Privacy Policy

STEMOVA is currently in pre-launch and operates a waitlist. This Privacy Policy explains how we handle personal data of visitors based anywhere in the world, with specific commitments for visitors in the European Union (GDPR), the United Kingdom (UK-GDPR), Switzerland (revised Federal Act on Data Protection — "nFADP"), and the Philippines (Data Privacy Act of 2012). Specific legal details marked [TO BE CONFIRMED BY LEGAL] will be finalised by counsel before launch.

1. Who we are (Data Controller)

STEMOVA is an independent skincare house. The legal entity acting as Data Controller, its registered address, and (where required) its EU / UK / Swiss representative will be confirmed on this page once the operating company is registered [TO BE CONFIRMED BY LEGAL]. In the meantime, the responsible team can be reached at support@stemova.shop.

2. Data we collect

• Email address (waitlist signup)
• Name, message content and email address (contact form)
• Standard log data (IP address, browser type) for security and abuse prevention
• Cookie / device data, only with your consent (see Section 7)

3. Lawful basis for processing

• Consent (Art. 6(1)(a) GDPR) — for waitlist signup, marketing emails, and non-essential cookies.
• Legitimate interests (Art. 6(1)(f) GDPR) — for replying to contact-form messages, securing the site, and preventing abuse.
• Legal obligation (Art. 6(1)(c) GDPR) — where required, e.g. responding to a valid data-subject request.

4. How we use your data

• To send waitlist updates and launch announcements you've explicitly opted in to receive (double opt-in).
• To reply to enquiries you send us.
• To protect the site (rate limiting, CAPTCHA, abuse detection).
• To improve the site and our future products.

5. Sharing & international transfers

We do not sell your personal data. We share data only with processors who help us run the service:

• Klaviyo, Inc. (USA) — waitlist and email delivery
• Cloudflare, Inc. (USA) — bot protection and CAPTCHA
• Our infrastructure provider — site hosting and email queue

Where data is transferred outside the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and — for Swiss data subjects — the Swiss FDPIC-recognised equivalents, to maintain an equivalent level of protection. The specific transfer mechanisms in use will be confirmed before launch [TO BE CONFIRMED BY LEGAL].

6. Your rights (EU GDPR / UK-GDPR)

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing (including marketing).
• Right to withdraw consent at any time, without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority (e.g. your national EU Data Protection Authority, or the UK ICO at ico.org.uk).

To exercise any of these rights, email support@stemova.shop. You can unsubscribe from any marketing email using the link in the email footer.

6a. Your rights — Switzerland (revised FADP / nFADP)

If you are based in Switzerland, the revised Federal Act on Data Protection ("nFADP") applies. The lawful basis for marketing emails is your consent; for replies to enquiries and protection of the site, it is our legitimate interest.

• Right of information / access to data we hold about you.
• Right to have inaccurate data corrected.
• Right to have your data deleted.
• Right to data portability for data you have given us with your consent or under a contract.
• Right to object to processing, including direct marketing.
• Right to withdraw consent at any time.
• Right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

Where required by the nFADP, a Swiss representative will be designated and named here [TO BE CONFIRMED BY LEGAL].

6b. Your rights — Philippines (Data Privacy Act of 2012)

Data subjects in the Philippines have the rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages, to data portability, and to lodge a complaint with the National Privacy Commission (NPC). The Data Protection Officer for STEMOVA will be named here once appointed [TO BE CONFIRMED BY LEGAL].

7. Cookies & tracking

We default to declining non-essential cookies. Essential cookies are used to run the site (security, session) and require no consent. Analytics and other non-essential cookies are only set after you actively accept them via the consent banner. You can change your choice at any time by clearing site data in your browser.

8. Data retention

• Waitlist data — kept until you unsubscribe or request deletion.
• Contact-form messages — up to 24 months after our last reply, then deleted.
• Security logs — typically up to 90 days.

9. Contact

Privacy questions or data-subject requests: support@stemova.shop.

Last updated: 2026 · STEMOVA. This Privacy Policy will be revised once the operating company is registered and added as the named Data Controller.