PRIVACY POLICY

This Privacy Policy describes how www.beautytotepro.com (“we”, “us”, “our”, or the “Brand”) collects, uses, discloses, and protects your personal information when you visit or make a purchase from www.beautytotepro.com (the “Site”). We are committed to processing your data in strict compliance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and relevant European data privacy laws.

—

1. DATA CONTROLLER

For the purposes of applicable data protection legislation, www.beautytotepro.com operates as the data controller responsible for your personal information processed via this Site.

If you have any questions regarding this Privacy Policy or our privacy practices, you may contact our data controller representative at:

Brand: www.beautytotepro.com
Email: cases@beautytotepro.com

—

2. INFORMATION WE COLLECT

When you browse the Site or make a purchase, we collect certain personal information necessary to deliver our services, process orders, and maintain Site security. This includes:

Device & Usage Information: IP address, browser type, operating system, referring URLs, device identifier, time zone, and details of how you interact with the Site.
Order & Transaction Information: Full name, billing address, shipping address, contact email address, telephone number, and order details.
Payment Information: Payment card details, cardholder name, and transaction metadata. Payment transaction processing is handled securely by our third-party payment infrastructure provider, Stripe.

Performance of a Contract (Article 6(1)(b) GDPR): Processing required to fulfil your order, manage payments, arrange shipping, and manage customer communications.
Compliance with Legal Obligations (Article 6(1)(c) GDPR): Processing required to comply with statutory accounting, tax, and regulatory obligations.
Legitimate Interests (Article 6(1)(f) GDPR): Processing necessary to secure our Site, prevent commercial fraud, optimize user experience, and defend our legal rights.
Consent (Article 6(1)(a) GDPR): Processing carried out where you have granted explicit consent, such as subscribing to electronic marketing communications or accepting functional website cookies.

Payment Processing: All online payment processing is executed securely via Stripe. Your sensitive payment credentials are collected and processed directly by Stripe under their proprietary security infrastructure and privacy standards. We do not store or process unencrypted payment card numbers on our servers.
Logistics & Order Delivery: Essential details (recipient name, delivery address, contact email) are provided to our shipping and postal partners solely to execute order delivery.
IT & Platform Support: Analytics and web hosting providers process technical usage data to sustain Site connectivity and performance.

All third-party processors are bound by contractual obligations to ensure appropriate technical and organizational measures are implemented to safeguard your data.

—

5. INTERNATIONAL DATA TRANSFERS

Where data transfers outside the European Economic Area (EEA) occur through our operational partners or technical service providers, we ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR. These safeguards include relying on European Commission Adequacy Decisions or implementing standard contractual clauses (SCCs) to ensure equivalent protection standards.

—

6. DATA RETENTION PERIODS

We retain your personal data only for as long as necessary to fulfil the operational purposes outlined in this policy or as mandated by mandatory statutory retention obligations under applicable European law:

Order & Commercial Transaction Records: Retained for up to 10 years following completion of the transaction, pursuant to statutory commercial and tax record-keeping legislation.
Customer Enquiry Records: Retained for up to 24 months from the date of resolution, after which the data is archived or deleted.
Technical Log Files & Web Analytics: Retained for a maximum of 12 months for diagnostic and security auditing purposes.
Direct Marketing Consents: Retained until you withdraw your consent or exercise your right to unsubscribe.

Upon expiry of the designated retention periods, relevant personal data is permanently destroyed or securely anonymized.

—

7. DATA SECURITY MEASURES

We implement robust administrative, technical, and physical safeguards appropriate to the risk of data processing. These measures are designed to guard against loss, unauthorized access, alteration, or disclosure of personal data.

While we employ industry-standard protocols to protect personal data during transmission and storage, no online communication channel or digital storage system can be declared entirely immune to external risk. Users are advised to exercise care when transmitting information electronically.

—

8. YOUR LEGAL RIGHTS UNDER GDPR

Subject to statutory conditions under European data protection laws, you possess the following rights regarding your personal data:

Right of Access: You may request confirmation as to whether we hold personal data concerning you and obtain a copy of such data.
Right to Rectification: You may request correction of inaccurate or incomplete personal records.
Right to Erasure (“Right to be Forgotten”): You may request deletion of personal data where processing is no longer required or lacks a lawful ground.
Right to Restrict Processing: You may request that processing activities be suspended under specific statutory scenarios.
Right to Data Portability: You may request a structured, commonly used machine-readable copy of the personal data provided to us based on consent or contract.
Right to Object: You may object at any time to the processing of personal data grounded upon legitimate interests or direct marketing.
Right to Withdraw Consent: Where processing relies on consent, you retain the right to withdraw consent at any time without affecting prior lawful processing.

Brand: www.beautytotepro.com
* Email: cases@beautytotepro.com