This statutory document explains how we collect and protect technical inquiry data across our digital catalogue channels.

Effective Date. This privacy statute and technical tracking disclosure took effect on October 18, 2026. All consumer consultations, batch quotations, and web session records originating on or after this date are governed under these published terms.

Data Controller Identification. The data controller responsible for personal information processed through this catalogue is Zenithskin, trading at zenithskin.click. Our commercial dispensary headquarters is located at 224 Southwest 1st Avenue, Portland, Oregon 97204, Portland, Oregon, United States.

Categories of Data Collected. Our inquiry processing interface collects the specific values entered by visitors: full name, contact telephone number, email address, physical delivery address, selected catalogue inquiry category, submitted notes, and affirmative consent verification. Concurrently, our web server infrastructure automatically records the visitor IP address, user-agent browser string, referring URL, time of page rendering, and exact time of form transmission. Our live consultation chat records conversation text and stores an access token in local storage. Preference choices are recorded in browser storage under the key site_consent_v2. This site does not maintain customer registration accounts, stores no passwords, processes no direct credit cards, and takes no electronic checkout payments.

Specified Processing Purposes. Personal information is collected strictly to prepare customized formulation estimates, answer active ingredient compatibility questions, confirm batch lot availability, coordinate freight logistics, maintain web infrastructure defense against automated abuse, and execute advertising attribution in accordance with visitor consent choices.

Explicit Legal Bases. We process data under three distinct legal grounds: consent, where the visitor checks our affirmative intake box or accepts cookie storage; pre-contractual and contractual necessity, where data is required to calculate and deliver non-binding batch quotes requested by the client; and legitimate interest, to secure our server systems against automated attack vectors and prevent commercial fraud.

Advertising Network Disclosures. This website receives live commercial traffic from Google Ads, Microsoft Advertising, and Meta Ads. When a visitor reaches our domain through a paid campaign, the corresponding advertising network appends an encrypted campaign parameter: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. These identifiers enable our marketing team to evaluate campaign efficacy and prevent automated click manipulation.

Consent Mode v2 Operations. Our technical tracking architecture integrates Consent Mode v2. Under this protocol, the operational signals ad_storage, ad_user_data, ad_personalization, and analytics_storage are held strictly denied by default. These parameters remain denied until the visitor explicitly clicks Allow Storage on our consent banner. If the visitor selects Decline or revokes consent via Cookie Settings, all four parameters immediately return to denied status.

Authorized Data Processors. We share telemetry only with designated service providers under written confidentiality agreements. Advertising data is processed by Google LLC / Google Ireland Ltd and Meta Platforms Ireland Ltd. Search advertising telemetry is processed by Microsoft Ireland Operations Ltd in accordance with the Microsoft privacy statement published at privacy.microsoft.com. Infrastructure hosting and inquiry database storage are managed by our secure cloud hosting provider, with transactional transmission handled by our authenticated enterprise mail gateway.

Cross-Border Data Transfers. Data collected from visitors located outside the United States is transferred to and processed on secure server nodes within the United States. International transfers comply with standard contractual clauses approved by international data protection authorities, guaranteeing that your information receives equivalent protection regardless of geographic processing location.

Defined Retention Periods. We maintain strict data retention schedules: completed customer inquiries and their corresponding email records are retained for 24 months; consultation chat transcripts are retained for 12 months; raw web server logs and IP access journals are purged after 60 days; and browser consent choice records are preserved for 12 months. Any formal data access or deletion request is processed and answered within 5 days.

Technical Data Security. All communication between your client device and our dispensary server is encrypted using TLS 1.3 protocol ciphers. Database storage volumes are encrypted at rest with AES-256 standards, access credentials require multi-factor authentication, and form endpoints incorporate cryptographic timestamp verification alongside hidden honeypot filters to neutralize automated vulnerability scrapers.

European Visitor Rights Under GDPR. Visitors accessing our catalogue from the European Economic Area or United Kingdom hold comprehensive rights under the gdpr framework. These include the right of access to personal records, rectification of inaccurate entries, complete erasure of collected data, restriction of active processing, data portability in structured format, objection to processing based on legitimate interests, and the absolute right to withdraw consent at any time.

United States Consumer Rights. In compliance with California consumer privacy legislation (the ccpa as amended by the CPRA) and related state privacy statutes across Oregon, Virginia, Colorado, and Connecticut, visitors have the right to know what personal categories are collected, request deletion of personal records, correct inaccurate data, and opt out of the sale or sharing of personal data for cross-context behavioral advertising. We do not sell personal data for monetary consideration.

Global Privacy Control Recognition. Our server and script architecture natively recognizes and honors the global privacy control (Sec-GPC) signal broadcast by compatible web browsers. When a GPC opt-out signal is detected in your HTTP headers, our consent engine automatically sets ad_storage, ad_user_data, and ad_personalization to denied status without requiring manual interaction with our banner.

Child Protection and Age Minimums. This website and our commercial dermocosmetic dispensary services are intended strictly for adults 18 years of age or older. We do not knowingly solicit, collect, or store personal data from children under the age of 18. If we identify that information belonging to an individual under 18 has been submitted, it is immediately purged from our database records.

Regulatory Complaint Avenues. If you believe our data handling practices violate applicable privacy statutes, you have the statutory right to lodge a formal complaint with your relevant supervisory authority. In California, complaints may be directed to the California Privacy Protection Agency (CPPA); in other US states, to your state Attorney General Consumer Protection Division; and in Europe, to your national Data Protection Authority.

Data Subject Request Submission. To exercise your statutory rights of access, correction, or complete deletion, you may transmit an electronic request to our dedicated inbox at office@zenithskin.click, submit our dedicated form at data-request.html, or dispatch written notice to 224 Southwest 1st Avenue, Portland, Oregon 97204. All verifiable requests receive confirmation and substantive resolution within 5 days.

Policy Modification Announcements. We review and update this privacy statute periodically to maintain alignment with advertising platform policies and legislative amendments. When modifications are published, the revised effective date at the head of this document is updated accordingly. Continued submission of inquiries after such publication constitutes acceptance of the amended terms.

Direct Privacy Officer Contact. For direct communications regarding your data rights or tracking disclosures, contact our privacy compliance desk via email at office@zenithskin.click, by telephone at +1 (464) 595-0261, or by physical mail addressed to Privacy Officer, Zenith Skin, 224 Southwest 1st Avenue, Portland, Oregon 97204, United States.