Who we are and how to contact us
Varanos Global provides a UK-based cosmetics market-entry coordination service. For privacy matters, contact hello@varanosglobal.com. Depending on the particular engagement, Varanos, a brand, a factory or an appointed specialist may have distinct data-protection responsibilities. Your agreed engagement documents should identify the contracting operator and any applicable controller/processor relationship.
The information we handle
This can include your name, work email, business and brand information, optional websites, account credentials and preferences, service enquiries, project instructions, quotes and payments, manufacturer details, correspondence, uploads, AI extraction drafts, project statuses and access/security audit events. Technical product files may include commercially confidential formulations. They can also contain incidental personal information such as named manufacturer contacts.
Where information comes from
We receive information through site forms, registered accounts, uploaded documents, brand and factory correspondence, authorised specialists and sometimes publicly available business contact information used for relevant enquiries. Please avoid sharing information you are not authorised to provide.
Why we use information
We use details to administer accounts, provide agreed services, coordinate authorised supplier and specialist communication, manage documents, support customers, maintain transaction and audit records and prevent misuse. Our applicable lawful bases can include contract, legitimate interests in secure and effective business operations, legal obligations for accounting or other required records, and consent where legally needed for optional marketing or non-essential device technologies.
AI-assisted processing
Uploaded documents may be converted to machine-readable text and processed using AI services to suggest product, ingredient or variation records and flag missing evidence. AI results can be inaccurate. Catalogue records require human review and approval. Automated outputs do not make decisions about individuals with legal or similarly significant effects, do not constitute safety assessments and do not confer a right to market cosmetics.
Who we share information with
Infrastructure and operational providers may include Cloudflare for hosting, storage and AI services, Resend and email-routing services for correspondence, and Stripe for payments. Properly authorised assessors, Responsible Persons, regulators and project partners may receive information needed for an agreed task. We do not assume any researched specialist is contracted. The payment provider processes card details; Varanos may retain relevant order references and billing records.
Confidential formulations and permissions
We separate factory-owned formula details and private correspondence from ordinary brand-visible status and marketed product names. Access depends on the authorised person, project and purpose. The brand portal is not intended to show unredacted manufacturer threads or exact private formula quantities by default. Contact us if you suspect data has been disclosed to the wrong project or recipient.
International access and transfers
Customers, manufacturers, support systems and advisers may work outside the UK. Information could therefore be processed in other countries where a service or project requires it. We assess relevant UK data-transfer safeguards and apply applicable contractual, adequacy or other lawful mechanisms where required. You may request further information for a particular engagement.
How long we retain information
We use the purpose and legal requirements to decide retention: active account and project information is held for delivery and support and afterwards when reasonably needed for disputes, audits or legal duties; payment and accounting records are retained for applicable statutory periods; security records for proportionate investigation and protection; and incomplete import files for review, recovery or deletion once no longer required. Any obligation of a legally appointed Responsible Person to retain a PIF is separate from Varanos's own retention needs. Please contact us for an account-specific export or deletion assessment.
Your rights
Subject to the circumstances and applicable law, you may ask for access, correction, erasure, restriction, portability or object to processing. You may object to direct marketing at any time. You can withdraw consent where processing depends on it. Some obligations can require specific records to be retained. You may complain to the UK Information Commissioner's Office.
Cookies and security
An essential session cookie allows the authenticated workspace to function. Some language or interface settings may be stored locally on your device. Infrastructure providers may use necessary security measures. Optional analytics or marketing technology is subject to the appropriate information and consent requirements. Read our Cookie Notice.
Updates
This notice was updated on 30 October 2026. We will review it when processing, services or suppliers change, and explain material new uses of personal information as required. Email hello@varanosglobal.com for questions or requests.