thebf.community
Operated by Tomfeah Ltd.
128 City Road, London, EC1V 2NX, United Kingdom
Email: hello@thebf.community
Effective Date: 2 February 2026
Last Updated: 9 June 2026
1. Introduction
Tomfeah Ltd. ("we", "us", "our") operates thebf.community ("Platform").
We are committed to protecting your personal data and respecting your privacy.
This Privacy Policy explains what personal data we collect, how we use it, the legal bases for processing, who we may share it with, and what rights you have.
2. Data Controller
The data controller is:
Tomfeah Ltd.
128 City Road
London, EC1V 2NX
United Kingdom
Email: hello@thebf.community
3. Data We Collect
A. Account Information
When you create an account, we collect:
- Email address
- Username
- Date of birth
- Optional location
- Profile information, such as:
- Skin type
- Skin condition
- Hair type
- Hair condition
B. User Content
When you use the Platform, we collect and store content you submit, including:
- Reviews
- Ratings
- Comments
- Images
- Videos
- Routines
- Product lists
- Other submitted content
C. Technical Data
We automatically collect limited technical data, including:
- IP address, including through server logs
- Device and browser information
- Access timestamps
- Security and error logs
This data is used for security, fraud prevention, system integrity, troubleshooting, and platform operation.
D. Analytics
We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors use our Platform and to improve performance, usability, and content.
Google Analytics may collect information such as:
- Pages visited
- Time of visit
- Approximate location derived from technical data
- Device and browser information
- Referring websites or sources
- Interactions with the Platform
- Cookie identifiers, where consent has been given
Google Analytics may use cookies such as _ga and related cookies to distinguish users and collect statistical information about Platform usage.
Google Analytics is only used where required consent has been obtained through our cookie consent tool. You can change or withdraw your consent at any time through the cookie settings available on the Platform.
Google LLC may process data in the United States. Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on appropriate safeguards as required by applicable data protection laws.
For more information about how Google processes data, please refer to Google's privacy information and Google Analytics documentation.
E. Newsletter
If you subscribe to our newsletter, we collect:
- Email address
- Subscription status
- Consent and subscription information, where applicable
You may unsubscribe at any time via the link in our emails.
F. Payments
Where payments are made through the Platform, for example for advertising or partner placements, payment processing may be handled by Stripe or another payment service provider.
We do not store full payment card details ourselves. Payment information is processed by the payment provider in accordance with its own security and privacy standards.
Payment data may include:
- Billing details
- Payment status
- Transaction identifiers
- Limited card information, such as card brand and last digits
- Fraud prevention and compliance information
4. Legal Basis for Processing
We process personal data based on the following legal bases:
- Performance of a contract: to provide account functionality, user profiles, Platform access, and requested services.
- Legitimate interests: to maintain Platform security, prevent abuse, moderate content, troubleshoot errors, and improve basic Platform functionality.
- Consent: for newsletters, non-essential cookies, analytics cookies, and similar technologies where consent is required.
- Legal obligations: where processing is necessary to comply with applicable laws, regulatory requirements, accounting, tax, or legal obligations.
You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
5. Account Deletion & Content
If you delete your account:
- Your personal account data will be removed or anonymized, unless retention is required by law or for legitimate security or legal reasons.
- Previously published content may remain available in anonymized form.
- Data may temporarily persist in secure backups before automatic deletion.
- Certain records may be retained where necessary for legal, compliance, fraud prevention, or dispute resolution purposes.
6. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.
Typical retention periods include:
- Account data: until account deletion, unless longer retention is required by law or legitimate security or legal reasons.
- User content: may remain available in anonymized form after account deletion.
- Newsletter data: until you unsubscribe or withdraw consent, subject to retention of suppression records where necessary.
- Server logs: retained for security purposes for a limited period.
- Analytics data: retained in accordance with our Google Analytics settings and Google's applicable retention practices.
- Payment and billing data: retained as required for legal, tax, accounting, fraud prevention, and compliance purposes.
- Backups: stored securely and overwritten automatically according to our backup cycles.
7. Data Sharing
We do not sell your personal data.
We may share personal data only where necessary with:
- Hosting providers
- Technical infrastructure providers
- Analytics providers, including Google Analytics / Google LLC
- Cookie consent management providers, including CookieFirst
- Email service providers for newsletters
- Payment service providers, including Stripe where applicable
- Professional advisers, legal advisers, or authorities where legally required
All service providers are expected to process personal data only in accordance with applicable data protection laws and appropriate contractual obligations.
Hosting & Infrastructure
Our Platform is hosted on servers located in Germany, European Union.
Personal data is primarily stored and processed within the EU.
8. International Users and International Transfers
The Platform is accessible worldwide.
As our servers are located in Germany, European Union, personal data is primarily processed within the EU.
However, some service providers, including analytics, payment, newsletter, or technical service providers, may process personal data outside the United Kingdom or the European Economic Area.
Where personal data is transferred outside the UK or the EEA, we rely on appropriate safeguards where required, such as:
- Adequacy decisions
- The EU-U.S. Data Privacy Framework
- The UK Extension to the EU-U.S. Data Privacy Framework
- Standard Contractual Clauses
- Other legally recognized transfer mechanisms
9. Your Rights
Depending on your location, you may have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Restrict processing
- Object to processing
- Request data portability
- Withdraw consent, including for newsletters and non-essential cookies
- Lodge a complaint with a data protection authority
To exercise your rights, contact: hello@thebf.community
10. Security
We implement appropriate technical and organizational measures to protect personal data.
However, no system can guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us if you suspect unauthorized access to your account.
11. Cookies
We use cookies and similar technologies to operate the Platform, remember preferences, understand usage, improve performance, and, where applicable, support advertising or measurement activities.
We use CookieFirst to manage cookie consent and provide up-to-date information about the cookies and similar technologies used on the Platform.
Non-essential cookies, including analytics cookies such as Google Analytics cookies, are only used where required consent has been obtained.
You can change or withdraw your consent at any time through the cookie settings available on the Platform.
The detailed cookie table below is generated and updated by CookieFirst.
12. Changes to this Policy
We may update this Privacy Policy periodically.
If we make material changes, we may notify users through the Platform or by other appropriate means.
The updated version will apply from the date stated at the top of this Privacy Policy.