Privacy Policy

1. Who we are

Xecrets ("we", "us") is a family-owned Norwegian skincare company, developed in Norway and manufactured in Finland. Organisation/VAT number: 915158323MVA (Norway).

We are the data controller for the personal data processed through this website. You can reach us at any time at hello@xecrets.com.

2. What data we process

Strictly necessary storage: We store your chosen language in your browser (localStorage) so the site displays in your language on return visits. A session flag is stored if you log in to the partner portal. This data never leaves your device and is not transmitted to us.

Cookie choices: Your cookie consent choice (accept, reject or customised categories) is stored in your browser together with a timestamp, so we can respect and document your decision.

Newsletter and contact: If you subscribe to our newsletter or contact us, we process your name and e-mail address in order to respond or send you the communications you requested.

We do not currently use analytics or marketing cookies, and we do not sell or share personal data with third parties for their own purposes.

3. Legal basis (GDPR art. 6)

Strictly necessary storage is processed on the basis of legitimate interest (art. 6(1)(f)) — the site cannot function as requested without it.

Analytics and marketing cookies, if activated in the future, will only be set after your explicit consent (art. 6(1)(a)), collected through the cookie banner.

Newsletter and contact enquiries are processed on the basis of your consent (art. 6(1)(a)) or to take steps at your request (art. 6(1)(b)).

4. How long we keep data

Browser storage (language, consent, partner session) remains on your device until you clear it or make a new choice. Consent is re-requested if our policy changes materially.

Newsletter and contact data is kept only as long as needed for the purpose — you can unsubscribe or request deletion at any time.

5. Your rights

Under the GDPR you have the right to access, rectify or erase your personal data, to restrict or object to processing, and to data portability. Where processing is based on consent, you may withdraw it at any time — for cookies via the "Cookie Settings" link in the footer, otherwise by contacting us.

To exercise any of these rights, e-mail hello@xecrets.com. We respond within 30 days.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

6. Changes to this policy

If we change how we process personal data — for example by introducing analytics — we will update this page and, where required, ask for your consent again.