To provide a highly curated, data-led experience, we collect the following categories of information:

• Transactional & Account Data: Name, billing/shipping address, email, phone number, and purchase history when you create an account or place an order.
• Diagnostic & Skin Analysis Data: Information you provide through our "Evidence Seeker" online quizzes, or data collected during physical skin analyses with our Validation Experts at our counters. This helps us map the exact cellular or topical solutions for your needs.
• User-Generated Content (UGC): Product reviews, before/after photos, and user panel feedback that you voluntarily submit to validate product efficacy.
• Technical & Tracking Data: IP address, device type, browser settings, and browsing behavior on our site, collected via cookies and similar technologies.

We process your personal data on lawful bases (contractual necessity, legitimate interest, and explicit consent) for the following purposes:

• 1. Fulfillment & O2O Integration: To process your orders, manage your account, and seamlessly link your online research with your in-store Validation Expert bookings.
• 2. Personalized Efficacy: To tailor product recommendations based on your unique skin diagnostic data and purchase history.
• 3. Direct Marketing (With Consent): To send you targeted updates, promotions, and clinical data regarding our products via Email, SMS, or WhatsApp. You must explicitly opt-in to receive these communications, and you may opt-out at any time.
• 4. Service Improvement & Analytics: To analyze user perception and validate the efficacy of our curated portfolio.

We act as your expert filter and fiercely protect your data. We do not sell your personal data. We only share information with strictly vetted third parties necessary to operate our business:

• Service Providers: Payment gateways (e.g., Stripe, PayPal), logistics/courier partners, and enterprise IT providers.
• Limitation of Liability: While BB2.0 ensures all integrated payment processors are PCI-DSS Level 1 compliant, we do not store your raw credit card information on our servers (data is tokenized). BB2.0 shall not be held liable for independent security breaches occurring on third-party payment or logistics networks, provided BB2.0 has fulfilled its required security obligations.

Your data is protected by enterprise-grade encryption (Secure Socket Layer - SSL) in transit and at rest. In the unlikely event of a data breach that poses a risk to your rights, BB2.0 has established rigorous protocols to notify you and the relevant regulatory authorities (such as the HK PCPD) within legally mandated timeframes (e.g., 72 hours).

We use cookies to elevate your browsing experience and gather anonymous site analytics (via tools like Google Analytics). Upon your first visit, you will be prompted via our Consent Management Platform to accept, reject, or customize non-essential cookies. You can update these preferences at any time via your account settings.

Depending on your jurisdiction (including HK PDPO, GDPR, and CCPA), you hold the following rights:

• Right to Access & Portability: Request a copy of the data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request deletion of your data, subject to legal retention requirements (e.g., tax and warranty laws).
• Right to Withdraw Consent: Easily opt-out of marketing communications via the "Unsubscribe" link in our emails, replying "STOP" to SMS, or adjusting your account settings.

We retain transactional data for as long as legally required for tax and accounting purposes (typically 7 years). Diagnostic and skin analysis data is retained only as long as you maintain an active account with us, ensuring your "Full Circle of Care" profile remains accurate and up-to-date.