4Mation Skins is a skincare brand owned and operated by 4Mation Biosciences Private Limited. This policy explains, in plain language, what personal information we collect when you use this website or buy from 4Mation Skins, why we collect it, who we share it with, and what control you have over it.
We have deliberately kept this readable. If anything here is unclear, write to us — our contact details are at the end.
Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, we are the Data Fiduciary for the personal data described here, and you are the Data Principal.
This policy applies to this corporate website, the 4Mation Skins online store and mobile apps, our official social media pages, and the email, SMS and WhatsApp messages we send you. It also covers information we collect at events, pop-ups and brand collaborations.
It does not cover the marketplaces and platforms where 4Mation Skins also sells — such as Amazon, Myntra, Blinkit and Smytten. When you buy there, that platform's privacy policy governs your data. We receive only the limited order and delivery information those platforms pass on to us so we can fulfil and support your order.
Our enquiry form collects your name, organisation, email address, phone number and your message. That enquiry is stored securely on our web server in a location that is not publicly accessible, and a copy is emailed to our team so we can respond. We use it only to reply to you and to manage the business relationship that follows.
We never ask for, and never store, your full card number, CVV, UPI PIN or net banking password.
We rely on your consent for marketing messages, non-essential cookies and advertising; on the performance of our contract with you for anything needed to complete your order; on legal obligation for tax and regulatory records; and on the legitimate uses permitted under the Digital Personal Data Protection Act, 2023.
Cookies are small files placed on your device. We also use pixels, tags, tag managers, software development kits and local storage, which work in a similar way. We group them as follows.
You can accept or decline non-essential cookies through the cookie notice on our sites, and change your mind at any time. You can also block or delete cookies in your browser settings, though blocking necessary cookies will break checkout.
We advertise on Meta (Facebook and Instagram), Google and similar platforms. To do that, and to understand whether our advertising actually works, we use the following business tools.
What is collected and shared with Meta. When you use our sites, these tools may share with Meta: the pages and products you viewed, items you added to cart, checkouts you started, purchases you completed, the order value and currency, enquiries you submitted, your device and browser details, your IP address, and cookie identifiers. Where we have it, we may also share a hashed — irreversibly scrambled — version of your email address, phone number, name, city, state, PIN code and country, so that Meta can match the activity to an account without us handing over those details in readable form.
Why we do it. To measure advertising performance and attribute sales correctly, to build Custom Audiences and lookalike audiences, to show you products you have looked at, and to stop showing advertisements to people who have already bought.
How Meta uses it. Meta processes this information under its own Privacy Policy and its Business Tools Terms. For some of this processing, Meta acts as an independent controller of your data rather than on our instructions.
What we never send. We do not send advertising or analytics partners any special or sensitive category of data. That specifically includes anything about a skin condition, medical concern, treatment or health issue you may have shared with us. We also never place your email address, phone number or name into a website address or query string.
Your choices. You can:
Opting out means the advertisements you see become less relevant. It does not mean you stop seeing advertisements.
We share personal data only with the categories of partners below, only to the extent they need it, and only under contracts that require them to protect it.
We do not sell your personal data. We do not rent, trade or otherwise make our customer list available to anyone for their own marketing.
Payments are handled by PCI-DSS compliant payment gateways. Your card, UPI or net banking credentials are entered on the gateway's secure page and are not visible to or stored by us. If you choose to save a card for future purchases, it is stored as a token by the gateway in line with the Reserve Bank of India's card-on-file tokenisation framework.
We retain only the transaction reference, amount, payment method, status and the last four digits of the instrument, which we need for accounting, refunds and dispute resolution. For cash-on-delivery orders, we may verify the order by phone call or one-time password before dispatch.
To deliver your order we share your name, delivery address and phone number with our courier partner and its delivery executive. Couriers may contact you directly about the delivery.
Order confirmations, dispatch alerts, tracking links and delivery updates are service messages tied to your purchase. We send them even if you have opted out of marketing, because they are part of fulfilling your order.
We send marketing by email, SMS and WhatsApp only where you have given consent or where you are an existing customer buying similar products. You are always in control:
When you opt out, we keep a minimal record of your opt-out — that is the only way we can make sure we do not contact you again. Opting out of marketing does not stop transactional messages about an order you have placed.
Some of our service providers — including our e-commerce platform, advertising platforms and communication tools — store and process data on servers outside India. Indian law currently permits such transfers except to countries or territories specifically restricted by the Central Government. Where we transfer data outside India, we do so under contractual protections requiring the recipient to keep it secure and use it only for the purposes we have agreed.
When a retention period ends, we delete the data or anonymise it so it can no longer be linked to you.
We use encrypted connections across our sites, access controls so staff see only what their role requires, encrypted storage of passwords, server-side rate limiting on our forms, and due diligence on partners before we share data with them. No system is perfectly secure, but if a personal data breach occurs we will act quickly: we will inform the Data Protection Board of India and notify affected users as required, including within 72 hours where the Digital Personal Data Protection Rules, 2025 require it.
As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:
To exercise any of these, email [PRIVACY EMAIL] from the email address on your account, or write to our Grievance Officer at the address in section 19. We may ask you to verify your identity before we act, which protects you from someone else making a request in your name. We will respond within 30 days.
Some requests have limits. If we are legally required to keep a record — a tax invoice, for example — we will retain it even after you ask for erasure, and we will tell you when that applies.
Our websites and stores are meant for adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or legal guardian, and we do not carry out behavioural advertising to, or tracking of, children.
Some 4Mation Skins products are formulated for teenage skin. These are intended to be purchased by a parent or guardian, who is responsible for the account and the order. If you believe a child has given us personal data, write to us and we will delete it.
If you share a review, photograph, video or testimonial with us — including through a paid or barter collaboration — you are giving us permission to publish it on our websites, our social media, our marketplace listings and our advertising, along with your first name or handle, unless we agree otherwise in writing with you. You can ask us to take your content down at any time by writing to 4mationbiosciences@gmail.com. We will remove it from the channels we control, though copies already shared by others may remain online.
Our sites and messages may link to other websites and platforms we do not control, including marketplaces, social networks and creator pages. This policy does not apply to them. Please read their privacy policies before sharing anything.
We update this policy when our practices or the law change. The "Last updated" date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you by email or through a notice on the website before it takes effect.
For any question, request or complaint about your personal data, contact us first:
In line with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023, our designated Grievance Officer is:
We acknowledge every complaint within 48 hours and aim to resolve it within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India, or to the appropriate consumer forum, including the National Consumer Helpline.