Privacy Policy

Last Updated on March 1, 2025.

This Privacy Policy (“Policy” and/or “Notice”) describes how Starlight Dermal (Hong Kong) Limited (“Starlight”, “we”, “our” or “us”) collects and processes personal information online through epiluma.com, and all other Starlight websites and applications (the “Services”) that link to this Policy.

1. Personal Information That We Collect

Personal information is information, or a combination of pieces of information, that could reasonably allow you to be identified. We collect personal information from a variety of sources, including from you directly (e.g., when you contact us via our website or sign up to receive product updates and availability), information we generate about you in the course of our relationship with you (e.g., data collected from cookies and similar technologies as described in our Cookies Policy below), and information we collect about you from other sources, including commercially-available sources, such as public databases (where permitted by law). We may also collect certain personal information about you as required by law, or as a consequence of our contractual relationship. Failure to provide this information may prevent or delay the fulfillment of these obligations. Note that we and our service providers may automatically collect certain technical information from your computer or mobile device over time and across different websites when you use the Services.

We may collect the following categories of personal information from and about you:

  • Identifiers such as a name, phone number, postal address, unique personal identifier, online identifier, email address, account name, or other similar identifiers;

  • Demographic information, including characteristics that may be protected by law such as gender or age;

  • Commercial information, such as your purchase history or products you have expressed interest in

  • Internet or other electronic network activity information, such as the data we receive when you interact with our website;

  • Geolocation data

  • Audio, electronic, visual, thermal, olfactory, or similar information, such as photographs or voice recordings;

  • Professional or employment-related information, such as your employer or title; and

  • Education information, such as the university you attended and degree.

  • Inferences are drawn from the above categories

2. How We Use Your Personal Information

We may use your personal information for the following purposes:

  • Identification and authentication: We use your identification information to verify your identity when you access and use our Services, or otherwise engage with us, and to ensure the security of your personal information. This is necessary to provide the requested service.

  • Service operations: We process your personal information to provide the Services that you request.

  • Service improvements: We analyze usage information, including site analytics, to continually improve the user experience. It is in our legitimate business interests to use the information provided to us for this purpose, so we can understand issues and make necessary improvements.

  • Communications: Communications may include providing information about changes to the terms and conditions, updates regarding our services, employment-related information, or responses to questions you pose.

  • Marketing: We may use your personal information to build a profile about you, to understand your preferences, and to help determine which marketing materials (for example, region- or sector-focused) would be of interest to you. Where necessary, we will obtain your consent before sending marketing materials, such as email and SMS messages.

  • Exercising our rights: We may use your personal information to exercise our legal rights where it is necessary to do so, for example to detect, prevent, and respond to intellectual property infringement claims or violations of law.

  • Complying with our obligations: We may process your personal information to carry out fraud prevention checks or comply with other legal or regulatory requirements, when required by law.

  • Customizing your experience: We may use your personal information to improve your experience of the Services, such as by providing interactive or personalized elements on the Services and providing you with content based on your interests.

We may also anonymize your personal information in such a way that you may not reasonably be re-identified by us or any other company, and may use this anonymized information for any other purpose.

3. How And When We Share Your Personal Information

We do not rent or sell or otherwise disclose information we collect about you, except as described here. We may share your information with:

  • Our affiliated legal entities

  • Third party service providers who perform services on our behalf based on our instructions. We do not authorize these service providers to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements. Examples of these service providers include entities that process credit card payments, fulfill orders and provide web hosting, advertising and marketing services.

In addition, and notwithstanding any other provision herein, we may retain and disclose information about you (a) if we are required to do so by law or legal process; (b) to law enforcement authorities or other government officials; or (c) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

We also reserve the right to transfer information we have about you in the event we sell or transfer all or a portion of our business or assets, including in connection with a merger, acquisition, reorganization, liquidation, change in control or other sale by or of us or any affiliated entity (in each case whether in whole or in part). Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use information you have provided to us in a manner that is consistent with this Policy. Following such a sale or transfer, you may contact the entity to which we transferred your information with any inquiries concerning the processing of that information.

4. Your Rights Over Your Personal Information

You have certain rights regarding the personal information we hold about you, subject to local law. These may include the right to access, correct, delete, restrict or object to our use of, or receive a portable copy in a usable electronic format of your personal information. You also may have a right to lodge a complaint with your local data protection or privacy regulator.

We also encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate. Where you have provided your consent to any use of your personal information, you can withdraw this consent at any time. Please note that we may require additional information from you in order to honor your requests.

If you would like to discuss or exercise any rights you may have under law, please contact us at privacy@epiluma.com. 

For additional information regarding your rights related to our use of cookies, please see our “Cookies Policy” in Section 6 below.

5. Data Retention

We will retain your personal information for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable laws or regulation. Copies of information that you have updated, modified, or deleted will remain in our systems if applicable law requires us to retain it.

You have a right to access your personal information, rectify inaccurate personal information kept about you, request the erasure of personal information and to request that we restrict the processing of your data in certain circumstances. If you wish to access your personal information, please contact us at the contact information provided in Section 10 below in writing, and allow reasonable time for the data to be collected. You also have the right to lodge a complaint with a supervisory authority.

6. Cookies Policy

Cookies

A cookie is a small text file that can be placed on your computer’s hard drive with your permission. The cookie helps analyze web traffic and lets you know when you visit a particular site. Cookies allow web applications to respond to your individual preferences when online and tailor operations by gathering and remembering information about your preferences.

Cookies help Starlight provide a better user experience on our website by monitoring which pages are most frequently visited. A cookie does not give Starlight access to your computer or provide any information other than the data you choose to share.

If you do not want the Services to collect information through the use of cookies, you can set your web browser to reject cookies from the Services. Each browser is different, so you should check your browser’s “Help” menu to learn how to change your cookie preferences. If you reject or block cookies from the Services, however, the Services may not function as intended.

Types of Cookies we use:

  • Strictly Necessary Cookies: These are essential cookies that let you move around the website and use its features, like accessing secure areas. Without them, services registration and logging in cannot be provided. These cookies don't collect any information about you that could be used for marketing or remembering where you've been on the internet.

  • Performance Cookies: These collect information about how you use a website, for instance, which pages you go to most often, and if you get error messages. They don't collect information that identifies you; all the information is anonymous. It is used only to improve how the website works.

  • Functionality Cookies: These remember choices you make (such as your user name, language or the region you are in) and provide personal features. They can remember changes you have made to text size, fonts and other parts of web pages that you can customize. They may also provide services you've asked for, such as watching a video or commenting on a blog. The information they collect can be made anonymous. They can't track other websites or apps you visit.

  • Targeting Cookies: These deliver adverts or messages relevant to you and your interests. Sometimes targeting cookies are linked to other sites, such as Facebook.

Within these four categorizations of cookie, cookies are sorted as either temporary ('Session' cookies) or more long-term ('Persistent' cookies).

Analytics Cookies

Starlight sites use analytics to help improve both the user experience and functionality, without personally identifying individual visitors. Starlight uses external services, including Google Analytics, to attain real-time statistics on use and navigation of the website, including page views, traffic patterns, visit counts, and visit statistics. These services are not used to gather, request, record, require, collect, or track personally identifiable information. This helps us understand how visitors to our website use it and to make recommendations based on browsing history and engagement.

  • 'Session' cookies link your actions in one session only. This 'session' starts when the webpage or app is opened and finishes when it is closed. Then the cookie is deleted forever.

  • 'Persistent' cookies are where the cookie remains on your phone or computer for a specific period of time. They are activated automatically when you visit a particular website or app.

Third-Party Cookies

One other difference between types of cookies is if the cookie is a 'first-party’ cookie or a 'third-party’ cookie. A first-party cookie is set by the Starlight website whereas a 'third-party' cookie is set by someone else.

If you'd like to delete cookies or instruct your web browser to delete or refuse cookies, please visit the help pages of your web browser.

7. International Data Processing & Transfer

Starlight is established in Hong Kong, where certain aspects of data processing and business operations take place. However, we utilize servers located in the United States to provide our Website and related services. This means that your personal information may be transferred to, stored on, and processed in jurisdictions outside of your own, where data protection laws may differ from those in your country of residence.

By using our Website, you acknowledge that your personal information may be transferred to and processed in Hong Kong, the United States, or other jurisdictions where we or our service providers operate, subject to appropriate safeguards as required by applicable law.

8. EU Residents

If you are accessing our Site from the European Union, we process your personal data as a “controller” under Regulation (EU) 2016/679 (“GDPR”).

We provide the Site from servers located in the United States. Any transfer of your personal data outside of the European Economic Area (EEA) is conducted in compliance with GDPR requirements, using appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful mechanisms.

We process personal information based on our legitimate interest in operating, maintaining, and improving our Sites, as described in Section 2 (“How We Use Your Personal Information”). For details on how we share your personal information, please refer to Section 3 (“How And When We Share Your Personal Information”).

9. Changes To The Notice

This Policy may be updated periodically and without prior notice to you to reflect changes in our information practices. Any changes to this Policy will be posted to this page so you are always aware of the information we collect and how we use it. Accordingly, please refer back to this page frequently as the Policy may change.

10. Contact Us

If you have questions or concerns regarding the way in which your personal information has been used, please contact us at privacy@epiluma.com. 

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you may have the right to make a complaint to the data protection authority of your country of residence.