Privacy Policy

Who we are

Skinmax BD is an online cosmetics retailer operating in Bangladesh. We decide what personal information is collected on this site and why, which makes us responsible for it. Privacy questions go to support@skinmaxbd.com.

What we collect, and why

• Your mobile number. It is how you sign in (we text a six-digit code rather than asking for a password), how we confirm an order, and how the courier reaches you. Without it there is no order.
• Your name and delivery address, including division, district and thana. A parcel cannot be delivered without them.
• Your email address, if you give one. Used for order emails. It is optional and an order works without it.
• Your orders: what you bought, what you paid, what happened to the parcel. We keep these as business records; they are also what you see in your own order history.
• Your cart and wishlist. A guest cart is tied to a cookie, not to you. Once you sign in it merges into your account.
• What you search for on this site. Search terms are logged with the number of results they returned. This is how we find out that people are searching for something we do not stock, or that a spelling we do not handle is being typed twenty times a day. It is not linked to your name.
• Technical information: IP address, browser, and the pages you visited, in ordinary server logs, and in analytics unless you have switched that off (below).

We do not collect your date of birth, your national ID, your income, or anything about your health beyond the skin concern you choose to filter by. We never ask for your card number or your bKash PIN. See below.

Payment details we never see

Card, bKash, Nagad and Rocket payments are handled entirely by our payment gateway (SSLCommerz) on their own page. Your card number, CVV and wallet PIN are entered there, are never sent to this site, and are never stored by us. What we receive back is a confirmation, which we then verify directly with the gateway before treating an order as paid. We store the amount, the method and the gateway's transaction reference. Nothing we store could be used to charge you again.

Cookies, all three of them

• Your cart (skx_cart). Set when you add something to a cart while signed out, so the cart survives a page reload. It contains an identifier, not your items. Strictly necessary; the shop cannot work without it.
• Your session (a sb-…-auth-token cookie), set only when you sign in, so you stay signed in. Strictly necessary.
• Your analytics choice (skx_consent). Set only if you use Cookie preferences at the bottom of any page. It records that you turned analytics off — or that you turned it back on — so the setting survives. If you have never touched that panel, you do not have this cookie.

Google's and Meta's cookies are described in the next section, and you can remove them and stop them coming back at any time.

Analytics and advertising, and how to switch them off

We use Google Analytics 4 to understand which pages and products people actually use, and the Meta pixel so that advertising we pay for can be measured. Both are on by default, and you can switch both off from “Cookie preferences” at the bottom of any page.

We are telling you rather than asking you, and it is fair that we say why. The law that makes a website ask permission before it measures anything is European, and this shop sells in Bangladesh, which has no equivalent requirement in force. Large sites already work this way for exactly this reason — Amazon shows a consent wall to a British visitor and a footer link to an American one. We have chosen the footer link, with this page as the notice that goes with it.

What we have not done is make the switch cosmetic. When analytics is off, the Google and Meta scripts are not loaded at all — not loaded and told not to collect. Your browser makes no request to either company and neither gives you a cookie. Turning it off also deletes the Google and Meta cookies already in your browser and reloads the page, so nothing of theirs is left running in it.

The refusal is honoured on our servers too. We can report a purchase to Meta from our own server, where no ad blocker could stop it; if you have switched analytics off, we do not send it. A shop that respects a refusal in the browser and quietly posts the same event from its server has not offered a choice, it has staged one.

While analytics is on, the events we send describe what happened: products viewed, items added to a cart, an order placed with its total. For orders, our server also sends Meta your mobile number, email and name hashed (SHA-256, irreversible), so that Meta can match the sale to an advert it showed without ever receiving the details themselves. Your IP address and browser type go with it, unhashed, because that is what the interface requires.

The choice is stored per browser, because a cookie is all we have to store it in. Switching it off on your phone does not switch it off on a laptop, and clearing your cookies clears the setting along with everything else.

Who else receives your information

• Our courier partners get your name, phone number, address and the amount to collect. There is no way to deliver a parcel without this.
• Our payment gateway gets your name, phone, email and the amount, plus the payment details you type on their page, which we never see.
• Our SMS and email providers get your number or email and the message we are sending you.
• Google and Meta get the analytics described above, and only with your consent.
• Our hosting and database providers store the site and its data on our behalf.

We do not sell your personal information, we do not rent our customer list, and we do not pass your number to other sellers. If we are ever required to hand something over by a court or a lawful order of a Bangladeshi authority, we will comply, and tell you unless we are forbidden to.

How long we keep it

• Orders and invoices: at least six years. These are accounting records and we are not free to delete them on request.
• Account details: until the account is closed, which is yours to do, from your profile page, at any time.
• Guest carts: cleared automatically after a period of inactivity.
• Search logs: kept in aggregate; they are not attached to your name in the first place.

Your choices

• See what we hold: most of it is on your own account pages: orders, addresses, profile. Ask us for the rest.
• Correct it: name, email and address are editable yourself; changing your mobile number needs a code sent to the new number, because that number is your login.
• Delete it: yourself, from your profile page. It removes your login, profile, addresses, wishlist and basket straight away. You cannot delete while an order is still on its way; wait until it has been delivered or cancelled. Completed orders stay, as above, and the screen says so before you confirm.
• Stop the analytics: the banner, any time.
• Stop the messages: marketing SMS can be stopped on request. Messages about an order you placed are not marketing and will continue until the order is finished.

Children

This shop is not intended for children under 13, and we do not knowingly collect their information. A parent who believes we have should contact us and we will delete it.

The legal position in Bangladesh

Bangladesh does not yet have a single comprehensive data protection act; a draft has been under consideration for several years. In its absence we apply the principles that law is expected to codify and that we think are right anyway: collect only what is needed, say what it is for, keep it no longer than necessary, do not sell it, and let you see and delete it. Where a Bangladeshi law does apply, such as the Consumer Rights Protection Act, 2009, and the record-keeping duties of the tax authority, we follow it.

Changes

If we change what we collect or who receives it, this page changes and the date at the top changes with it. A material change to tracking will also reset the cookie banner, so you are asked again rather than assumed to agree. See also our terms of service.