This policy explains which personal data we process when you visit beauty-box.shop, buy forms or contact us, why we do it and what your rights are under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
Who is responsible
The controller of your personal data is ZIEGERT SRL, Str. Sfântul Petru Tei 59, Sector 2, Bucharest, Romania, CUI RO35793880, Trade Register J40/3733/2016. For anything related to your data, write to office@beauty-box.shop.
What we process and why
| Purpose | Data | Legal basis |
|---|---|---|
| Processing your order and making the downloads available | Name, email address, billing address and country, phone number if you give it, the forms you bought, order date and amount, the IP address recorded with the order | Performance of the contract — Art. 6(1)(b) GDPR |
| Your consent to the immediate download | The fact that you ticked the box, the text you agreed to, date and time | Legal obligation to prove the consent — Art. 6(1)(c) GDPR |
| Invoicing and accounting | Name, billing address, order details, payment details | Legal obligation (Romanian accounting and tax law) — Art. 6(1)(c) GDPR |
| Your customer account, if you create one | Email address, name, password (stored encrypted), addresses, order history, downloads | Performance of the contract — Art. 6(1)(b) GDPR |
| Payments | Payment status and transaction reference; if you choose to save a card for later purchases, the card brand, its last four digits and its expiry date — never the full card number | Performance of the contract — Art. 6(1)(b) GDPR |
| Withdrawal statements and complaints | Name, email address, order number, your message, date and time of receipt | Legal obligation under consumer law — Art. 6(1)(c) GDPR |
| Answering your emails | Your email address, name and the content of your message | Our legitimate interest in answering you, or steps before a contract — Art. 6(1)(f) and (b) GDPR |
| Security of the website and fraud prevention | IP address, browser information, server logs | Our legitimate interest in a secure shop — Art. 6(1)(f) GDPR |
| Analytics cookies (WooCommerce order attribution) | How you arrived at the shop (for example a search engine or a link), recorded on your order | Your consent — Art. 6(1)(a) GDPR; only if you accept analytics cookies |
We do not sell your data, we do not use it for advertising and we do not make decisions about you based solely on automated processing. The payment providers may run automated fraud checks on payments.
Who receives your data
- Our hosting provider, which runs the server of the website and of our email, as our processor.
- Stripe (Stripe Payments Europe, Limited, Ireland), when you pay by card. Stripe processes the payment and, for fraud prevention and its own legal obligations, also acts as an independent controller — see stripe.com/privacy.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), when you pay with PayPal, as an independent controller — see PayPal’s privacy statement.
- The people and services who keep our accounts, for invoices and accounting records.
- Public authorities, only when the law requires it (for example the tax authority).
Transfers outside the European Economic Area
Stripe and PayPal belong to groups based in the United States and may process some data there. Such transfers take place under the EU–US Data Privacy Framework or under the European Commission’s Standard Contractual Clauses.
How long we keep your data
- Orders, invoices and the related consent: for as long as Romanian accounting and tax law requires us to keep accounting records.
- Your customer account: until you delete it or ask us to delete it. Orders that must be kept by law are kept for the period above.
- Withdrawal statements and complaints: for as long as needed to handle them and to prove how we handled them, within the legal limitation periods.
- Emails: for as long as needed to answer you and to follow up on the matter.
- Server logs: for a limited period, for security.
- Cookies: see our Cookie Policy.
Your rights
You have the right to:
- access the data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where we do not have to keep it by law;
- restrict the processing of your data;
- receive the data you gave us in a portable format;
- object to processing based on our legitimate interest;
- withdraw your consent at any time (for cookies, from “Cookie preferences” at the bottom of every page), without affecting what was done before.
Write to office@beauty-box.shop to exercise your rights. We reply within one month; we may ask you to confirm your identity first.
You can also lodge a complaint with the Romanian data protection authority — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro — or with the data protection authority of the EU country where you live or work.
Security
The shop is served over an encrypted connection (HTTPS). Passwords are stored encrypted, card details are handled only by the payment providers, and access to order data is limited to the people who need it to serve you.
Changes to this policy
We update this policy when the way we process data changes. The date of the latest version is shown at the top of the page.