPR

Purpose	Legal basis under GDPR/UK GDPR
Providing products, services, customer support and order assistance	Performance of a contract or taking steps before entering a contract
Responding to enquiries	Legitimate interests, or taking steps at your request before entering a contract
Providing chatbot product recommendations	Consent and/or legitimate interests
Collecting skin concerns, allergies, medication information, pregnancy status or uploaded photos that may reveal health information	Explicit consent
Operating, maintaining and improving our website, chatbot, products and services	Legitimate interests
Analytics and service improvement	Legitimate interests, or consent where required
Sending email or SMS marketing	Consent, where required by law
Complying with legal obligations	Legal obligation
Handling disputes, enforcing rights and protecting our business	Legitimate interests or legal obligation

SHARING YOUR DATA

We may share your personal information in certain circumstances, as following:

where there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would seek to only disclose information in good faith and where required by any of the above circumstances;
credit-checking agencies for credit control reasons;
disclosures required by law or regulation; and
service providers and other affiliated third parties to enable us to provide our services to you including other professional advisers such as accountants, disaster recovery service providers or auditors and/or overseas counsel.

COLLECTION OF SENSITIVE INFORMATION

Sensitive information includes Personal Data about a person's racial or ethnic origin, political opinions or memberships, religious or philosophical beliefs or affiliations, professional or trade association or union memberships, sexual orientation or practices, criminal record or health (including genetic and biometric information).

We do not generally collect sensitive information about individuals and only collect it where you provide it to us for a specific purpose.

Our AI chatbot may collect sensitive information, including health information such as allergies, skin conditions, medication use, pregnancy status, health concerns, and photographs that may reveal information about your health. We only collect this sensitive and health information with your express, active consent, which you give by opting in before you submit it.

We use this information to provide product recommendations, customer support, analytics and service improvement. You do not have to provide sensitive information, and we ask that you avoid submitting any sensitive information that is not necessary for your enquiry. If you provide sensitive information to us for any reason, you consent to us collecting, using and disclosing that information for the purpose for which you disclosed it and as permitted under applicable law. We will handle any sensitive information we receive in accordance with applicable law and this Privacy Policy.

MINORS

The chatbot is not intended for users under 18 without parent or guardian consent. Where the chatbot asks for your age and you indicate that you are under the required age threshold, a parental consent prompt will appear, and the chatbot should only be used where that consent has been given. If we become aware that we have collected Personal Data from a minor without the required parental or guardian consent, we will take reasonable steps to delete that information.

AI CHATBOT AND AUTOMATED PROCESSING

We offer an AI chatbot on our website that can answer product-related questions and customer enquiries, help with "where is my order" queries, receive your skin concerns, allow you to upload a photograph of your skin, and suggest products based on the information you provide.

Responses may be generated using artificial intelligence, and the information you enter may be processed by our chatbot and AI service providers. The chatbot may suggest products based on the information you provide. These suggestions are general product recommendations only. They are not medical advice, diagnosis or treatment, and they do not make decisions that have a legal, financial or similarly serious impact on you. You can choose whether or not to follow the recommendation or purchase any product.

Our chatbot and AI layer are currently provided by Alhena, and our website is hosted by Shopify. Alhena may use large language model tools provided by subprocessors, currently including OpenAI and Anthropic. The subprocessors we use may change from time to time.

Alhena indexes our website content and Shopify product catalogue connected to our account, so that product and knowledge content can be retrieved to answer your questions. This indexing is separate from, and is not used for, training AI models. Our connection to Shopify may allow the chatbot to access current and historical orders, and order events and purchased items may be synced. Where order lookup is enabled, the chatbot can retrieve your email, order status, shipping and tracking information.

Your conversations may include message content, attachments, session identifiers and IP and device information. Message content may be retained in operational analytics and debugging traces. Where you upload a photograph, that photograph and any analysis results may be processed and stored as data needed to provide and account for the chatbot service.

Conversation history may be used to provide context for your interactions and for quality evaluation and debugging. Synergie data is not used to train AI model weights. Some data, including the main database, sampled photo storage and analytics, may be located in the United States.

We ask that you avoid submitting any unnecessary sensitive information to the chatbot.

Using the chatbot will not automatically add you to our email or SMS marketing lists; marketing is separate and optional and only occurs where you opt in (see the section on direct marketing below). We may use analytics for service improvement.

DO WE USE YOUR PERSONAL DATA FOR DIRECT MARKETING?

We may send you direct marketing communications and information about our products or service. This may take the form of phone calls, emails, SMS, mail or other forms of communication, in accordance with the Spam Act and the applicable law. Marketing is optional and opt-in. Using our AI chatbot will not automatically subscribe you to our email or SMS marketing communications.

You may opt out of receiving marketing materials from us by contacting us using the details set out below or by using the opt-out facilities provided (e.g. an unsubscribe link).

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?

We may disclose Personal Data for the purposes described in this Privacy Policy to:

our employees and related bodies corporate;
service providers (including providers that host our web servers, manage our IT and/ or those involved in the operation of our business or in connection with providing our products and services to you);
our chatbot, AI, website hosting, CRM, email marketing and analytics providers (including Alhena, Shopify and their subprocessors such as OpenAI and Anthropic), for the purpose of operating our chatbot and website and improving our services;
professional advisers, lawyers, accountants, insurers, auditors, dealers and agents;
payment systems operators (e.g. merchants receiving card payments);
our sponsors or promoters of any competition that we conduct via our services;
anyone to whom our assets or businesses (or any part of them) are transferred;
specific third parties authorised by you to receive information held by us;
in certain circumstances, to third parties that require information for law enforcement or to prevent a serious threat to public safety; and/ or
other persons, including government agencies, regulatory bodies, and law enforcement agencies, or as required, authorised or permitted by law.

We require our service providers to keep Personal Data confidential and not to use or disclose it for any purpose other than performing services for us or on our behalf.

You should be aware that some information that you upload to parts of our websites or to our social media pages may be available to be viewed by the public. You should use discretion in deciding what information to upload to such sites.

TRANSFER OF PERSONAL DATA

We may disclose or transfer your Personal Data to recipients outside Australia, including in the countries listed below. Where required, we take reasonable steps to ensure overseas recipients handle your Personal Data in accordance with applicable privacy laws and appropriate contractual safeguards.

As we deal with some customers overseas, some information (including Personal Data) may be transferred to countries outside of Australia in the ordinary course of our business. In particular, Personal Data collected through our website, chatbot, CRM, email marketing and analytics providers may be transferred to, or accessed from, Australia and the United States, and potentially other countries depending on the subprocessors used by our service providers from time to time.

Pursuant to any applicable privacy and data protection laws (including, without limitation, the Privacy Act, APP and GDPR), your Personal Data may be disclosed, processed and transferred by Synergie on a worldwide basis for the purposes of providing our services. Personal Data may be disclosed or transferred to agents or third parties authorised to act on our behalf for the purposes of providing the services.

TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA (‘EEA’)

To provide our services, we may transfer the personal information we collect to countries outside of the UK or EEA which do not provide the same level of data protection as the country in which you reside and are not recognised by the European Commission as providing an adequate level of data protection.

When we do this, we will make sure that it is protected to the same extent as the EEA and UK as we will put in place appropriate safeguards to protect your personal information, which may include standard contractual clauses.

For more information, please contact us using the contact details located at the end of this policy.

YOUTUBE & GOOGLE

By using the website you acknowledge that the Synergie Skin website uses the YouTube API services. By using those services you also acknowledge and agree to the connected use of the YouTube Terms of Service, Google Privacy Policy, and Google Security Settings.

SECURITY

We take reasonable steps to ensure your personal information is secure and protected from misuse or unauthorised access. Our information technology systems are password protected, and we use a range of administrative and technical measures to protect these systems. However, we cannot guarantee the security of your personal information.

LINKS

Our website may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content in those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites.

YOUR DATA PROTECTION RIGHTS

Please be advised that in case you allow us to collect and process certain Personal Data from you, you have the following rights:

Right of Access. You have the right to obtain from us confirmation as to whether or not Personal Data concerning you are processed, and, where that is the case, you have the right to request and get access to that Personal Data.
Right to be Informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we are providing you with the information in this policy.
Right to Rectification. You have the right to obtain from us the rectification of inaccurate Personal Data and you have the right to provide additional Personal Data to complete any incomplete Personal Data.
Right to Erasure (“Right to be Forgotten”). In certain cases, you have the right to obtain from us the erasure of your Personal Data.
Right to Restriction of Processing. You have the right to obtain from us restriction of processing, applicable for a certain period and/or for certain situations.
Right to Data Portability. You have the right to receive from us in a structured format your Personal Data and you have the right to transmit such Personal Data to another controller.
Right to Object. In certain cases, you have the right to object to processing of your Personal Data, including with regards to profiling. You have the right to object at further processing of your Personal Data in so far as such data have been collected for direct marketing purposes.
Right to be Not Subject to Automated Individual Decision-Making. You have the right to not be subject to a decision based solely on automated processing.
Right to Filing Complaints. You have the right to file complaints with the applicable data protection authority on our processing of your Personal Data.
Right to Withdraw Consent: If you have given your consent to anything we do with your personal information, you have the right to withdraw your consent at any time. This includes your right to withdraw consent to us using your personal information for marketing purposes.
Right to Compensation of Damages. In case we breach applicable legislation on processing of your Personal Data, you have the right to claim damages from us for any damages such breach may cause with you.

You may, at any time, exercise any of the above rights, by using the contact details provided at the end of this policy.

ACCESSING OR CORRECTING YOUR PERSONAL DATA

You have the right to seek access to the Personal Data we hold about you. Sometimes, we may not be able to provide you with access to all of your Personal Data and, where this is the case, we will tell you why. We may also need to verify your identity when you request your Personal Data.

You also have the right to request us to correct any Personal Data we hold about you which is inaccurate. We will take reasonable steps to ensure that it is corrected.
You can ask for access to or correction of your Personal Data by contacting us using our details under the ‘Contact Us’ section below.

MAKING A COMPLAINT

If you wish to make a complaint about the way we have handled your Personal Data, you can contact us using the details set out below.

Please include your name, email address and/or telephone number and include as much detail as possible in relation to your complaint. We will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time. If you think that we have failed to resolve the complaint satisfactorily, you may refer the issue to the Office of the Australian Information Commissioner (at enquiries@oaic.gov.au) or your national Data Protection Authority.

For further information about our Privacy Policy or practices, or to access or correct your Personal Data, or make a complaint, please contact us using the details set out below:

The Privacy Officer
Ms Pooneh Azady
Synergie Skin Pty Ltd
17-21 Longford Court,
Springvale VIC 3171

Phone: 1300 689 619 (within Australia) or +61 3 9008 6024 (international)
Fax: 03 9830 6659
info@synergieskin.com

Item added to your cart

Privacy Policy

SHOPPING BAG