Privacy Policy & Data Compliance Protocol

1. Effective Date & Governance Timeline

This privacy policy took effect on October 18, 2026. It establishes the technical and legal parameters governing data processing across all digital touchpoints operated by Dermabloom at dermabloom.click. All inquiries submitted for catalog advisory, topical active skincare dossiers, barrier repair creams, and oral cosmetic supplements operate under these provisions as of this date.

Archival revisions are maintained on file at our Tampa administrative office. Updates are executed whenever technical tracking scripts, platform attribution guidelines, or statutory privacy rules mandate revision.

2. Data Controller Identity & Physical Operating Footprint

The data controller responsible for the capture, retention, and routing of personal information collected through this website is:

Dermabloom
Trading at: dermabloom.click
Physical Address: 803 North Tampa Street, Tampa, Florida 33602, Tampa, Florida, United States
Operational Telephone: +1 (464) 575-5661
Central Electronic Mail: office@dermabloom.click

Dermabloom operates as a documented business entity registered in the State of Florida with recognized membership in national cosmetic formulation and skincare trade associations. Daily catalog selections, ingredient assessments, and active concentration dossiers are managed under the direction of Irina Petrova, Product Manager, active since 2021.

3. Categories of Personal & Technical Data Collected

Dermabloom operates an inquiry-only formulation catalog and consultation desk. We do not maintain user registration databases, member portals, or consumer shopping carts. We capture solely the data necessary to reply to formulation inquiries and evaluate incoming marketing traffic:

• Inquiry Form Submissions (via banub95.php): Name, telephone number, electronic mail address, physical shipping address or delivery zone, requested consultation kind, narrative notes describing skin tolerance or barrier history, requested formulation specification (product selection, vehicle type, seasonal tier), and affirmative consent verification.
• Support Chat Records (via toso27d.php): Real-time messaging transcripts exchanged with our product desk and an ephemeral session token generated and held in your browser local storage to maintain continuity during your session.
• Automated Server and Network Logs: Internet Protocol (IP) address, browser user-agent string, operating system version, screen resolution, referring Uniform Resource Locator (URL), timestamp of page render (captured via hidden form input tm), and the exact timestamp of transmission.
• Campaign Click Identifiers: Specific inbound query strings appended to links by commercial advertising platforms, specifically gclid, msclkid, and fbclid.
• Cookie and Local Storage Records: The local storage key site_consent_v2 recording your timestamped choice to permit or decline optional advertising and analytical tracking.

We deliberately refrain from collecting payment card numbers, bank credentials, biometric identifiers, or social security numbers. No financial transactions are executed on dermabloom.click.

4. Explicit Purposes of Processing

Every data point captured through dermabloom.click serves an operational purpose directly linked to our clinical skincare advisory:

• To evaluate individual barrier condition profiles and prepare non-binding formulation advisory quotes ranging from $65 to $299 USD based on selected topical actives, vehicle delivery forms, and seasonal Tampa climate requirements.
• To contact visitors via phone or email regarding their submitted catalog dossiers, active ingredient contraindications, and packaging specifications (airless pump cylinders, amber dropper vials, or oral softgel blister cards).
• To operate the real-time support chat desk managed by Irina Petrova and our catalog team during business hours (Monday through Friday, 08:30 to 17:30 EST).
• To measure campaign performance across Google Ads, Microsoft Advertising, and Meta Ads, matching inbound inquiries to commercial keyword sources without creating invasive tracking profiles.
• To defend server infrastructure against automated spam, bot injection, and distributed denial-of-service threats via server log analysis and honeypot field verification (office and homepage fields).

5. Lawful Bases for Processing

In compliance with international and domestic data protection standards, including European and United States frameworks, Dermabloom processes personal information under the following specific legal bases:

6. Advertising Platforms & Click Identifiers (Present Tense Reality)

This website receives live commercial traffic funded through paid search and social campaigns. We operate active advertising accounts across multiple networks, specifically google ads, microsoft advertising, and meta ads. As visitors click through our advertisements, inbound URLs carry platform-specific click identifiers that our server and measurement tags capture:

• Google Ads: Traffic arriving via google ads campaigns carries the unique gclid (Google Click Identifier) query parameter. This token is used to evaluate keyword match precision, campaign ad group efficiency, and conversion milestones when an inquiry form is submitted.
• Microsoft Advertising: Traffic originating from Bing search campaigns and the Microsoft network carries the msclkid (Microsoft Click Identifier) query parameter, routed into Microsoft Universal Event Tracking (UET) mechanics.
• Meta Ads: Commercial traffic deployed across Meta platforms carries the fbclid (Facebook Click Identifier) parameter, measuring inbound response to clinical formulation showcases and seasonal barrier advisory campaigns.

We do not claim that Google Ads, Microsoft Advertising, or Meta Ads have reviewed, endorsed, or certified this catalog. These services provide paid distribution and measurement infrastructure only.

7. Google Consent Mode v2 Architecture & Signal State

Dermabloom enforces strict compliance with consent mode v2 (Google Consent Mode v2). Our measurement scripts are engineered with default-denied logic that operates automatically upon page initialisation before any tracking libraries execute.

Until you take affirmative action on our consent banner by choosing "Allow Storage", all four primary consent signals remain locked in a denied state:

• ad_storage: 'denied' — Disallows reading or writing of cookies for advertising purposes.
• ad_user_data: 'denied' — Prohibits transmission of personal identifiers to advertising networks for conversion attribution.
• ad_personalization: 'denied' — Blocks targeting based on user behavior across third-party websites.
• analytics_storage: 'denied' — Disallows storage of analytical performance cookies.

When a visitor selects "Allow Storage", these four signals transition to granted. If a visitor selects "Decline Optional" or subsequently modifies their consent, every signal is instantly updated back to denied, and any optional tracking cookies are ceased. The consent choice is recorded in local storage under the key site_consent_v2.

8. Third-Party Data Processors & Infrastructure Providers

Dermabloom does not sell, lease, or rent customer lists. We disclose data solely to contracted technical processors bound by strict confidentiality and data protection agreements:

• Google LLC / Google Ireland Ltd: Provides Google Ads conversion tracking and site telemetry. Information regarding Google data practices is accessible through Google privacy channels.
• Microsoft Ireland Operations Ltd / Microsoft Corporation: Operates Microsoft Advertising and UET analytics. Microsoft data handling procedures and privacy commitments are detailed in the official Microsoft Privacy Statement (privacy.microsoft.com).
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Manages Meta Ads conversion tracking and pixel infrastructure for inbound paid social acquisition.
• Web Infrastructure & Hosting Provider: High-security server facilities hosting our static assets, PHP application execution environment, and local flat-file inquiry databases.
• Mail Routing Gateway: Transport-layer mail services delivering operational inquiry notifications from banub95.php directly to office@dermabloom.click.

9. International Data Transfers & Cross-Border Safe Harbors

Dermabloom’s core servers and administrative operations are situated in Tampa, Florida, United States. When visitors access our catalog from the European Economic Area, the United Kingdom, or Switzerland, their technical data and submitted inquiries are transmitted directly to our secure United States infrastructure.

To maintain lawful transfer mechanisms under the General Data Protection Regulation (GDPR), our cloud and enterprise service providers rely on the EU-U.S. Data Privacy Framework (DPF), UK Extension, and standard contractual clauses approved by the European Commission, ensuring adequate technical and organizational safeguards equivalent to European standards.

10. Data Retention Periods & Scheduled Purge Timelines

We reject indefinite data warehousing. We adhere to verified, published retention schedules based on administrative necessity and statutory record-keeping rules:

• Formulation Inquiries & Email Correspondence: Retained for exactly 24 months from the date of receipt to track customer barrier tolerances, historical advisory recommendations, and consultation quotes. At the conclusion of 24 months, files are permanently purged.
• Live Support Chat Transcripts: Maintained for exactly 18 months to provide continuity for recurring routine adjustments, after which database rows are securely deleted.
• Web Server Access & Security Logs: Stored on our infrastructure for exactly 60 days for brute-force mitigation and forensic threat detection, rotating automatically via logrotate.
• Consent Verification Records: Your affirmative or declined consent selection under site_consent_v2 is maintained in your browser for 12 months, after which the banner will re-prompt for choice confirmation.
• Formal Data Subject Requests: Processed, resolved, and documented with an initial formal reply delivered within 5 days of verified receipt.

11. Technical Safeguards & Operational Security Architecture

Dermabloom implements defense-in-depth protocols to protect personal data against unauthorized interception, destruction, alteration, or disclosure:

• Strict Transport Security: All digital communications across dermabloom.click are encrypted end-to-end utilizing modern Transport Layer Security (TLS 1.3) protocols. Non-HTTPS requests are forcibly redirected.
• Honeypot Injection Filtering: Automated bot scrapers and malicious submission scripts are identified and quarantined via two hidden honeypot fields (office and homepage) that normal visitors never encounter.
• Principle of Least Privilege: Access to consultation records, customer skin history dossiers, and dispatch logs is strictly limited to authorized personnel (Product Manager Irina Petrova and verified consultation staff).
• Static Architecture Advantage: Public catalog pages are compiled as lightweight static assets without dynamic database bloat, minimizing vector vulnerability and eliminating SQL injection risks across front-end catalog views.

12. European Data Subject Rights (GDPR Provisions)

For visitors accessing our catalog from the European Union, European Economic Area, or United Kingdom, the gdpr guarantees comprehensive statutory rights regarding your personal information:

• Right of Access (Art. 15): You have the right to request a complete copy of all personal records, consultation inquiries, and chat transcripts linked to your identity.
• Right to Rectification (Art. 16): You may correct inaccurate or incomplete skin barrier notes, telephone records, or mailing coordinates held by our desk.
• Right to Erasure / Right to be Forgotten (Art. 17): You may demand the permanent destruction of all personal records where processing is no longer required for legitimate business continuity.
• Right to Restriction of Processing (Art. 18): You may restrict the active use of your data during dispute resolution or legal validation.
• Right to Data Portability (Art. 20): You may receive your personal inquiry history in a structured, machine-readable format (JSON or CSV).
• Right to Object (Art. 21): You have the unconditional right to object to the processing of your data based on legitimate business interests or direct marketing outreach.
• Right to Withdraw Consent (Art. 7(3)): You may withdraw your cookie and tracking consent at any moment via our footer consent controls without invalidating prior lawful processing.

13. United States State Privacy Rights (California CCPA/CPRA & State Statues)

Residents of California, Virginia, Colorado, Connecticut, Utah, Florida, and other states with comprehensive consumer privacy statutes enjoy statutory protections regarding personal information:

• Notice at Collection: We disclose all categories of data captured, collection purposes, and retention timelines prior to or at the point of data entry.
• California ccpa / CPRA Compliance: In the preceding 12 months, Dermabloom has not sold consumer personal information. We do not sell personal data for monetary consideration. We share online identifiers (such as gclid, msclkid, fbclid) with advertising partners solely for conversion attribution when affirmative consent is granted.
• Right to Opt-Out of Sale or Sharing: Consumers have the absolute right to direct a business to cease selling or sharing their personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not collect or process sensitive personal information (such as precise geolocation, genetic data, or government IDs) to infer consumer characteristics.
• Non-Discrimination: Dermabloom will never deny services, alter advisory rates, or adjust consultation quality ($65–$299 USD tier scope) if you exercise any state privacy rights.

14. Global Privacy Control (GPC) Signal Recognition

Dermabloom fully supports and honors browser-level global privacy control signals (the Sec-GPC header). When our website detects a browser transmitting a valid Global Privacy Control opt-out indicator:

• All advertising and tracking storage permissions are automatically set to denied without prompting you with secondary consent requests.
• This preference is recorded as an automated opt-out from the sharing of personal identifiers for cross-context behavioral advertising under the CCPA/CPRA and related state privacy statutes.

15. Children's Privacy Protection (COPPA Notice)

Our website, skincare formulation catalog, active ingredient dossiers, and consultation inquiry tools are intended strictly for adults aged 18 and older. We do not knowingly solicit, collect, or retain personal data from children under 16 years of age.

If a parent or legal guardian discovers that a minor under 16 has submitted personal information through our contact or inquiry forms without verified parental consent, notify our compliance desk immediately at office@dermabloom.click. We will immediately purge all associated records from our live storage.

16. Regulatory Oversight & Right to File Complaints

If you believe Dermabloom has processed your personal information in violation of applicable data protection laws, you retain the legal right to file a formal complaint with relevant regulatory authorities:

• Florida Residents: File with the Office of the Attorney General, State of Florida, The Capitol PL-01, Tallahassee, FL 32399 (Phone: +1 866-966-7226).
• California Residents: Contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov or the California Attorney General's Office.
• European Union Residents: Lodge a complaint with your national Data Protection Authority (DPA) in the EU member state of your habitual residence or place of work.
• United Kingdom Residents: Contact the Information Commissioner’s Office (ICO) at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

17. Data Subject Access Request (DSAR) Protocol & Procedure

To exercise any statutory right under GDPR, CCPA, or applicable state laws—including requests to inspect, export, rectify, or purge your personal data—submit your request to our compliance desk:

Electronic Mail Request: office@dermabloom.click
Subject Heading: Attn: Privacy Compliance / DSAR Submission
Physical Postal Notice: Dermabloom, 803 North Tampa Street, Tampa, Florida 33602, United States

Verification and Response Timetable: To safeguard client privacy, we verify your identity by cross-referencing the email address and phone number previously supplied in your catalog inquiry. We acknowledge receipt within 48 hours and deliver our complete, substantiated response within 5 business days. No fee is assessed for standard requests unless requests are demonstrably repetitive or unfounded.

18. Policy Modifications & Revision Notifications

Dermabloom reserves the right to modify this privacy policy as our skincare catalog expands, new formulation categories are integrated, or ad network technical parameters evolve. Material amendments will be highlighted through an updated "Effective Date" at the masthead of this document.

We recommend reviewing this page periodically. Continued utilization of dermabloom.click following posted revisions constitutes informed acknowledgment of modified terms.

19. Compliance Contact Information & Direct Inquiries

For immediate questions regarding data protection practices, formulation verification records, or ad platform attribution protocols, direct correspondence to our human management desk:

Primary Contact: Irina Petrova, Product Manager
Direct Email: office@dermabloom.click
Telephone Channel: +1 (464) 575-5661
Physical Facility: 803 North Tampa Street, Tampa, Florida 33602, Tampa, Florida, United States
Desk Hours: Monday through Friday, 08:30 – 17:30 EST

Digital Accessibility Statement & Architectural Conformance

Dermabloom is committed to ensuring digital accessibility for people with disabilities. We continually improve the user experience for everyone and apply relevant accessibility standards based on the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.1 Level AA.

Our concrete industrial interface utilizes high-contrast color pairings (exceeding 4.5:1 for body copy against our midnight ground of #0E1424), accessible tap targets of at least 44px, full keyboard navigability across overlays and interactive tools, explicit ARIA controls, responsive text scaling without horizontal clipping, and motion suppression under prefers-reduced-motion. If you encounter any accessibility barrier across our catalog pages, contact us at office@dermabloom.click for prompt remediation.