Privacy Policy – Consumer Product Testing Program

Effective Date: 12/11/26
Company Name: BYOMA Limited
Contact: dpo@byoma.com
Applies to: UK participants aged 18 or over

BYOMA Limited (“BYOMA”, “we”, “our” or “us”) takes the privacy of participants in our product testing and before-and-after campaigns seriously. This notice explains how we collect, use, store and share personal data when an individual participates in a BYOMA product testing programme and provides photographs, videos, feedback or other content showing the experience of using a BYOMA product.

This notice applies to participants located in the United Kingdom.

1. Who we are

BYOMA Limited is the controller of personal data processed for the purposes described in this notice. We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Questions about this notice or our use of personal data can be sent to our Data Protection Officer at dpo@byoma.com.

2. Who can participate

Our product testing and before-and-after campaigns are intended for individuals aged 18 or over. We do not knowingly accept participants under 18.

3. Personal data we collect

·         Identity and contact information, including name and email address.

·         Delivery information, including postal address where products are sent.

·         Participation information concerning involvement in the programme.

·         Photographs and videos, including before-and-after and progress imagery.

·         Product feedback, comments and information about the experience of using the product.

·         Marketing content, including photographs, videos, quotes or testimonials supplied under the programme.

·         Administrative and contractual records, including communications, the participant agreement and records of Content use.

For the programme, participants are required to provide front, left and right photographs before use, after two weeks and after four weeks.

Health and special category information

We do not routinely ask participants in this programme to provide medical diagnoses, medication information, allergy information or medical records. Photographs may nevertheless show aspects of a participant’s skin.

If a future programme asks for diagnosed skin conditions, allergies, medication or other health information, we will assess that processing separately and, where required, provide additional privacy information and identify an appropriate Article 9 UK GDPR condition before processing begins.

4. Why we use personal data and our lawful bases

BYOMA must have a lawful basis for each purpose for which it processes personal data. We rely principally on performance of a contract and BYOMA’s legitimate interests, depending on the activity.

Our legitimate interests

Where we rely on legitimate interests, those interests include evaluating product performance, conducting product research and development, substantiating appropriate product claims, maintaining programme records, protecting BYOMA’s legal and commercial interests, and using agreed participant Content to market and promote BYOMA products.

Before relying on legitimate interests, we consider whether the processing is necessary and proportionate, the participant’s reasonable expectations, the nature of the information and the impact on the participant’s rights and interests. Participants may object to processing based on legitimate interests as described in section 11.

5. Use of photographs, videos and other Content

Providing the Content specified in the participant agreement and programme brief is a condition of participating in the programme. We may initially use Content to administer participation, assess the participant’s experience, evaluate visible product performance, conduct product research and support appropriate product substantiation.

Where provided for under the participant agreement, agreed Content may also be used for BYOMA marketing and promotional purposes, including:

·         BYOMA websites and ecommerce channels.

·         Organic and paid social media.

·         Digital advertising and email marketing.

·         Retailer websites and digital channels.

·         Public relations, media and advertising.

·         Other related BYOMA marketing and promotional channels consistent with the participant agreement.

The marketing use agreed under the participant agreement forms part of the nature of the programme. We do not describe this as optional marketing consent where participation is conditional upon granting the relevant Content rights. Nothing in the participant agreement limits statutory rights under UK data protection law.

6. Who we share personal data with

We do not sell personal data. Where reasonably necessary for the purposes described above, personal data or Content may be accessed by or shared with:

·         Authorised BYOMA employees and group companies.

·         Creative, marketing, advertising, media and PR agencies.

·         Technology, hosting and communications providers.

·         Retailers and retail partners.

·         Advertising, social media and other publishing platforms.

·         Professional advisers, regulators, courts and authorities where disclosure is required or permitted by law.

Where an organisation processes information on BYOMA’s behalf, we seek to put appropriate contractual, security and data-protection arrangements in place. An independent retailer or platform may also have its own privacy responsibilities and privacy information.

7. Storage and security

Programme information and source imagery may be stored within BYOMA’s Microsoft 365 environment, including SharePoint. Access is restricted to authorised people who require it for the purposes described in this notice. We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. Content selected for marketing may subsequently exist within relevant BYOMA, agency, retailer, advertising, social media or publishing systems.

8. Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of contractual, legal, regulatory, substantiation and record-keeping requirements.

Where personal data is no longer reasonably required, we will delete, anonymise or securely dispose of it in accordance with our retention practices.

9. AI, facial recognition and automated analysis

We do not currently use photographs or videos collected through this programme for facial recognition, biometric identification, automated skin analysis or training general-purpose artificial intelligence models. Any materially different AI, biometric or automated processing will be separately assessed, with additional privacy information, safeguards or choices provided where required.

10. International transfers

BYOMA operates internationally and some service providers, platforms, agencies, retailers or other recipients may process personal data outside the United Kingdom. Where required, we use an appropriate lawful transfer mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another lawful mechanism. We will assess relevant safeguards where required.

11. Data protection rights

Subject to applicable legal conditions and exemptions, participants may have the right to:

·         Request access to personal data held by BYOMA.

·         Ask us to correct inaccurate or incomplete information.

·         Request deletion of personal data.

·         Ask us to restrict certain processing.

·         Object to processing based on BYOMA’s legitimate interests.

·         Receive certain personal data in a portable format.

·         Withdraw consent where a particular activity is based on consent.

Right to object

A participant may object to processing based on legitimate interests. We will consider the circumstances and whether there are compelling legitimate grounds to continue or whether processing is required for legal claims. The effect on Content already published or distributed will depend on the circumstances, lawful basis and applicable law. Where required, we will take appropriate steps in relation to Content within our control.

To exercise a right, contact dpo@byoma.com. We may request information reasonably required to verify identity and locate records. Participants may also complain to the Information Commissioner’s Office.

12. Changes to this notice

We may update this notice where our product-testing activities, use of personal data or legal requirements change. Where a change materially affects existing participants, we will take appropriate steps to notify them where required.

13. Contact us

Data Protection Officer
BYOMA Limited
dpo@byoma.com