LEGAL

Privacy Policy

How we collect, use and protect your personal data, and how you stay in control of it.

KARMICA BV, trading as KARMICARE · Vizierstraat 28, 8000 Bruges, Belgium · VAT BE 0676.972.896 · RPR Ghent, division Bruges

care@karmicare.com · Last updated October 2026

1. Introduction and scope

This policy explains what we collect about you, why we need it, who helps us process it, and how you stay in control.

KARMICA BV (“KARMICARE”, “we”, “us” or “our”) respects your fundamental right to privacy and is committed to protecting your personal data in full compliance with:

  • The General Data Protection Regulation (EU) 2016/679 (“GDPR”);
  • The Belgian Data Protection Act of 30 July 2018;
  • The Belgian Electronic Communications Act of 13 June 2005, transposing the ePrivacy Directive 2002/58/EC as amended;

This policy explains how we collect, process, store, disclose and safeguard your personal data when you visit our website, order from us, start a plan or contact our customer care.

2. Data controller

KARMICA BV in Bruges is responsible for your personal data. Every privacy question goes to one address: care@karmicare.com.

The data controller responsible for the processing of your personal data is:

KARMICA BV, Vizierstraat 28, 8000 Bruges, Belgium · Company and VAT number BE 0676.972.896 · Register of Legal Persons: Enterprise Court of Ghent, division Bruges · care@karmicare.com · +32 (0) 478 57 27 61

For all questions, privacy requests or to exercise your rights under the GDPR, write to our Data Privacy Lead at care@karmicare.com, or call +32 (0) 478 57 27 61.

3. Personal data we process

We collect what we need to deliver your order, run your membership and answer your questions. Oral-health data only for the Dental Check-up Reward, and only with your explicit consent.

Depending on how you interact with KARMICARE, we process the following categories of personal data:

  • Identification and contact data: first name, last name, billing and delivery address, email address, telephone number, and company name or VAT number (for B2B dental partners).
  • Transaction and order data: what you ordered, your membership (Awake and Asleep frequency, interval, delivery cycle), order history, payment reference IDs, carrier, order notes and return or refund records. Full card numbers are processed by our PCI-DSS Level 1 payment providers, Stripe and PayPal, and are never stored on our servers.
  • Account and membership data: customer portal login, delivery schedule preferences, pauses and skipped deliveries, and membership status (active, paused, cancelled), and the name and address of anyone you send a delivery to as a gift.
  • Care Credit data: your Care Credit balance, the credit you earn and spend, and your reward status.
  • Check-up data (Year members, only with your explicit consent): your answers to the starting and follow-up questionnaires about your oral health, and proof of your dental visit (an appointment confirmation or invoice).
  • Communication data: records of your messages by email or contact form, including product questions, after-sales questions and feedback.
  • Marketing and newsletter data: email address, first name, communication preferences, newsletter status, open and click events, and discount or voucher use.
  • Technical, navigation and cookie data: IP address (anonymised where applicable), browser and version, device identifier, operating system, referral source, pages viewed, time per page, language, Day/Night preference and cart token.

Your questionnaire answers about your oral health are health data, a special category of personal data (Article 9 GDPR). We process them only with your explicit consent, only for the Dental Check-up Reward and the follow-up of your oral health, and you can withdraw that consent at any time. We do not process other special categories of personal data, such as racial or ethnic origin, genetic or biometric data. Our formulas are notified EU cosmetics, not medicinal treatments.

4. Purposes and legal bases

Every use of your data rests on a legal basis: your contract, a legal duty, a legitimate interest or your consent.

Under Articles 6 and 9 GDPR, we only process your personal data when a valid legal basis exists:

Order processing and fulfilment Processing orders, delivering, sending order updates and managing returns.
Data: identification, contact, transaction, order
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)

Membership management Managing your deliveries, renewals, pauses and reminders, and providing the customer portal.
Data: account, membership, transaction, contact
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)

Care Credit Granting, showing and redeeming Care Credit, and reversing it after refunds.
Data: account, transaction, Care Credit
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)

Payment processing and fraud prevention Authenticating transactions, managing chargebacks and preventing payment fraud.
Data: transaction, identification, technical
Legal basis: performance of a contract (Art. 6(1)(b)) and legitimate interest in fraud prevention (Art. 6(1)(f))

Customer care Handling questions, complaints, refund requests and legal guarantee claims.
Data: contact, communication, order
Legal basis: performance of a contract (Art. 6(1)(b)) and legitimate interest in efficient customer care (Art. 6(1)(f))

Dental Check-up Reward and oral-health follow-up Checking eligibility for the €40 Dental Check-up Reward and following up your oral health over time.
Data: questionnaire answers (health data), visit proof, account
Legal basis: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you can withdraw at any time

Legal and tax obligations Bookkeeping, invoicing, VAT compliance, product liability and regulatory reporting.
Data: identification, transaction, invoicing
Legal basis: legal obligation (Art. 6(1)(c) GDPR; Belgian Code of Economic Law and Income Tax Code)

Direct marketing to existing customers Relevant updates and recommendations about similar KARMICARE products.
Data: contact, order history
Legal basis: legitimate interest (Art. 6(1)(f) GDPR and Art. XII.13 WER, “soft opt-in”), with an opt-out in every email

Newsletter and promotional campaigns Newsletters and promotional offers to prospects.
Data: contact, first name, marketing data
Legal basis: explicit prior consent (Art. 6(1)(a) GDPR)

Website performance and analytics Aggregated traffic analysis, conversion tracking, site optimisation and debugging.
Data: technical, navigation, analytics cookies
Legal basis: explicit prior consent (Art. 6(1)(a) GDPR and ePrivacy Directive)

Targeted advertising and retargeting Measuring ad performance, audience segmentation and relevant social ads.
Data: marketing cookies, pixel data
Legal basis: explicit prior consent (Art. 6(1)(a) GDPR and ePrivacy Directive)

5. Service providers and recipients

We never sell your data. A small set of service providers helps us run the shop, each under a written data processing agreement.

We never sell, rent or lease your personal data to data brokers or unrelated third parties. We share data strictly on a need-to-know basis with vetted service providers (processors) who act on our written instructions under data processing agreements (DPAs):

  • E-commerce and hosting: Shopify Inc. (Canada / US), e-commerce engine, checkout and order management · Webflow, Inc. (US), website hosting, CMS and CDN · Loop Subscriptions (US / India), membership engine, Care Credit and customer portal.
  • Payments: Stripe Payments Europe, Ltd. (Ireland / US), card, Apple Pay, Google Pay, Bancontact and iDEAL payments · PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), alternative payments.
  • Email and marketing automation: Klaviyo, Inc. (US), transactional and promotional email, cart reminders (only if you opted in) and list management.
  • Logistics: fulfilment warehouses and carriers (for example Bpost, DHL Express, PostNL and national postal services), only for shipping and tracking.
  • Analytics and optimisation: Google Ireland Limited (Google Analytics 4), web metrics · Meta Platforms Ireland Ltd. (Meta Pixel), conversion tracking and ad optimisation, with your consent · Hotjar Ltd. (Malta), heatmaps and session analysis, with your consent and keystroke masking · TriplePixel / Triple Whale (US), e-commerce attribution and analytics.
  • Authorities: tax authorities (FPS Finance), customs (EORI BE0676972896), courts or law enforcement, only where the law strictly requires it.
6. International data transfers

When your data leaves the European Economic Area, it travels under an EU-approved safeguard.

When personal data is transferred outside the European Economic Area (EEA), in particular to the United States, KARMICARE ensures an adequate level of protection in line with Articles 44–49 GDPR:

  1. Adequacy decisions: transfers to countries the European Commission recognises as adequate, such as Canada for commercial organisations under PIPEDA.
  2. EU-U.S. Data Privacy Framework (DPF): where US providers (such as Shopify, Google, Meta, Klaviyo, Stripe and Webflow) are certified under the DPF.
  3. Standard Contractual Clauses (SCCs): where providers are not DPF-certified, transfers follow the Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), with transfer impact assessments and encryption safeguards.

You can ask for a copy of the relevant safeguards at care@karmicare.com.

7. How long we keep your data

We keep your data only as long as the purpose or the law requires, then delete or anonymise it.

We store personal data only as long as necessary for the purpose it was collected for, or to meet legal retention duties:

  • Order, invoicing and accounting records: kept for 7 years after the end of the financial year (Art. III.86 WER and Art. 315 CIR92).
  • Membership and Care Credit records: kept while your membership is active, then 7 years after it ends, for tax and limitation purposes.
  • Check-up questionnaires and visit proof: proof of your dental visit is deleted 60 days after we have checked it; we keep only the date it was verified. Your questionnaire answers are kept while your membership continues and for 24 months after it ends, so your oral-health history is still there if you return. If you withdraw your consent, we delete them straight away.
  • Customer care messages: kept for 2 years after resolution, to handle legal guarantee claims and disputes.
  • Newsletter and marketing data: kept until you withdraw consent or unsubscribe. After 24 months of inactivity, your data is removed or archived.
  • Analytics and cookie data: kept for at most 13 months, then deleted or permanently anonymised.
8. Your rights under the GDPR

You can see, correct, delete, move or limit your data, and object to marketing at any time. We answer within one month.

As a data subject, you have the following rights:

  1. Access (Art. 15): ask whether we process your data and receive a free copy of it.
  2. Rectification (Art. 16): have inaccurate data corrected or incomplete data completed.
  3. Erasure (Art. 17): have your data deleted when it is no longer needed, when you withdraw consent or when processing is unlawful, subject to legal retention duties (for example the Belgian 7-year accounting rules).
  4. Restriction (Art. 18): have processing frozen while the accuracy or lawfulness of the data is contested.
  5. Portability (Art. 20): receive your data in a structured, machine-readable format (JSON, CSV) and have it transferred to another provider.
  6. Objection (Art. 21): object at any time, without giving a reason, to direct marketing, and object to processing based on legitimate interests on grounds relating to your situation.
  7. Withdrawing consent (Art. 7(3)): withdraw consent for newsletters, marketing cookies or the check-up questionnaires at any time, without affecting earlier processing.
  8. No automated decisions (Art. 22): KARMICARE does not use automated decision-making or profiling that produces legal effects for you.

How to exercise your rights

Email care@karmicare.com or write to KARMICA BV — Privacy Operations, Vizierstraat 28, 8000 Bruges, Belgium.

We respond without undue delay and at the latest within one month of receipt. Where necessary, given the complexity and number of requests, this can be extended by two further months; we then tell you within the first month.

Your right to complain

If you believe our processing breaks data protection law, you can lodge a complaint with the Belgian Data Protection Authority or with the supervisory authority in your country:

Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, Belgium · Tel. +32 2 274 48 00 · contact@apd-gba.be · gegevensbeschermingsautoriteit.be

9. Cookies and tracking

Essential cookies keep the shop working. Everything else waits for your consent, and you can change your mind at any time.

Our website uses cookies and similar technologies (local storage, session tokens, pixel tags) to make the site work, remember your preferences and, with your consent, measure traffic and show relevant advertising.

9.1 Cookie categories

  • Strictly necessary: core operation of the shop, security, sessions, cart and checkout. These need no consent and cannot be switched off (Art. 5(3) ePrivacy Directive exemption).
  • Functional: remember your language (en, nl, fr), country and Day/Night preference.
  • Performance and analytics: measure traffic, referrers and site performance (for example Google Analytics 4, Hotjar). Active only after your explicit consent.
  • Marketing and advertising: set by advertising partners (for example Meta Pixel, TriplePixel, Klaviyo) to track visits across websites and build interest profiles for targeted ads. Active only after your explicit consent.

9.2 Your consent choices

On your first visit, our consent banner lets you accept all cookies, decline all non-essential cookies, or choose by category.

No non-essential cookies or tracking scripts run before you opt in. You can change or withdraw your choice at any time through the “Cookie settings” link in our footer.

10. Data security

Your data travels encrypted, and only the people who need it can reach it.

KARMICA BV uses technical and organisational measures to protect personal data against accidental loss, unauthorised access, destruction, misuse or alteration:

  • TLS encryption for all web traffic and data transfers;
  • role-based access controls and multi-factor authentication (MFA) for administrative systems;
  • anonymisation and pseudonymisation of analytics data;
  • regular system audits, automatic security patching and vulnerability management;
  • data processing agreements with every sub-processor, requiring confidentiality and GDPR compliance.
11. Changes to this policy

When this policy changes, the date at the top changes too, and we tell you first about anything important.

We may update this policy to reflect changes in how we work, new formulas or new law. The “Last updated” date at the top shows when the latest changes took effect. We announce material changes on our website, or by email to account holders, before they apply.

Questions about your data? Write to care@karmicare.com. A person reads every message.