Privacy Policy

The protection of our Clients’ personal data is of key importance to us, therefore we act with the utter due diligence to ensure an optimal level of security during the processing of your personal data. This Privacy Policy (hereinafter: the Policy) determines the rules for the processing and protection of personal data of Users by the Controller. The Policy regulates the types of personal data collected by the Controller, the manner of using these data, the Users’ rights and the categories of entities to which the data are made available. The Policy also specifies the measures for the protection and security of personal data and the manner of contact with regard to the measures and methods of personal data protection applied by the Controller.

• User – a natural person whose data are processed by the Controller;
• Client – an entity to whom the Controller provides services or with whom the Controller has made a sales agreement
• Personal data – any information relating to an identified or identifiable natural person, e.g. first and last name, phone number, address, e-mail address. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of that person. Information is not considered as allowing the identification of the person if this requires excessive costs, time or activities.
• Data processing – any operations which is performed on personal data, such as collecting, recording, storing, developing, changing, sharing and deleting, in particular those performed in IT systems;
• Personal data breach – a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access to personal data transmitted, stored or otherwise processed;

In connection with the regulations resulting from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation) (OJ L 119, p. 1) (hereinafter: the GDPR), we would like to inform you that:

The Controller of your personal data is Cosibella Sp. z o.o. with its registered office in Warsaw, entered into the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division, under number 832314, address: ul. Jutrzenki 177, 02-231 Warsaw, business id. no. (REGON) 385746050, tax id. no. (NIP) 5223180504.

Personal data of the Users are processed in compliance with the requirements of generally applicable law, in particular the Polish Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2019, item 1781, as amended) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation or the GDPR, OJ L 119, 04/05/2016, p. 1-88).

The following persons have access to personal data: The Controller, employees and contractors of the Controller, its associates and persons providing services to the Controller authorised in writing. Access to personal data by the above-mentioned persons takes place solely for the purpose and in the scope specified by the Controller.

The Controller keeps records of persons authorised to process data. Persons who have been authorised to process data are obliged to keep secret the personal data and the methods of their protection.

The Controller and the persons authorised to process these data apply technical and organisational measures ensuring the protection of the personal data processed.

Your personal data may be made available to:

• state authorities and other entities authorised to access data in the scope and for the purpose specified in the provisions of law;
• other external entities providing the Controller with services supporting its functioning in the scope of the services provided, i.e. logistic, courier and transport companies, IT service providers, audit entities, entity providing accounting services, entities providing marketing services, entities supporting the sales and marketing process, entities providing legal services, payment processing entities, banks;

Your personal data will not be processed in an automated manner (including profiling) that may produce legal effects concerning you or similarly significantly affect your situation, except for the following processes whose detailed rules are indicated in their descriptions below: ‘online store’.

In connection with the processing of your personal data, in cases provided for in the provisions of law, you have the following rights:

• right of access to your personal data,
• right to request restriction of the processing of your personal data,
• right to your personal data portability,
• right to rectification of your personal data,
• right to erasure of your personal data,
• right to object to the processing of your personal data,
• right to withdraw consent to the processing of personal data in a situation where it constitutes the basis for data processing, which however does not affect the lawfulness of processing based on consent before its withdrawal
• right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office – (Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, tel. 22 531-03-00).

In order to exercise the above rights, please contact us at: contact@skintra.eu

Your data will not be transferred to third countries, unless the shipping address provided by you at the time of placing an order is located in a third country, in which case we transfer your data to our business partners in that third country, i.e. entities providing transport, courier, logistics, postal services. The transfer of your data to a third country is based on a decision of the European Commission on the adequate level of personal data protection. If no decision of the European Commission on the adequate level of personal data protection has been issued in respect of a given third country, the transfer to that third country takes place with the reservation that the appropriate safeguards referred to in Article 46(2) of the GDPR are ensured. Third countries are countries outside the European Economic Area. The European Economic Area covers all countries of the European Union and the countries of the European Free Trade Association, to which Norway, Iceland and Liechtenstein belong.

We collect your personal data:

• during the visit at www.skintra.eu,
• during the performance of the order,
• when establishing any contact, including answering your queries,
• during the implementation of the cosmetic consultation service,
• when delivering goods
• when you express your will to receive the newsletter,
• when processing payments,
• when preventing improper use of our website,
• during the process related to informing you about the re-availability of the product,
• when you express your will to receive e-books or other materials of a similar nature.

Purpose and basis of processing: Your personal data will be processed for the purpose of providing services by electronic means through:

• establishing and handling an account on the website www.skintra.eu (the basis for processing is Article 6(1)(b) of the GDPR),
• making with the user of the online store agreements for the sales of products ordered by the user in the online store www.skintra.eu as well as their performance (the basis for processing is Article 6(1)(b) of the GDPR),
• informing the user about the availability of the selected product (the basis for processing is Article 6(1)(a) of the GDPR),
• meeting legal obligations, in particular fulfilling the obligation to conduct financial reporting (the basis for processing is Article 6(1)(c) of the GDPR),
• returning and exchanging products as well as examining any complaints (the basis for processing is Article 6(1)(b) of the GDPR),
• exercising the Controller’s legitimate interest (the basis for processing is Article 6(1)(f) of the GDPR), which should be understood as:
• conducting direct marketing activities – due to specific provisions, actions via e-mail or phone number are carried out on the basis of a separate consent to the use of an appropriate communication channel,
• carrying out surveys concerning the satisfaction of the user of the online store www.skintra.eu with its functioning – due to specific provisions, actions via e-mail or phone number are carried out on the basis of a separate consent to the use of an appropriate communication channel,
• responding to your questions sent via contact forms at www.skintra.eu, e-mail, chatbot and telephone,
• establishing, pursuing or defending claims related to the functioning of www.skintra.eu, and services provided through the online store run at the indicated address.

Data processing time: Your data will be processed until:

• termination of the agreement for the provision of services by electronic means,
• statute of limitations for claims arising from the agreement provided by electronic means,
• statute of limitations for claims arising from the sales agreement,
• expiry of the period provided for in the Regulations of the online store www.skintra.eu for submitting and considering complaints or replacing the goods,
• lodging a reasoned objection in a situation when the basis for the processing of personal data is the legitimate interest of the Controller,
• expiry of the obligation to store data resulting from the provisions of law, in particular the obligation to store accounting documents concerning the sales agreement.

Are you obliged to submit to us your personal data?

• Submitting personal data by you is fully voluntary, however failure to submit them may prevent the Controller from providing services by electronic means and a potential Client from doing shopping in the online store www.skintra.eu.

• In order to ensure the most favourable, tailor-made, personalised offer for its Clients and users to whom the data relate, and the Controller, as well as in the case of the express consent of the data subject, the Data Controller may use ‘profiling’.
• The use of the online store www.skintra.eu is connected with the processing of the user’s personal data, which should be understood as the IP address or other identifiers and information collected through cookies or other similar technologies. The information collected in this way allows, due to their automatic processing (profiling), submitting to the user of the online store marketing contents adapted to their preferences/interests and offering them cosmetic products selected according to their needs. Personal data are stored for the duration of the session and deleted immediately after the end of the session. Some information (not being personal data) will be stored until the User deletes them on their own.
• Profiling in the online store consists in an automatic analysis or forecast of the behaviour of a given person on the website of the online store, e.g. by adding a specific Product to the cart, browsing the website of a particular Product in the online store, or by analysing the history of shopping done in the online store. We do not use your personal data for this purpose. We do not have knowledge who has done the shopping, we only know what products a person has viewed and added to the cart. If you delete cookies in your browser, we start collecting information from the beginning of your next visit to the store. We use data collected (not personal data) only to display products in frames. We do not send you discount codes or reminders about unfinished shopping.

Purpose and basis of processing: Your personal data will be processed for:

• Carrying out direct marketing activities (requests for expressing an opinion on products and services) – marketing activities via e-mail address or phone number are carried out based on a separate consent to the use of an appropriate communication channel under the Polish Act on provision of services by electronic means (Article 10) and the Polish Telecommunications Law (Article 172) (the legal basis for processing is Article 6(1)(a) of the GDPR),
• Defence against any legal claims for a violation of the personal data protection regulations, on the basis of Article 6(1)(f) of the GDPR,
• Answers to your questions sent via contact forms on www.skintra.eu, which constitutes a legitimate interest of the Controller (the legal basis for data processing is Article 6(1)(f) of the GDPR).

Data processing time: Your data will be processed:

• until the withdrawal of consent to sending marketing information by electronic means,
• after the withdrawal of consent for a period of up to 6 years in order to defend against possible legal claims.

Do you have to submit to us your personal data?

• Submitting personal data is voluntary, but without submitting them, receiving marketing information and answers to the questions in the contact form will not be possible.

The purpose and basis for the processing of your personal data will be:

• in the case of obtaining your data during the complaint process: acceptance, processing and realisation of a complaint lodged by you (the basis for processing is Article 6(1)(b) of the GDPR),
• in the case of obtaining your data within the process of returning or replacing the purchased goods: acceptance and realisation of the goods returned by you or replacement of the purchased goods (the basis for processing is Article 6(1)(b) of the GDPR),
• in relation to both processes, in order to:
• fulfil legal obligations, i.e. in particular to fulfil the obligation to maintain financial reporting (the basis for processing is Article 6(1)(c) of the GDPR),
• establish, defend and exercise claims related to the sales agreement, which should be understood as a legitimate interest of the controller (Article 6(1)(f) of the GDPR).

Data processing time: Your data will be processed:

• in relation to the complaint process – until the expiry of the warranty period or guarantee period,
• in relation to the process of return or replacement of the purchased goods – until the statute of limitations for claims resulting from the agreement in connection with which the return or replacement of the purchased goods has been made,
• in relation to both processes: until the expiry of the obligation to store data resulting from the provisions of law, in particular the obligation to store accounting documents.

Do you have to submit to us your personal data?

• Submitting personal data by you is voluntary, but it is necessary for the acceptance and processing of your complaint or the acceptance and realisation of the return or the replacement of the purchased goods in accordance with the return and complaint policy.

Purpose and basis of processing: Your personal data will be processed for the purpose of implementing the legitimate interest of the controller (Article 6(1)(f) of the GDPR), which should be understood as:

• handling correspondence by the Controller in connection with messages sent by clients, potential clients, representatives of the controller’s contractors and other persons or entities in paper or electronic form,
• replying to your questions sent via contact forms on www.skintra.eu,
• establishing and exercising possible claims or defending against possible claims.

Data processing time: Your data will be processed until:

• completing the exchange of correspondence or lodging an objection to the processing of data recognised by the Controller as justified. Moreover, the data will be processed for the period of limitation for potential claims.

Do you have to submit to us your personal data?

• Submitting personal data is voluntary, but necessary to communicate with you within correspondence.

Purpose and basis of data processing: Personal data will be processed in order to:

• place the Users’ comments and opinions on the purchased goods or visits to the store (the basis for processing is Article 6(1)(f) of the GDPR)
• fulfil the legitimate interest of the Controller (the basis for processing is Article 6(1)(f) of the GDPR), which should be understood as: establishing, exercising or defending claims connected with the functioning of www.skintra.eu, and services provided through the online store run at the indicated address.

Data processing time

• Personal data are processed until the Controller deletes the User’s comment or opinion at the User’s request or until the User lodges an objection to the processing of personal data pursuant to Article 21 of the GDPR, recognised by the Controller as justified.

Do you have to submit to us your personal data?

• Submitting personal data is voluntary, but necessary to place comments or opinions.

Purpose and basis of processing: Your personal data will be processed for:

• wperforming the agreement made with the Controller (in the case of personal data directly belonging to the contractor, the basis for processing is Article 6(1)(b) of the GDPR, and in the case of personal data of the contractor’s representatives, the basis for processing is Article 6(1)(f) of the GDPR, where the legitimate interest of the Controller is the need to ensure proper performance of the agreement),
• meeting legal obligations, in particular fulfilling the obligation to maintain financial reporting (the basis for processing is Article 6(1)(c) of the GDPR),
• establishing, exercising or defending claims connected with the performance of the agreement made with Cosibella sp. z o. o., (the basis for processing in this case is Article 6(1)(f) of the GDPR – while the legitimate interest of the Controller should be understood as the possibility to exercise or defend claims).

Data processing time: Your data will be processed until:

• expiry or termination of the agreement between the Controller and its contractor, and after its completion within the deadlines specified by the provisions of law, including accounting regulations,
• statute of limitations for any claims resulting from the agreement or actions aimed at making the agreement.

Do you have to submit to us your personal data?

• Submitting personal data is voluntary, but without submitting them, the performance of the agreement made with the Controller will not be possible.

Cookies are small text files installed on the device of the Client browsing the online store. Cookies collect information facilitating the use of the website – e.g. by remembering the user’s visits to the online store and their activities. A detailed description of cookies used on the website is available in the tool used to manage cookies (link available in the lower footer of the website called 'Manage cookies').

Moreover, the so-called third party cookies are also used to run the website, for instance to collect statistical data and data used to verify the manner of using websites by their users, and also to personalise marketing messages (e.g. by providing tailored advertisement on the basis of activity or retargeting of the user, i.e. providing the Client with a specific advertisement on other websites on the Internet).

Google Analytics is used for the above purposes. This is a publicly available tool applied to analyse the use of websites and to draw up reports on users’ activity. Google Analytics generates information about the URL address, type of browser used by the user, their IP address and the operational system used. The tool determines data concerning the number of visits on servers and their length as well as it collects data about individual parts of the visited website most frequently used by the user (analysing their functionality). Based on the analysis of the data obtained in this way, it is possible to determine the efficiency and usefulness of the websites and their particular parts, and then to direct the development of new services and functionalities.

Detailed information about Google Analytics can be found at the following address: Google Analytics Google Analytics
It should be borne in mind that in standard settings of your Internet browsers it is permissible to save files on your end devices, which allows the processing of data obtained in this way.

Users always have the possibility to change their settings concerning cookies on their own and at any time, determining the conditions for storing them and obtaining access by cookies to their end devices. The user may change the settings referred to in the previous sentence by means of the settings of the web browser or by means of the configuration of the above-mentioned service. Below you will find links to web browsers (including information on how to modify their settings on your end devices):

• Chrome
• Internet Explorer
• Firefox
• Opera
• Microsoft Edge
• Safari

These settings may be changed in particular in such a way as to block the automatic handling of cookies in the browser settings or to inform the user whenever cookies are placed on their device. Limiting the use of cookies may affect certain functionalities available on the website. Detailed information about the possibilities and ways of handling cookies are available in the settings of your software (web browser).

The following types of cookies are used within the website www.skintra.eu:

• ‘necessary’ cookies that allow the use of services available on the website, e.g. authentication cookies used for services that require authentication on the website, cookies that are used to provide security, e.g. used to detect abuse in the scope of authentication on the website,
• ‘performance’ cookies that allow the collection of information about the manner in which sites forming parts of the website are used,
• ‘functional’ cookies that allow ‘remembering’ the website settings selected by the user and personalising the interface, e.g. in the scope of the selected language or region, font size, website appearance, etc.,
• ‘marketing and advertising’ cookies that allow providing users of the website with advertising content more suited to their interests.

The Controller uses cookies to:

• maintain the User’s session (after logging in), due to which the User does not have to re-enter the login and password on each sub-site of the website,
• adjust the website to the User’s needs,
• create statistics concerning viewing individual sub-sites of the website,
• developing aggregated statistical data, measurement data and data about general trends in order to strengthen and optimise marketing, promotional and analytical activities,
• remembering data created as a result of using the Virtual Cosmetologist service by the User so that after each logging in to the account the User may use these data.

The Controller informs the User that they may disable cookies by changing the browser settings. Most frequently the appropriate option is in the privacy or settings tab of a given browser. The Controller informs the User that it will process, in accordance with the provisions of law in force in the territory of the Republic of Poland, data concerning the number (including IP) and type of the User’s end device, as well as the time of connection with the Website and other operational data concerning the User’s activity on the Website. The Controller does not have tools that will allow it to connect the IP with a specific User. These data are processed for technical purposes. The Controller declares that it will use its best endeavours to provide the User with a high level of security in the scope of using the Website by applying appropriate administrative, technical and physical safeguards of data against accidental or unlawful destruction, loss, unauthorised disclosure or provision. Unfortunately, no manner of transferring data via the Internet is fully secure. Any events affecting the security of the information transfer, including e.g. events concerning suspected provision of files containing harmful software, should be reported to the following address: contact@skintra.eu

Purpose and basis of processing:

• Your personal data will be processed in order to: provide you with the possibility to subscribe to our newsletter by providing an e-mail address and giving consent to the processing of your personal data for the purpose of sending commercial and marketing information by e-mail. In the newsletter we inform the Users about our latest offers (for example novelties, promotions or information concerning products from the offer of Cosibella.pl store) (the basis for processing is Article 6(1)(a) of the GDPR).

Data processing time: Your data will be processed:

• until the withdrawal of consent to sending the newsletter. You may resign at any time from the newsletter subscription by clicking on the link contained in the newsletter received or by sending an e-mail to the following address: contact@skintra.eu
• after the withdrawal of consent for a period of up to 6 years in order to defend against possible legal claims.

Do you have to submit to us your personal data?

• Submitting personal data is voluntary, but without submitting them, the newsletter subscription will not be possible.

Purpose and basis of processing: Your personal data will be processed for:

• providing you with the possibility to receive e-books or other similar materials by submitting an e-mail address and giving consent to: subscribing to our newsletter and processing your personal data for the purpose of sending commercial and marketing information by e-mail. In the newsletter we inform the Users about our latest offers (for example novelties, promotions or information concerning products from the offer of Cosibella.pl store). E-books or other similar materials will include information about the rules of care, cosmetic brands, cosmetic products and other similar messages related to the skin and hair care (the basis for processing is Article 6(1)(a) of the GDPR)

Data processing time: Your data will be processed:

• until the withdrawal of consent to sending the newsletter. You may resign at any time from the newsletter subscription by clicking on the link contained in the newsletter received or by sending an e-mail to the following address: contact@skintra.eu
• after the withdrawal of consent for a period of up to 6 years, solely for the purpose of defence against possible legal claims.

Do you have to submit to us your personal data?

• Submitting personal data is voluntary, but without submitting them, receiving e-books or other similar materials will not be possible. The condition for receiving e-books or other similar materials is to give consent to receiving the newsletter and to processing personal data for the purpose of sending commercial and marketing information by e-mail.

Cosibella sp. z o.o. has profiles in the following social media: Facebook, Instagram, YouTube, TikTok (hereinafter the ‘social media’), on which it publishes posts referring also to products of individual product brands. The administrators of social media record on their own their users’ behaviours by means of cookies and other similar technologies, also in the case of each interaction with Cosibella sp. z o. o. profiles The full scope and purposes of the processing of personal data in the social media are determined by their administrators.

Cosibella sp. z o.o. as an entity maintaining profiles has access to general statistics generated by the administrators of the social media, concerning interests and demographic data (such as age, gender, region) of users visiting the Cosibella sp. z o.o. profile.

Cosibella sp. z o.o. as an entity maintaining profiles is responsible for content placed there, as well as for communication with users of the social media – within these profiles.

Facebook and Instagram are administered by Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.

YouTube is administered by Google Inc. 1600 Amphitheatre Parkway, Mountain View, California, USA.

TikTok is administered by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Our website includes plugin for Facebook, Instagram and YouTube. Plugins of the social media are marked with their logo. These plugins will directly connect you with our profile in the selected social media. The social media may then obtain information that you have visited our website from your IP address. The indicated social media do not provide us with information about the data collected and the manner in which they are used. We do not know the purpose and scope of the data collected by them. In order to obtain additional information about privacy on these social media, please become acquainted with the privacy policy available on them, which sets out the rules for the processing of personal data on these social media.

• The Policy may be modified periodically. Modifications are aimed at taking into account changes in the Controller’s practices concerning handling personal data and strengthening the personal data protection system.
• Significant changes in the Policy will be indicated by means of well visible messages on www.skintra.eu. At the top of the website with the content of the Policy, there will be information about the date of its latest update.

• The User may at any time contact the Controller at the address: contact@skintra.eu to obtain information about whether and how the Controller uses or intends to use their personal data, as well as in the case of any questions or comments concerning this Policy.