Privacy policy

Privacy Policy

Effective date: 3 August 2026

1. Data Controller

The controller of your personal data is Magdalena Sendor Kosmetyki Świata, with its registered office at ul. Dąbrowskiego 9/12, 30-532 Kraków, Poland, VAT ID PL6772174306, operating the online store at e-cosmetorium.com.

Contact for data protection matters: support@e-cosmetorium.com.

2. What data we collect

  • Data provided when placing an order: first and last name, delivery and billing address, email address, phone number, and — for businesses — company name and VAT ID.
  • Transaction and payment data: processed by payment providers; we do not store full payment card details.
  • Technical data: IP address, browser and device information, and data about your activity in the store (via cookies — see Section 9).
  • Correspondence: the content of messages sent to customer support.

3. Purposes and legal bases of processing (Art. 6 GDPR)

Purpose Legal basis
Fulfilling the order and sales contract Art. 6(1)(b) (performance of a contract)
Issuing invoices, tax and accounting obligations Art. 6(1)(c) (legal obligation)
Handling complaints, returns and disputes Art. 6(1)(b) and (f) (legitimate interest)
Fraud prevention and chargeback handling Art. 6(1)(f) (legitimate interest)
Email marketing (newsletter) Art. 6(1)(a) (consent)
Analytics and non-essential cookies Art. 6(1)(a) (consent)

4. Data retention period

  • Order data and tax documentation: for the period required by law (as a rule 5 years from the end of the tax year ).
  • Marketing data: until consent is withdrawn.
  • Data relating to complaints and disputes: until the applicable limitation periods for claims expire.
  • Technical data and cookies: in accordance with the cookie settings (Section 9).

5. Recipients of data

We may share your data with:

  • payment providers (Shopify Payments, PayPal, Stripe, Wise);
  • courier and logistics companies (UPS, Poczta Polska, Spring GDS, and our fulfilment and returns partners in the USA);
  • our store platform provider — Shopify Inc.;
  • our accounting firm and advisors (tax, legal) under data processing agreements;
  • public authorities, where required by law.

We conclude data processing agreements (Art. 28 GDPR) with entities that process data on our behalf.

6. Transfers of data outside the EEA

In connection with fulfilling orders to the United States (fulfilment and returns partners) and our use of the Shopify Inc. platform (USA), your data may be transferred to countries outside the European Economic Area.

We take steps to ensure that such transfers take place on the basis of appropriate safeguards provided for under the GDPR — Standard Contractual Clauses approved by the European Commission, or the recipient's participation in the EU-U.S. Data Privacy Framework. To obtain a copy of the safeguards applied, contact us at support@e-cosmetorium.com.

7. Your rights

You have the right to:

  • access your data and receive a copy of it,
  • rectify your data,
  • erase your data ("right to be forgotten"),
  • restrict processing,
  • data portability,
  • object to processing based on legitimate interest,
  • withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).

To exercise these rights, contact us at: support@e-cosmetorium.com.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

8. Data security

We apply appropriate technical and organisational measures to protect data, including encryption of transmission (SSL/TLS). The Shopify platform stores data on secure servers in accordance with the PCI-DSS standard. However, no method of transmission over the Internet is 100% secure.

9. Cookies

We use cookies and similar technologies to ensure the proper functioning of the store and — with your consent — for analytics and marketing purposes.

Cookies that are essential for the store to function (e.g. maintaining the session, cart contents, security) are always used, as the store would not work properly without them. Non-essential cookies — analytics and marketing — are used only after you have given your consent.

We collect consent through a consent banner displayed on your first visit to the store. You can manage your consent and withdraw it at any time using the cookie settings available via the consent banner in our store. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Customers located in certain U.S. states may also exercise the right to opt out of data sharing via the "Data sharing opt-out" page available in our store.

10. Marketing

We send marketing messages only with your explicit consent. You may withdraw your consent at any time by clicking the "unsubscribe" link in the message or by contacting us.

11. Changes to this policy

We may update this policy. We will inform you of any material changes by publishing a new version on this page together with the date of the update.

12. Contact

For matters relating to personal data: support@e-cosmetorium.com, or in writing to the registered office indicated in Section 1.