Privacy Policy

The confidentiality of your personal data is one of the main concerns of SC IBEAUTY OFFICIAL SRL, registered with the Trade Register under no. J40/9907/21.06.2017, VAT no. RO34466758, headquartered at Str. Barajul Argeș 41D, parter, of. 4, Sector 1, Bucharest, Romania, acting as data controller ("we", "us", "our").

This document is intended to inform you about the processing of your personal data in the context of using the website biotiful.life (the "Website"). The Website is dedicated to international markets outside Romania; regardless of your country of residence, we apply the standards of Regulation (EU) 2016/679 ("GDPR") to the processing of your personal data.

Contents

  1. Categories of personal data processed
  2. Purposes and legal grounds for processing
  3. Duration for which we process your data
  4. Disclosure of personal data
  5. Transfer of personal data
  6. Cookies and similar technologies
  7. Your rights
  8. California residents (CCPA/CPRA)
  9. Privacy of minors
  10. Changes to this privacy policy
  11. Contact

1. Categories of personal data processed

A. If you are a customer of the Website, we process personal data such as:

  • name and surname;
  • phone number;
  • email address;
  • billing address;
  • delivery address;
  • order history and details of the products you purchase;
  • data regarding the way you use the Website (for example, your behavior, preferences or habits within the Website);
  • any other categories of data that you provide directly when creating a user account, placing an order through the Website, or otherwise using the Website.

Payment data: payments are made exclusively online, by card, and are processed by our secure payment processor. We do not store your full card details; we only receive confirmation of the transaction and limited information (e.g. the last digits of the card) needed to manage your order.

If you create a user account using your Facebook or Google account, we process the following public profile data displayed by those applications: username and email address.

If an account is created automatically based on your email address before finalizing an order and you do not finalize the order, the email address and other data provided will not be stored, and the account created will be automatically deleted.

B. If you are a visitor of the Website, we process personal data that you provide:

  • directly, in the context of using the Website, such as data you provide in the contact/questions/complaints section or when subscribing to our newsletter;
  • indirectly, such as: IP address, browser used, browsing duration, search history, operating system, language and pages viewed, complete URLs, sequence of clicks to, through and from the Website, information or products viewed or searched, duration of visits to certain pages, information regarding interaction with pages (e.g. scrolling, clicks, mouse movements) and other data about user behavior. This data is collected through cookies and similar technologies, subject to your consent where required (see section 6).

2. Purposes and legal grounds for processing

A. If you are a customer of the Website, we process your personal data as follows:

To carry out the contractual relationship between you and us — receiving, validating, shipping and invoicing the order placed on the Website, informing you about the status of the order, organizing the return of ordered products and handling withdrawal requests, providing customer support. Legal ground: the contract concluded between you and us, as defined in the Terms and Conditions published on the Website. Providing your data for this purpose is necessary for the performance of the contract; refusal may make it impossible to carry out the contractual relationship.

To fulfil our legal obligations arising in the context of the services provided through the Website, including tax, invoicing and archiving obligations. Legal ground: our legal obligations. Providing your data for this purpose is necessary; refusal may make it impossible for us to comply with the law and therefore to provide the services.

For marketing activities — sending, through remote communication means (email, SMS), commercial communications regarding our products and services. Legal ground: your consent, if you choose to provide it. You can give your consent by ticking the corresponding box when creating your account or subscribing to the newsletter, and you can withdraw it at any time by using the unsubscribe option at the end of each email/SMS or from your account settings. Providing your data for this purpose is voluntary and refusal has no negative consequences for you.

For carrying out analyses and reports on how the Website functions, creating consumption preference profiles, mainly in order to improve your experience on the Website. Legal ground: our legitimate interest in continuously improving the customer experience, and, for data collected through non-essential cookies, your consent. Providing your data for this purpose is voluntary and refusal has no negative consequences for you.

B. If you are a visitor of the Website, we process your personal data as follows:

For marketing activities (newsletter), based on your consent, expressed by filling in the newsletter subscription form available on the Website. You can unsubscribe at any time using the option at the end of each communication.

For resolving complaints and claims, monitoring traffic and improving your experience on the Website, based on our legitimate interest in ensuring the correct functioning of the Website and continuously improving it, and, where applicable, on your cookie consent.

3. Duration for which we process your data

We will process your personal data for as long as necessary to fulfil the purposes mentioned above.

If you are a customer, we will process your data for the entire duration of the contractual relationship and afterwards in accordance with our legal obligations — for example, financial-accounting supporting documents are retained for the period required by applicable Romanian law (as a rule, 5 years from 1 July of the year following the end of the financial year in which they were prepared).

If you delete your user account, we will interpret this as your choice to unsubscribe from commercial communications; however, deleting the account does not automatically result in the deletion of your personal data (some data must be retained under our legal obligations, e.g. invoices). If you wish your personal data to be deleted, you may exercise the rights detailed in section 7. If you request the deletion of your account while at least one order is active, the request can only be registered after the delivery of the products and completion of the last active order.

If you withdraw your consent for marketing processing, the processing for this purpose will cease, without affecting the lawfulness of processing carried out before the withdrawal.

4. Disclosure of personal data

We do not rent or sell your personal data to third parties for money.

In certain situations, your data may be accessible to third parties acting as processors or independent controllers, strictly for the purposes described in this policy, such as:

  • courier and transport operators, for the delivery of your orders;
  • payment processors, for the secure processing of card payments;
  • the e-commerce platform provider hosting the Website (Shopify) and IT/hosting service providers;
  • email/SMS marketing platform providers, for sending communications you have consented to;
  • analytics and advertising service providers, subject to your cookie consent;
  • accounting, legal and other professional advisors.

These providers are contractually bound to maintain the confidentiality of the data and to use it exclusively for the purpose for which it was provided to them.

We may also disclose your personal data to central or local public authorities where the disclosure is required by law or is necessary for the establishment, exercise or defense of a legal claim.

5. Transfer of personal data

Some of our service providers (for example, the e-commerce platform, marketing and analytics providers) may process personal data in countries outside the European Economic Area, including the United States and Canada.

Whenever personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with the GDPR — such as an adequacy decision of the European Commission (including, where applicable, the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, supplemented where necessary by additional protection measures. You may request further information about these safeguards using the contact details in section 11.

6. Cookies and similar technologies

The Website uses cookies and similar technologies to ensure its proper functioning, to analyze traffic and, subject to your consent, for marketing and advertising purposes.

When you first visit the Website, a cookie consent banner allows you to accept, decline or customize non-essential cookies. You can change your preferences at any time through the cookie preferences option available on the Website. Consent for non-essential cookies is entirely voluntary, and the Website can be used without accepting them.

7. Your rights

Under the GDPR, as a data subject, you benefit from the following rights:

  • The right to be informed — the right to receive details about the processing activities carried out by us, as described in this document;
  • The right of access — the right to obtain confirmation from us regarding the processing of your personal data, as well as details about the processing activities;
  • The right to rectification — the right to obtain, without undue delay, the correction of inaccurate personal data and the completion of incomplete data;
  • The right to erasure ("right to be forgotten") — under the conditions provided by law; following a deletion request, we may anonymize certain data (stripping it of its personal character) and continue processing it in this form for statistical purposes;
  • The right to restriction of processing, under the conditions provided by law;
  • The right to data portability — the right to receive your personal data in a structured, commonly used and machine-readable format, and the right to have this data transmitted to another controller, where the legal conditions are met;
  • The right to object — at any time, for reasons related to your particular situation, to processing based on our legitimate interest, and at any time, free of charge and without justification, to processing for direct marketing purposes;
  • The right not to be subject to an automated individual decision, including profiling, which produces legal effects concerning you or similarly significantly affects you;
  • The right to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro); if you reside in another EU/EEA country, you may also address the data protection authority in your country of residence — as well as the right to address the competent courts.

To exercise any of these rights, please contact us using the details in section 11. We will respond to your request without undue delay and in any case within one month of receipt; this period may be extended by two further months where necessary, in which case we will inform you of the extension and its reasons.

8. California residents (CCPA/CPRA)

If you are a consumer residing in the State of California, USA, you benefit from specific rights under the CCPA/CPRA, including the right to know, correct and delete your personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination.

These rights, the categories of personal information we collect and the way to exercise them are described in detail on our [CCPA Compliance] page. To exercise any of these rights, including to opt out of the sale or sharing of your personal information, please contact us at office@biotiful.life, specifying the right you wish to exercise and the email address associated with your account or orders. You can also limit the sharing of your online identifiers with advertising partners at any time by declining non-essential cookies through the cookie preferences option available on the Website.

9. Privacy of minors

The Website does not knowingly contact or collect information from persons under the age of 18 and is not intended to request information of any kind from such persons.

If, by error, we come into possession of such information and are notified of this, we will obtain appropriate parental consent to use the information or, if this is not possible, we will delete it from our servers. If you wish to inform us about the receipt of information regarding persons under the age of 18, please contact us at office@biotiful.life.

10. Changes to this privacy policy

We reserve the right to modify this privacy policy. In case of major changes, you will be notified by email (where possible) or through a specific message displayed on the Website. The version in force is the one published on the Website.

11. Contact

For any questions regarding the processing of your personal data or to exercise your rights:

SC IBEAUTY OFFICIAL SRL Str. Barajul Argeș 41D, parter, of. 4, Sector 1, Bucharest, Romania

  • Email: office@biotiful.life
  • Phone: +40 754 575 198