1. Who this Privacy Policy applies to
This Privacy Policy explains how LMD BEAUTY EU S.A.R.L.-S (“LMD BEAUTY EU”, “we”, “us” or “our”) processes personal data in connection with lmdbeauty.eu, our B2B customer platform, account applications, orders, communications and related services.
Our services are intended exclusively for professional customers. Even in a B2B context, information relating to identifiable individuals — for example employees, directors, sole traders, purchasing contacts or delivery contacts — may constitute personal data and is protected under applicable data-protection law.
2. Data controller
We have not appointed a Data Protection Officer because we do not currently consider that our processing activities require the formal appointment of a DPO. Questions relating to privacy and the exercise of data-protection rights can be sent to the contact details above.
3. Personal data we process
Depending on how you interact with us, we may process the following categories of data:
- Business and account information: legal and trade name, company registration number, VAT number and country, website, preferred language, account status and account-related verification information.
- Contact information: first name, last name, business email address, telephone number, preferred contact method and role within the business where relevant.
- Address and delivery information: billing and shipping addresses, contact name, company name, telephone number, VAT information and, where needed for cross-border logistics, EORI information.
- Account and security information: authentication credentials in protected form, login timestamps, session information, IP address, browser/user-agent information and security/audit logs.
- Order and commercial information: carts, ordered products, quantities, prices, discounts, coupons or commercial credits, order versions and change history, payment status, shipment status, refunds, stock adjustments and related commercial records.
- Payment-related information: selected payment method, payment references and payment proof uploaded by the customer. We do not store full payment-card numbers.
- Communications: messages sent through our contact form, email exchanges and, where you choose this channel, WhatsApp Business conversations.
- Notification preferences: settings for optional account, order, promotional, cart reminder, inactivity, weekly price update and blog notifications, as well as product-specific back-in-stock subscriptions.
- Review information: when a Trustpilot invitation is triggered, customer name, customer email and the immutable order reference used for the invitation.
- Website and analytics data: cookie identifiers, page and event information, device/browser data, approximate location derived from IP address and similar usage information where analytics or embedded third-party content is enabled.
- B2B prospecting information: professional name, company, business email, telephone number, website, commercial notes and contact history obtained from publicly accessible professional/business sources or other legitimate B2B research channels.
We do not routinely request identity documents such as passports or national identity cards from customers, and we do not intentionally seek special-category personal data.
4. Why we use personal data and our legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Process B2B account applications and create customer accounts | Company, contact, VAT, address and account data | Pre-contractual measures, performance of a contract and our legitimate interest in onboarding eligible professional customers |
| Verify professional eligibility and VAT information | VAT number, company name, VIES verification evidence | Legal/tax compliance where applicable and legitimate interests in fraud prevention and B2B eligibility checks |
| Manage carts, orders, stock allocation, deliveries, payments, refunds and customer support | Account, order, payment, delivery and communication data | Performance of a contract and pre-contractual measures |
| Issue invoices, credit notes and maintain accounting records | Company, order, payment and invoice data | Compliance with legal obligations |
| Protect the platform, prevent abuse and maintain auditability | IP address, session, device, login and audit data | Legitimate interests in security, fraud prevention, service integrity and defence of legal claims |
| Send essential account-access and service communications | Name, email, account and order events | Performance of a contract, pre-contractual measures and legitimate interests in operating the service |
| Send optional commercial communications, offers, new arrivals and similar B2B updates | Email, account and preference data | Consent where required, or our legitimate interests/existing-customer relationship where electronic marketing law permits, always subject to an easy opt-out |
| Send back-in-stock alerts requested for a specific product | Email/account and selected SKU | Your explicit request and, where applicable, consent |
| Collect customer feedback and facilitate review invitations | Name, email, order reference and preference status | Legitimate interests in service quality and customer feedback, subject to communication preferences and opt-out rights |
| Measure website use and improve the storefront | Analytics/cookie and device data | Consent for non-essential analytics and similar technologies |
| Conduct proportionate B2B prospecting | Professional contact and company data | Legitimate interests in developing our B2B business, subject to applicable direct-marketing rules and the right to object |
5. B2B account verification and VIES
Account applications are reserved for professional customers. As part of onboarding, we may verify the VAT number through the European Commission’s VIES system and compare the returned company information with the details submitted in the account application.
Where the VAT number is valid and the company-name match reaches the required confidence level, an application may be approved automatically. If the application is not automatically approved, it is referred to human review by default. We do not use this automated check to issue a final automated rejection without human review.
Verification outcomes, timestamps and supporting evidence may be retained to demonstrate the basis on which the business account was reviewed.
6. Orders, payments, documents and accounting
We process order and payment information to fulfil customer orders, manage commercial adjustments and maintain an auditable record of the business relationship. Customers may upload proof of payment in the application. Photos of damaged products are normally handled by email rather than uploaded to the customer platform.
Card payments are processed by external payment service providers within their own secure payment environments. LMD BEAUTY EU does not receive or store complete payment-card numbers.
Invoices, credit notes, proformas and other accounting-relevant documents may be shared, where necessary, with our external accounting, tax and professional advisers for bookkeeping, tax, audit and legal-compliance purposes.
7. Emails, notification preferences and stock alerts
We use an external email-delivery provider to send service and permitted commercial communications. Our platform distinguishes essential service communications from optional notifications.
Essential account-access and security messages, such as account activation/invitation and password-reset emails, cannot be disabled where they are necessary to provide or secure the account.
For other customer communications, the client account contains notification controls. Depending on the current service configuration, these may include:
These settings apply to future optional communications and can be changed from the customer account. Product-specific Back In Stock alerts are managed separately per product and can be cancelled by the customer.
Where Luxembourg electronic-marketing rules allow us to contact an existing customer about our own similar products or services, we provide a clear and easy means to object when the contact details are collected and in each relevant message. Where prior consent is required, we rely on consent and you may withdraw it at any time.
8. Trustpilot and Google reviews
For Trustpilot review collection, we use Trustpilot’s Automatic Feedback Service (AFS). When the applicable review workflow is triggered, Trustpilot may receive the customer’s name, email address and immutable LMD order reference so that it can send the official invitation and manage its review experience.
Customers can disable the relevant optional review/promotional communications from their notification preferences. A customer may also request a Trustpilot invitation directly from an eligible closed order; this is an on-demand action initiated by the customer.
For Google reviews, our application may provide a direct review link. We do not send customer order data to Google through a review API for this purpose. We may also display Google Reviews and Trustpilot widgets on the website. Loading such third-party widgets can cause technical data such as IP address, device/browser information and cookie identifiers to be transmitted to the relevant provider. Non-essential widgets are subject to the website’s consent settings where required.
9. Contact form and WhatsApp Business
Our contact form may collect your name, professional profile, email address, telephone number and message. When you submit the form, the request is stored in our internal CRM so that our commercial team can review it, keep a proportionate history of follow-up and respond to you. The same request may also be delivered to our team through our email-delivery infrastructure.
The CRM record may include the status of the commercial contact, dated follow-up notes and events, and — if a customer account is subsequently created — a link to that existing LMD customer account and related order events. This allows us to keep one operational history of the prospect/customer relationship without creating a second customer account.
If you choose WhatsApp Business as a communication channel, messages are handled within WhatsApp rather than copied automatically into our internal CRM unless a member of our team records a relevant follow-up note or event. WhatsApp is operated by entities within the Meta group and may process metadata and communications in accordance with its own privacy terms.
10. B2B prospecting and data obtained from other sources
We may maintain a B2B prospect database containing professional contact details of companies or business contacts that have not yet created an LMD account. Data may come from publicly accessible professional or business sources, direct contact requests and other legitimate B2B research channels.
Typical information includes name, company, professional email address, professional telephone number, company website or marketplace/store links, commercial notes and the history of business contacts.
Where Article 14 GDPR applies because we did not obtain the data directly from you, we provide the required information within the applicable legal timeframe, including at the latest at the first communication where required. You may object to B2B direct marketing at any time by contacting contact@lmdbeauty.eu.
11. Cookies, Google Analytics, Google Tag Manager and embedded content
Our website uses cookies and similar technologies for different purposes. Technologies that are strictly necessary for authentication, session management, cart functionality, language preferences, security and service availability may operate without consent where permitted by law.
We currently use Google Analytics and Google Tag Manager. We do not currently use the Meta/Facebook Pixel, TikTok Pixel, Microsoft Clarity or Hotjar. Google Analytics and other non-essential analytics are activated in accordance with the user’s cookie choices where consent is required.
Google Tag Manager is a tag-management tool. The tags deployed through it remain subject to the same consent rules as the underlying service. We may also embed Trustpilot and Google Reviews content, which may result in third-party requests when the content is loaded.
You can accept, reject or change non-essential cookie choices through the cookie-consent interface made available on the website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
12. Who receives personal data
We share personal data only where necessary for the purposes described in this Policy. Categories of recipients may include:
| Recipient / category | Role / purpose |
|---|---|
| Hosting and infrastructure providers | Hosting, availability, content delivery, network security, abuse prevention, backups and operation of our website and online services. Our primary hosting and backup arrangements are located within the European Union. |
| Email-delivery providers | Delivery of transactional, account-related, contact-form and permitted commercial communications. |
| Accounting, tax and professional advisers | Bookkeeping, accounting, tax, audit, legal and compliance support, including receipt of documents where necessary. |
| Banking and payment service providers | Banking services, payment processing and card-payment handling where applicable. Complete card numbers are processed by the relevant payment provider rather than stored by LMD BEAUTY EU. |
| Shipping carriers and logistics providers | Delivery and fulfilment. They receive only the delivery/contact information required to perform the shipment. The logistics providers used for these activities are intended to be located within the EU/EEA. |
| Trustpilot | Verified review invitations and review collection through AFS. |
| Google Analytics, Google Tag Manager and embedded Google Reviews functionality, subject to applicable cookie-consent requirements. | |
| WhatsApp / Meta | Customer communications when the customer chooses WhatsApp Business. |
| Professional advisers, insurers, courts and authorities | Where necessary for legal, regulatory, tax, audit, dispute or compliance purposes. |
We do not sell personal data.
13. International data transfers
Our primary hosting and backup arrangements are located within the European Union. Some external service providers or provider groups used in connection with our services may nevertheless process personal data, or make it accessible, from countries outside the European Economic Area.
Where personal data is transferred outside the EEA, we rely on an applicable legal transfer mechanism such as an adequacy decision, the European Commission’s Standard Contractual Clauses and, where relevant, supplementary safeguards or another mechanism permitted by Chapter V GDPR.
You may contact us if you would like more information about the safeguards applicable to a specific provider or transfer.
14. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, taking into account contractual, legal, tax, accounting, security and dispute-resolution requirements.
| Data | Indicative retention |
|---|---|
| Active customer account and operational profile | For the duration of the business relationship. |
| Inactive customer account data not required for accounting/legal purposes | Generally up to 6 months after the customer relationship is closed or the account is deactivated. |
| Rejected account application | Generally up to 6 months after the final decision, unless needed longer for a dispute, fraud-prevention or legal reason. |
| Invoices, credit notes and accounting records | Generally 10 years in accordance with Luxembourg accounting requirements. |
| Payment proof and order documents | For the period necessary to support the relevant order/accounting record and legal obligations. |
| Contact requests that do not lead to a business relationship | Generally up to 24 months after the last meaningful exchange. |
| B2B prospecting records | Reviewed periodically and generally retained for up to 3 years after the last meaningful interaction, unless you object earlier or a longer period is justified. |
| Security and technical logs | For a limited period appropriate to security and troubleshooting, generally up to 12 months, unless required longer to investigate an incident or establish legal claims. |
| Cookie / analytics data | According to the configured retention settings of the relevant analytics service and the applicable consent rules. |
Deletion from the operational customer account does not require us to erase information that must be retained separately to comply with legal obligations or to establish, exercise or defend legal claims.
15. Security
We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, protected authentication credentials, encrypted HTTPS connections, security logging, backups, role-based internal permissions and infrastructure protections provided by our hosting and security providers.
No internet or storage system can be guaranteed to be completely secure. We therefore review our controls and adjust them as the platform evolves.
16. Your data-protection rights
Subject to the conditions and limitations of applicable law, you may have the right to:
To exercise your rights, email contact@lmdbeauty.eu or write to LMD BEAUTY EU S.A.R.L.-S, 10A Rue du Puits, L-2355 Luxembourg. We may request reasonable information necessary to verify your identity before acting on a request.
17. Complaints to the CNPD
If you believe that our processing of your personal data infringes applicable data-protection law, you may lodge a complaint with the Luxembourg supervisory authority:
Commission nationale pour la protection des données (CNPD)15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg
info@cnpd.lu
+352 26 10 60 - 1
We encourage you to contact us first at contact@lmdbeauty.eu so that we can review and address your concern.
18. Changes to this Privacy Policy
We may update this Privacy Policy when our services, providers, processing activities or legal requirements change. The latest version will be published on this page with an updated revision date. Material changes may also be communicated through the customer account or by email where appropriate.