Ôrixir

Last updated: May 2026

1. Introduction

Welcome to Ôrixir. This Privacy Policy explains how Ellen Life BV, the company behind the Ôrixir cosmetics brand, collects, uses, stores, and protects your personal data when you visit our website www.orixir.com, make a purchase, or interact with us in any way.

Ellen Life BV is the data controller responsible for your personal data. We are committed to protecting your privacy and complying with all applicable data protection legislation, including:

The General Data Protection Regulation (EU) 2016/679 (GDPR)
The Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Other applicable national data protection laws across the European Economic Area (EEA)

2. Data Controller

The data controller for the processing of your personal data is:

Ellen Life BV

Excelsiorlaan 31

1930 Zaventem, Belgium

Email: hello@orixir.com

Website: www.orixir.com

For all privacy-related requests, questions, or complaints, please contact us at the email address above.

3. Personal Data We Collect

Depending on how you interact with Orixir, we may collect the following categories of personal data

3.1 Data You Provide Directly

Identity data: first name, last name
Contact data: email address, phone number
Delivery data: shipping address, billing address
Account data: username, password (encrypted), purchase history
Payment data: payment method details (processed securely via PayPal and Stripe — we do not store full card numbers or bank details on our servers)
Communication data: messages you send us via the contact form on our website or by email
Skin profile data: skin type, concerns, or preferences you voluntarily share with us

3.2 Data Collected Automatically

Technical data: IP address, browser type and version, device type, operating system
Usage data: pages visited, time spent on pages, click behaviour, referral URLs
Advertising data: ad interactions, conversion data collected via Google Ads, Google Merchant Center, and Meta (Facebook/Instagram) Pixel
Cookie data: see Section 8 (Cookie Policy) for full details

4. How We Collect Your Data

We collect personal data through the following means:

Directly from you when you place an order, submit a contact form, or communicate with us by email
Automatically when you browse our website, via cookies and tracking technologies (Google Analytics, Meta Pixel, Google Ads, Google Merchant Center)
Through our website platform provider Wix, which hosts our website and stores contact form submissions and customer communications on our behalf
Through our payment providers PayPal and Stripe when you complete a purchase
Through our logistics partners bpost, DHL, and DPD when processing and delivering your orders

5. Purposes of Processing & Legal Basis

We process your personal data only when we have a valid legal basis under the GDPR. The following summarises our main processing activities:

Order Processing

Purpose: Manage and fulfil your orders, arrange delivery via bpost, DHL, or DPD, send order confirmations and invoices.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)

Payment Processing

Purpose: Process payments securely via PayPal and Stripe.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR). Payment data is processed directly by PayPal and Stripe under their own privacy policies. We do not store full card or payment details on our servers.

Customer Service

Purpose: Respond to your questions, complaints, or return requests. Contact form submissions received via our Wix-hosted website are stored in our Wix account.

Legal basis: Performance of a contract / Legitimate interest (Art. 6(1)(b)(f) GDPR)

Marketing & Advertising

Purpose: Send you promotional communications and display personalised advertisements via Google Ads, Google Merchant Center, and Meta (Facebook/Instagram). We use tracking pixels and conversion data to measure campaign performance and optimise our advertising.

Legal basis: Your consent (Art. 6(1)(a) GDPR) for cookie-based advertising. You may withdraw consent at any time via our Cookie Settings or by unsubscribing from emails.

Website Analytics

Purpose: Analyse website traffic and user behaviour using Google Analytics to improve our website performance and user experience.

Legal basis: Consent for non-essential analytics cookies (Art. 6(1)(a) GDPR)

Legal Obligations

Purpose: Comply with Belgian and EU legal requirements including tax, accounting, and product safety obligations.

Legal basis: Legal obligation (Art. 6(1)(c) GDPR)

6. Third-Party Service Providers & Data Sharing

We do not sell your personal data to third parties. We share your data only where necessary to provide our services, and only with trusted partners under appropriate data protection agreements. Below is a full list of the third-party providers we currently use:

6.1 Payment Providers

PayPal (PayPal Holdings, Inc.) and Stripe (Stripe, Inc.)

We use PayPal and Stripe to process payments securely. When you complete a purchase, your payment information is transmitted directly to and processed by these providers. Both PayPal and Stripe are PCI-DSS certified. Your financial data is governed by their respective privacy policies:

PayPal: www.paypal.com/privacy
Stripe: stripe.com/privacy

6.2 Logistics & Delivery Partners

bpost, DHL, and DPD

Depending on your delivery location and order, we share your name and delivery address with one or more of our logistics partners — bpost (Belgium), DHL, or DPD — solely for the purpose of delivering your order. These partners act as data processors on our behalf and may not use your data for any other purpose.

6.3 Website Platform

Wix.com Ltd.

Our website www.orixir.com is built and hosted on the Wix platform. Wix stores data submitted through our website, including contact form submissions and customer communications, on servers within the European Economic Area. Wix acts as a data processor on our behalf. For more information, see Wix's privacy policy at support.wix.com/privacy.

6.4 Analytics

Google Analytics (Google LLC)

We use Google Analytics to analyse how visitors use our website. Google Analytics collects data such as pages visited, session duration, and device type. This data is anonymised and aggregated where possible. Google may transfer data to servers in the United States; this transfer is governed by Standard Contractual Clauses. You can opt out of Google Analytics tracking by adjusting your cookie preferences or by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

6.5 Advertising & Marketing Platforms

Google Ads & Google Merchant Center (Google LLC)

We use Google Ads and Google Merchant Center to display our products in Google search results and shopping ads. These tools use cookies and conversion tracking to measure the effectiveness of our campaigns. Your data processed through these tools is subject to Google's privacy policy at policies.google.com/privacy.

Meta (Facebook & Instagram) — Meta Platforms Ireland Ltd.

We use the Meta Pixel on our website to track conversions, build custom audiences, and display targeted advertisements on Facebook and Instagram. The Meta Pixel may collect data about your activity on our website and match it with your Facebook or Instagram profile. This is only done with your cookie consent. For more information, see Meta's data policy at www.facebook.com/privacy/policy.

6.6 Legal Authorities

We may disclose your personal data to Belgian or EU law enforcement authorities, courts, or regulators when required by applicable law or in response to a valid, legally binding request.

6.7 International Data Transfers

Some of our service providers (including Google and Meta) are based outside the European Economic Area (EEA), particularly in the United States. In such cases, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data remains adequately protected.

7. Cosmetic Product Safety & Regulatory Compliance

As a cosmetics company operating within the European Union and selling throughout the EEA, Orixir complies with Regulation (EC) No 1223/2009 of the European Parliament and of the Council on cosmetic products (the EU Cosmetics Regulation).

7.1 Responsible Person

The Responsible Person for all Orixir cosmetic products placed on the EU market, as required by Article 4 of the EU Cosmetics Regulation, is:

Ellen Life BV

Excelsiorlaan 31, 1930 Zaventem, Belgium

Email: hello@orixir.com

As the Responsible Person, Ellen Life BV ensures that all Orixir products comply with EU cosmetic safety requirements before being made available to consumers.

7.2 Product Ingredients & Natural Botanical Extracts

Orixir products are formulated using high-quality ingredients including natural botanical extracts. All ingredients used in our products are listed on the product packaging in accordance with EU labelling requirements (INCI nomenclature).

Our products are formulated to be suitable for all skin types. Our current product range does not contain known allergenic substances requiring mandatory declaration under the EU Cosmetics Regulation (Annex III). However, as with any cosmetic product containing botanical extracts, individual sensitivities may vary.

We recommend that all customers read the full ingredient list on the product packaging before use, particularly if you have known sensitivities or allergies to plant-derived ingredients. If you experience any adverse reaction, discontinue use immediately and consult a healthcare professional.

7.3 Product Safety & CPNP

All Orixir cosmetic products have been notified to the EU Cosmetic Products Notification Portal (CPNP) as required by Article 13 of the EU Cosmetics Regulation. Each product is supported by a Product Information File (PIF) including a safety assessment performed by a qualified cosmetic safety assessor.

7.4 Adverse Event Reporting

In the event of a serious undesirable effect related to the use of an Orixir product, please contact us immediately at hello@orixir.com. Ellen Life BV, as the Responsible Person, is obligated to report serious undesirable effects to the competent authority of the EU Member State where the effect occurred, in accordance with Article 23 of the EU Cosmetics Regulation.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law:

Customer order and account data: retained for the duration of the customer relationship, and up to 7 years after the last transaction for Belgian accounting and tax compliance
Order and invoice data: 10 years in accordance with Belgian tax law
Payment transaction records: retained by PayPal and Stripe in accordance with their own retention policies and applicable financial regulations
Contact form data (stored in Wix): 3 years from the date of the last communication
Marketing consent records: until you withdraw consent, plus 3 years thereafter as proof of consent
Website analytics data (Google Analytics): 14 months by default
Advertising data (Google Ads, Meta): retained in line with the policies of each platform
Delivery data shared with logistics partners: retained only as long as necessary for delivery and returns processing

When data is no longer needed, it is securely deleted or anonymised.

9. Cookie Policy

Our website www.orixir.com uses cookies and similar tracking technologies. A cookie is a small text file placed on your device when you visit our website. Some cookies are placed by us, others by third-party services we use (see Section 6).

9.1 Types of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be disabled. They include session cookies for shopping cart functionality, login authentication, and security. These are placed by Wix as our website platform.

Analytics Cookies

We use Google Analytics to understand how visitors interact with our website. Analytics cookies collect aggregated, anonymised data about pages visited, session duration, and device type. These cookies are only placed with your consent.

Marketing & Advertising Cookies

We use the Meta Pixel (Facebook/Instagram), Google Ads conversion tracking, and Google Merchant Center to measure the performance of our advertising campaigns and to show you relevant ads on third-party platforms. These cookies are only placed with your consent.

9.2 Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner. You can accept all cookies, reject non-essential cookies, or customise your preferences. You may update your preferences at any time by clicking the 'Cookie Settings' link in the footer of our website.

You can also manage or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website or the personalisation of your experience.

10. Your Rights Under the GDPR

As a resident of the European Union or the European Economic Area, you have the following rights regarding your personal data:

Right of access (Art. 15): You may request a copy of the personal data we hold about you.
Right to rectification (Art. 16): You may ask us to correct inaccurate or incomplete data.
Right to erasure / 'Right to be forgotten' (Art. 17): You may request that we delete your personal data, subject to certain conditions.
Right to restriction of processing (Art. 18): You may ask us to pause the processing of your data in certain circumstances.
Right to data portability (Art. 20): You may request a copy of your data in a structured, machine-readable format.
Right to object (Art. 21): You may object to processing based on legitimate interest, including for direct marketing purposes.
Right to withdraw consent (Art. 7(3)): Where we process data based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint: You have the right to file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorite de protection des donnees) at www.dataprotectionauthority.be.

To exercise any of these rights, please contact us at hello@orixir.com. We will respond within 30 days.

11. Security of Your Personal Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

SSL/TLS encryption for all data transmitted via our website
Secure payment processing via PCI-DSS certified providers PayPal and Stripe — we do not store payment card data on our own servers
Access controls: only authorised personnel with a legitimate need can access personal data
Data processing agreements in place with Wix, PayPal, Stripe, bpost, DHL, DPD, Google, and Meta
Regular security updates to our website and IT systems

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals where required.

12. Children's Privacy

Our website and products are not directed at children under the age of 18. We do not knowingly collect personal data from children under 18 without verifiable parental consent. If you believe we have inadvertently collected data from a child, please contact us at hello@orixir.com and we will promptly delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make significant changes, we will notify you by email or by placing a prominent notice on our website. The date of the latest update is always indicated at the top of this document.

We encourage you to review this policy periodically.

14. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Ellen Life BV

Excelsiorlaan 31, 1930 Zaventem, Belgium

Email: hello@orixir.com

Website: www.orixir.com

Phone: (+32) 2 411 69 96

For complaints regarding the use of your personal data, you also have the right to contact the Belgian Data Protection Authority:

Gegevensbeschermingsautoriteit / Autorite de protection des donnees

Rue de la Presse 35 / Drukpersstraat 35

1000 Brussels, Belgium

Website: www.dataprotectionauthority.be

Email: contact@apd-gba.be