Privacy policy

Updated October 23, 2026.

Introduction

When you contact NERO or browse this website, we may process personal information. TELXIA Ltd is committed to protecting its confidentiality and security in accordance with applicable data protection law, including Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

Personal data means information relating to an identified or identifiable individual. This policy explains the information used for the international NERO catalogue, its purposes and your rights. Regional online boutiques have their own privacy information.

1. Who is responsible for your information?

TELXIA Ltd, registered in Bulgaria under number 205264867, is the data controller.
Registered office: 99 Ivaylo Street, 8000 Burgas, Bulgaria.
General contact: info@neroskincare.com.
Privacy enquiries: privacy@neroskincare.com.

2. What information is collected, and why?

Contact enquiries. We use your name, email, country, message and any product reference you provide to respond to your request. Business details are requested where relevant to a partnership enquiry.

Partnership enquiries. The form requests your name, business email, establishment or company, business type, city and country, and project. Your website or Instagram account is optional. Required fields are identified in the form; without them, we may be unable to handle the enquiry.

We process these enquiries to take steps at your request before entering a possible contract, or on the basis of our legitimate interest in responding to questions and managing business relationships. Sending an enquiry does not subscribe you to marketing emails.

Website operation and security. Technical information, such as an IP address and request information, may be processed to operate and secure the website. The forms use a short-lived anti-spam rate limit based on a hash of the email address and IP address. This processing serves our legitimate interest in protecting the service.

Cookies and optional tools. Depending on the choices you make, analytics or marketing tools may process information about your browsing. Where consent is required, it is requested through the cookie interface. See the Cookie policy.

Find my ritual. The questionnaire does not request an email address. Its answers are used in your browser to display cosmetic guidance. The questionnaire does not send its answers through a contact form, create a customer account or place an order. If you contact us afterwards, the separate enquiry form applies.

This catalogue does not collect payment details or delivery addresses for online purchases. If you leave it to visit a regional boutique, that boutique’s privacy policy applies.

3. Who can receive your information?

Information is available to the NERO team handling your request and to service providers needed to operate the website, host it, deliver emails or provide technical support. Authorities may receive information where required by law. Optional third-party tools are described in the cookie interface and their own privacy policies.

We require service providers acting on our behalf to protect personal data and to process it only for the agreed purposes.

Some third-party services may process information outside the European Economic Area. Where such a transfer falls within our responsibility, applicable GDPR safeguards are required. You can contact us for information about the providers and safeguards relevant to your request. This policy does not assume that all third-party processing takes place within the European Union.

4. How long is information kept?

Information is retained only for as long as needed for the purpose for which it was collected. In accordance with our published retention policy, prospect information may be retained for up to two years after the last contact, unless a shorter period is specified or deletion is appropriate sooner.

If a contractual relationship is established, relevant information is retained for the relationship and any period necessary to meet legal obligations or establish, exercise or defend legal claims. The enquiry rate-limit record expires after one minute. Cookie storage periods are shown in the consent interface where available.

5. Cookies

Cookies are small files stored on your device by your browser. Necessary cookies support essential website functions. Other categories may support preferences, statistics or marketing. Details and choices are available through our Cookie policy and the “Manage my cookies” button in the footer.

6. Your cookie choices

You can reopen the cookie settings at any time to change your choices or withdraw consent for optional cookies. Withdrawing consent does not affect the lawfulness of earlier processing. You can also use your browser settings to remove or block cookies; some essential functions may then be affected.

7. Security

We use technical and organisational measures intended to protect personal data against unauthorised access, disclosure, loss or alteration. Please avoid including sensitive information that is unnecessary for your enquiry.

8. Changes to this policy

We may update this policy to reflect changes to our services or applicable rules. The version published on this website replaces earlier versions for future use of the service.

9. Your rights

Subject to the conditions of applicable law, you may request access to, rectification or erasure of your personal data, restriction of processing, portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time.

To exercise your rights, write to privacy@neroskincare.com or the registered office above. Additional information to confirm your identity may be requested where necessary. We normally respond within one month; this may be extended by up to two further months for complex or numerous requests, with notice within the first month.

You may lodge a complaint with a competent supervisory authority, including the authority in your country of habitual residence, place of work or the place of an alleged infringement. In France, this is the CNIL; in Bulgaria, the Commission for Personal Data Protection.