1. General Provisions and Data Controller

1.1. This Privacy Policy (the “Policy”) sets out how we collect, use, store, and protect the personal data of users of the estheticlab.pro online store.

1.2. The controller of personal data is:

Estheticlab.pro (Serhii Shuhajlo) NIP (Tax ID): 9452293494 Registration number: 528810233 Address: Kraków, ul. Dobrego Pasterza, nr 19A, lok. U2, 31-416, Poland Email: [email protected]

1.3. The Company operates in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR), the Polish Personal Data Protection Act (Ustawa o ochronie danych osobowych), and, with respect to the processing of data of users from Ukraine, also with reference to the Law of Ukraine “On Personal Data Protection”.

1.4. By using the Website, you confirm that you have read and understood the terms of this Policy.

2. What Data We Collect

  • Identification data: first name, last name, patronymic (where applicable).
  • Contact data: email address, phone number, delivery address.
  • Order data: order history, selected products, payment and delivery method.
  • Technical data: IP address, browser type, operating system, cookie data.
  • Professional data: document confirming a cosmetologist’s/physician’s qualification (where registering as a specialist, for access to professional products).

3. Purposes of Data Collection

Personal data is collected for the following purposes:

  • placing and fulfilling orders for aesthetic medicine preparations;
  • delivering goods within Poland, Ukraine, and the European Union member states;
  • communicating with the client regarding order status;
  • verifying professional qualification for access to professional products;
  • improving the quality of service and the Website;
  • sending marketing communications (subject to separate user consent);
  • complying with legal requirements, including tax and accounting obligations.

4. Legal Bases for Processing

We process personal data on the following legal bases:

  • performance of the sales contract (Art. 6(1)(b) GDPR);
  • user consent, e.g. for marketing communications (Art. 6(1)(a) GDPR);
  • the Company’s legitimate interest in improving its services (Art. 6(1)(f) GDPR);
  • compliance with legal obligations (Art. 6(1)(c) GDPR).

5. Disclosure of Data to Third Parties

We may disclose your data to the following categories of recipients:

  • delivery services: UPS, InPost (Poland, EU), Nova Poshta (Ukraine);
  • payment/banking service providers (for processing invoice payments);
  • IT service providers (hosting, CRM systems);
  • government authorities, where required by law.

We do not sell or disclose your personal data to third parties for their own marketing purposes.

6. International Data Transfers

Since we deliver to Ukraine and use a Ukrainian hosting provider (HostPro) and CRM system (KeyCRM) for order processing, part of your data may be transferred to recipients located outside the European Economic Area (EEA), where the European Commission has not issued an adequacy decision. In such cases, we apply appropriate safeguards, including standard contractual clauses (SCCs) approved by the European Commission.

7. Cookies

The Website uses the following categories of cookies:

  • necessary — required for the Website to function correctly, always enabled;
  • functional/analytics — for analysing traffic and improving user experience;
  • marketing — used for advertising and retargeting.

Analytics and marketing cookies are only set after obtaining your consent via the cookie management banner on the Website. You may change your choice at any time via the cookie settings in the Website footer or via your browser settings.

8. Retention Periods

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected:

  • order data, including accounting and tax records, — for at least 5 years, in accordance with applicable Polish tax law;
  • account data — for the duration of the account and 6 months after its deletion;
  • documents confirming professional qualification — for the duration of the specialist’s account.

9. Your Rights

Under the GDPR, you have the right to:

  • access your personal data;
  • rectify inaccurate data;
  • erase your data (“right to be forgotten”);
  • restrict processing;
  • data portability;
  • object to processing;
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, please contact us using the details in Section 13.

Right to lodge a complaint. If you consider that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with a data protection supervisory authority — the President of the Personal Data Protection Office of Poland (Prezes Urzędu Ochrony Danych Osobowych, UODO), or the supervisory authority of your habitual residence within the EU.

10. Automated Decision-Making

10.1. The Company does not carry out automated decision-making, including profiling, which would produce legal effects concerning a user or similarly significantly affect them.

11. Children and Minors

11.1. The Website and its products are not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with their data, please contact us so that we can delete it.

12. Data Security

We implement organisational and technical measures to protect your data, including:

  • SSL encryption of data transmission;
  • restricted access to personal data;
  • regular backups;
  • protection against unauthorised access.

13. Contact Information

For all questions relating to the processing of personal data, please contact:

Estheticlab.pro (Serhii Shuhajlo) Website: https://estheticlab.pro Address: Kraków, ul. Dobrego Pasterza, nr 19A, lok. U2, 31-416, Poland Email: [email protected] Telegram: @estheticlabpro

14. Changes to This Policy

We may update this Policy from time to time. The current version is always available on this page of the Website. We will notify users of material changes via the Website or by email.