Privacy policy
License number issued by Kreator Legal Geek: 10a2f92b-85b0-469c-b1f5-8b0da6c0f05e.
Privacy Policy of the SkinVibe Store
skinvibe.pl / skinvibe.eu / skinvibe.uk / skinvibe.global
("Store")
Dear User!
We care about your privacy and want you to feel comfortable while using our services. Below you will find the most important information about the rules governing the processing of your personal data and the cookies used by our Store. This information has been prepared in accordance with the GDPR, i.e. the General Data Protection Regulation.
DATA CONTROLLER
ITRG-ZIĘBA-MAGIERA-STYLIŃSKI SPÓŁKA JAWNA (general partnership) with its registered office at Christo Botewa 6B/B4, 30-798 Cracow, Poland, entered in the National Court Register - Register of Entrepreneurs by the District Court for Kraków-Śródmieście in Cracow, 11th Commercial Division of the National Court Register, under KRS number 0000890294, VAT ID: PL9452174051, REGON: 122875190.
If you wish to contact us regarding the processing of your personal data, please write to us at: contact@skinvibe.eu.
YOUR RIGHTS
You have the right to request:
- access to your personal data, including obtaining a copy of your data (Art. 15 GDPR or - if applicable - Art. 13(1)(f) GDPR),
- rectification of your data (Art. 16 GDPR),
- erasure of your data (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability to another controller (Art. 20 GDPR).
You also have the right to:
- object at any time to the processing of your data:
- on grounds relating to your particular situation - against the processing of your personal data based on Art. 6(1)(f) GDPR (i.e. our legitimate interests), including profiling (Art. 21(1) GDPR);
- where personal data are processed for direct marketing purposes, including profiling, to the extent that processing is related to such direct marketing (Art. 21(2) GDPR).
Please contact us if you wish to exercise your rights. You can change or withdraw your consent to cookies (described below) at any time using the „Cookie settings” link in the Store footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Do not want to be on the customer lists we use for ads on Facebook, Instagram, Google and TikTok? Write to contact@skinvibe.eu (EU) or contact@skinvibe.global (other countries). We will remove you from these lists within 14 days.
If you believe that your data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland, or with your local supervisory authority.
PERSONAL DATA AND PRIVACY
Below you will find detailed information on the processing of your data depending on the actions you take.
1. Placing an order in the Store - part 1
| Purpose | |
|---|---|
| fulfilment of your order | |
| Legal basis | |
| sales contract (Art. 6(1)(b) GDPR) | legal obligation, particularly related to accounting and product safety, requiring us to process your personal data (Art. 6(1)(c) GDPR) |
| Retention period | |
| for the duration of the above-mentioned contract | until the expiry of legal obligations incumbent upon us |
| furthermore, your data will be processed until the expiry of the limitation period for claims - by you or by us (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) |
|
| What happens if you do not provide data? | |
| you will not be able to place an order | |
2. Placing an order in the Store - part 2
| Purpose |
|---|
| asking for a review of the purchased product (by email and, if you have consented to text messages, also by SMS) and publishing reviews in the Store through a review collection service; reviews help us improve our products and service |
| Legal basis |
| our legitimate interest in processing your data to conduct satisfaction surveys regarding our services (Art. 6(1)(f) GDPR) |
| Retention period |
| if you do not submit a review - for 13 months from your purchase, or until we accept your objection to processing; if you do submit a review - until it is deleted, or until we accept your objection to processing* |
| furthermore, your data will be processed until the expiry of the limitation period for claims - by you or by us (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) |
| What happens if you do not provide data? |
| we will not take your feedback into account in our efforts to further develop our services |
3. Creating an account in the Store
| Purpose |
|---|
| performance of the contract for the provision of account management services in the Store |
| Legal basis |
| service provision contract (Art. 6(1)(b) GDPR) |
| Retention period |
| for the duration of the above-mentioned contract |
| furthermore, your data will be processed until the expiry of the limitation period for claims - by you or by us (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) |
| What happens if you do not provide data? |
| you will not be able to create an account and use its features, such as viewing order history or checking order status |
4. Contacting us (e.g. to ask a question)
| Purpose | |
|---|---|
| handling your enquiries or requests | |
| Legal basis | |
| contract or actions taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) - where your enquiry or request relates to a contract to which we are or may become a party | our legitimate interest in processing your data for the purpose of communicating with you (Art. 6(1)(f) GDPR) - where your enquiry or request is not related to a contract |
| Retention period | |
| for the duration of the binding contract or - if the contract is not concluded - until the expiry of the limitation period for claims (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code)* | until the expiry of the limitation period for claims (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) - or until we accept your objection to processing* |
| furthermore, your data will be processed until the expiry of the limitation period for claims - by you or by us (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) |
|
| What happens if you do not provide data? | |
| we will not be able to respond to your enquiry or request | |
5. Consent to marketing cookies
| Purpose |
|---|
| measuring the effectiveness of our advertising (e.g. whether a purchase followed an ad click) and showing you ads tailored to your interests on our advertising partners' services (you can read more in the „Profiling”, „Cookies” and „Sharing purchase data with advertising partners” sections of this Privacy Policy) |
| Legal basis |
| your consent (Art. 6(1)(a) GDPR) given in the cookie banner; storing information on your device and accessing it is based on your consent (Art. 399(1) of the Polish Electronic Communications Law, implementing Art. 5(3) of the ePrivacy Directive) |
| Retention period |
| until you withdraw your consent, and no longer than 12 months from when it was given (after that we will ask you again); the validity periods of individual cookies are listed in the cookie settings on our website |
| What happens if you do not provide data? |
| we will not measure ad effectiveness based on your visit, and the ads you see will not be tailored to your interests |
6. Consent to statistics cookies
| Purpose |
|---|
| analysis of how you use and navigate the Store website, in order to improve its functionality (you can read more in the „Analytical activities” and „Cookies” sections of this Privacy Policy) |
| Legal basis |
| your consent (Art. 6(1)(a) GDPR) given in the cookie banner; storing information on your device and accessing it is based on your consent (Art. 399(1) of the Polish Electronic Communications Law, implementing Art. 5(3) of the ePrivacy Directive) |
| Retention period |
| until you withdraw your consent, and no longer than 12 months from when it was given (after that we will ask you again); we keep statistical data in Google Analytics for no longer than 14 months from your last visit, and a copy in the Google BigQuery data warehouse (servers in the European Union) for no longer than 26 months |
| What happens if you do not provide data? |
| we will not take into account how you use and navigate the Store website in our efforts to develop it further |
7. Giving your consent to receive marketing content from us (e.g. information about special offers)
| Purpose | |
|---|---|
| sending marketing information, especially special offers | analysis of the effectiveness of messages sent by us, in order to establish general principles for effective messaging in our business (you can read more about this in the "Analytical activities" section of this Privacy Policy) |
| Legal basis | |
| your consent to our marketing activities (Art. 6(1)(a) GDPR) | our legitimate interest in processing data for the above-mentioned purpose (Art. 6(1)(f) GDPR) |
| Retention period | |
| until you withdraw your consent - remember, you can withdraw your consent at any time. Processing of data up to the moment of withdrawal remains lawful. | until we accept your objection to processing |
| furthermore, your data will be processed until the expiry of the limitation period for claims - by you or by us (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) |
|
| What happens if you do not provide data? | |
| you will not receive our marketing materials, including information about our special offers | |
8. Subscribing to the newsletter
| Purpose | |
|---|---|
| sending the newsletter containing information about products, promotions and news in the Store | analysis of the effectiveness of content sent by us, in order to establish general principles for effective messaging in our business (you can read more about this in the "Analytical activities" section of this Privacy Policy) |
| Legal basis | |
| your consent (Art. 6(1)(a) GDPR) given by subscribing to the newsletter | our legitimate interest in processing data for the above-mentioned purpose (Art. 6(1)(f) GDPR) |
| Retention period | |
| until you withdraw your consent (unsubscribe from the newsletter) - remember, you can withdraw your consent at any time. Processing of data up to the moment of withdrawal remains lawful. | until we accept your objection to processing |
| furthermore, your data will be processed until the expiry of the limitation period for claims - by you or by us (usually 6 years, or 3 years for claims related to business activity, counted to the end of the calendar year - Art. 118 of the Polish Civil Code) |
|
| What happens if you do not provide data? | |
| you will not be able to receive information about the Store and our services | |
When subscribing to the newsletter via the form, in addition to your email address, we automatically record the technical context of the subscription (such as language, market and form source) for the purpose of personalising the content sent to you.
9. Taking action or omission that may give rise to claims related to the Store or our services
| Purpose |
|---|
| establishing, pursuing or defending potential claims related to a concluded contract or services provided |
| Legal basis |
| our legitimate interest in processing personal data for the above-mentioned purpose (Art. 6(1)(f) GDPR) |
| Retention period |
| until the expiry of the limitation period for claims, or until we accept your objection to processing* |
| What happens if you do not provide data? |
| it will not be possible to establish, pursue or defend claims |
10. Geolocation and language preferences
| Purpose |
|---|
| detecting your approximate location (country) based on your IP address to suggest the most appropriate version of the Store (skinvibe.pl, skinvibe.eu, skinvibe.uk, or skinvibe.global) with the correct currency, language, and shipping options. Your country and language preferences may be shared with our email marketing provider (Klaviyo) for communication personalisation. |
| Legal basis |
| our legitimate interest in ensuring the correct operation of our international store (Art. 6(1)(f) GDPR). The IP address is processed transiently and is not stored. Preference cookies require your consent (category: functional). |
| Retention period |
| IP address: processed transiently, not stored. Preference cookies: 60 days from the moment you express your preference. |
| What happens if you do not provide data? |
| you can browse the Store without restrictions; however, we will not be able to suggest the Store version best suited to your location |
11. Signing up for SMS or WhatsApp messages
| For what purpose? | |
|---|---|
| sending information about our products, launches, offers, product availability, reminders about an unfinished order and delivery deadlines, and requests to review a purchased product - by SMS (including the RCS format) or via WhatsApp, to the phone number you provided | |
| On what basis? | |
| your consent (Art. 6(1)(a) GDPR) - given separately from the consent to e-mail messages (at the Store checkout, in the sign-up form or in a WhatsApp conversation); commercial information is sent to a phone number in accordance with Art. 398 of the Polish Electronic Communications Law | |
| For how long? | |
| until you withdraw your consent - remember, you can withdraw your consent at any time. Processing carried out until the withdrawal remains lawful. In addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us | |
| What happens if you do not provide the data? | |
| you will not receive SMS or WhatsApp messages from us | |
| Who do we share your phone number with? | |
| the technical providers needed to deliver the messages: Klaviyo, Inc. (messaging platform), telecommunications operators and Meta Platforms Ireland Ltd. (WhatsApp). We do not sell or rent your phone number or your consent and do not share them with anyone for their own marketing. If you give the same number when placing an order, it may be shared with advertising partners in hashed form - as described in the „Sharing purchase data with advertising partners” and „Customer lists in advertising” sections. | |
| How to withdraw consent? | |
| SMS: an unsubscribe link in every message; WhatsApp: reply “STOP” in the conversation; in both cases you can also write to contact@skinvibe.eu. The rules of sending are described in the SMS and WhatsApp Messages Terms (in Polish) |
12. Post-purchase survey answers (“Thank you” page)
| For what purpose? | |
|---|---|
| learning how customers find out about the Store (including, if you tell us, who recommended the Store to you, e.g. a content creator's account name), what almost stopped them from buying and which other brands they considered, in order to improve the Store, plan advertising better and assess our work with content creators; answers are saved with your order and analysed in aggregate | |
| On what basis? | |
| our legitimate interest in analysing the effectiveness of our marketing and improving the Store (Art. 6(1)(f) GDPR) | |
| For how long? | |
| up to 24 months from the purchase or until we accept your objection; after that we delete the answer from the order and use only aggregate data that is not linked to you | |
| What happens if you do not provide the data? | |
| nothing - answering is voluntary and does not affect your order; please do not enter health information or other people's data in the text fields, except the name of the person or account that recommended the Store to you | |
| If someone named you in an answer | |
| if someone named you in a survey answer as the person who recommended the Store (e.g. as a content creator), we process your name or account name for the same purpose, on the same basis and for the same period; you can object by writing to contact@skinvibe.eu |
13. Customer lists in advertising (Meta, Google, TikTok)
| For what purpose? | |
|---|---|
| so that we do not show ads for a product to people who have already bought it, so that we can show our customers and newsletter subscribers ads for products that suit them (e.g. a new product for owners of our hair dryers), and to reach new people similar to our customers (more in the „Customer lists in advertising” section) | |
| On what basis? | |
| our legitimate interest in direct marketing of our products to our customers and subscribers and in not showing ads to people who have already bought the product (Art. 6(1)(f) GDPR) | |
| For how long? | |
| as long as you belong to the group concerned (e.g. you are our customer or a newsletter subscriber) and have not objected; Meta deletes the uploaded data after matching, and Google keeps you on a list for no longer than 540 days from the list's last update | |
| What happens if you do not provide the data? | |
| nothing - you do not need to do anything; if you object, we will not add your data to the lists, and the ads you see will not use our customer lists. To stop the sharing of data about your visits and purchases with advertising partners, which takes place when you have consented to marketing cookies (see the „Sharing purchase data with advertising partners” section), withdraw this consent separately using the „Cookie settings” link in the Store footer | |
| How to object? | |
| write to contact@skinvibe.eu (EU) or contact@skinvibe.global (other countries) - one sentence is enough: „Please do not add me to advertising lists”. We will remove you from all lists within 14 days and will not add you again. An objection to direct marketing does not need a reason |
DATA PUBLICATION
If you decide to publish a comment, its content and your signature will be visible to other users of the Store.
We do not disclose your email address to other users - unless you do so yourself.
PROFILING
We carry out profiling within the Store. Profiling based on cookies applies to you only if you consent to marketing cookies. This profiling consists of an automatic assessment of which products or services you may be interested in, using information about the content you view. As a result, advertisements for products or services displayed within the online services you use will be better tailored to you and your needs.
Furthermore, if you subscribe to the newsletter or consent to receive marketing content, our email marketing provider may carry out automated analysis of your data (such as purchase history, message open rates, product preferences) for the purpose of personalising the content sent to you - e.g. selecting recommended products or determining the optimal time for sending messages.
If you have bought from the Store or subscribe to our newsletter, we may also assign you to a group (e.g. „hair dryer owners”) and share that group with advertising services, to show you or skip a given ad, or to find people similar to our customers (see „Customer lists in advertising”). You can object to this at any time.
The profiling we carry out does not result in decisions that produce legal effects concerning you or similarly significantly affect you. You have the right to object to profiling at any time pursuant to Art. 21 GDPR.
ANALYTICAL ACTIVITIES
Within the Store website, we carry out analytical activities aimed at increasing its intuitiveness and accessibility - this will apply to you only if you consent to statistics cookies. As part of the analysis, we will take into account how you use and navigate the Store - for example, how much time you spend on a given subpage, or which areas of the Store you click on. This will allow us to optimise the layout, appearance and content of the Store during its development, in order to improve its functionality.
Furthermore, if you express a wish to receive marketing messages or newsletters from us, we may analyse the effectiveness of our mailings. For example, we may check whether and how they influenced activity in our Store. Such activities will help us establish general principles for sending such messages in our business - e.g. regarding optimal sending times or how to formulate effective content.
Checkout analytics. When you open the Store checkout, we check how placing the order goes, so that we can quickly detect and fix errors that make it harder. This analytics runs regardless of your cookie settings, because it serves the proper functioning of the checkout you use when placing an order. We record:
- which checkout steps you go through;
- which error messages are displayed (e.g. about an invalid discount code or a failed payment) and whether any part of the checkout stopped working;
- which delivery and payment method you choose and whether you use a discount code;
- which products are in the cart and its approximate value;
- the Store version (country, language) and the type of device and browser;
- whether the order was placed.
We do not record your first name, last name, email address, phone number, address or anything you type into the checkout form. We store the checkout identifier only as an encrypted hash (pseudonymisation).
The legal basis is our legitimate interest in ensuring that the checkout works properly (Art. 6(1)(f) GDPR). Reading this information from your device is necessary to provide the service you request (Art. 399(3) of the Polish Electronic Communications Law). You may object to this processing at any time (Art. 21 GDPR) as described in the "Your rights" section.
We keep the data for no longer than 13 months in the database of the provider Supabase Pte. Ltd. (Singapore), on servers in the European Union (Frankfurt). The provider may access it from outside the European Union on the basis of Standard Contractual Clauses (SCC). The provider keeps technical connection data (IP address, country, browser) in its logs for 7 days.
DATA SECURITY
When processing your personal data, we apply organisational and technical measures in accordance with applicable laws, including the use of SSL/TLS certificate encryption.
COOKIES
Our Store, like most websites, uses cookies and similar technologies such as browser storage (local storage) and pixels, together referred to as „cookies”. They are stored on your device (computer, phone, etc.) and do not change its settings. They may be set by us or by the service providers we use (listed below).
How do you give consent? On your first visit we show a cookie banner. You can accept all categories, reject all cookies other than essential ones, or choose categories under „Preferences”. If you close the banner with the X button or press the Esc key while the banner is displayed, we will treat this as consent to all cookie categories. Until you decide, we use essential cookies only. We remember your choice for 12 months. You can change it or withdraw your consent at any time using the „Cookie settings” link in the Store footer. Your choice is saved separately for each version of the Store (skinvibe.pl, skinvibe.eu, skinvibe.global).
Cookie categories:
- Essential (no consent needed, Art. 399(3) of the Polish Electronic Communications Law) - cart and checkout, detecting errors in the checkout (checkout analytics, described in the "Analytical activities" section), account login, security and bot protection, Store currency and language, remembering your banner choice. Set by: Shopify, Consentmo, Cloudflare and us (checkout analytics).
- Preferences (functional) (consent required) - remembering your country and language (Orbe), playing embedded YouTube videos, remembering your review votes (Judge.me), saving your progress in the product quiz.
- Statistics (consent required) - Google Analytics, Shopify analytics, Judge.me review widget statistics.
- Marketing (consent required) - Google Ads, YouTube, Meta (Facebook, Instagram), TikTok, OpenAI (ads in ChatGPT), Klaviyo (recognising newsletter subscribers and tailoring messages), Shopify (marketing consent and measurement).
The full, up-to-date list of cookies with providers and validity periods is available in the cookie settings („Cookie settings” link in the footer, „Preferences” tab). They are also described on our Cookie policy page.
Google Consent Mode. We use Google Consent Mode in its advanced version. Google Analytics and Google Ads tags load straight away, but until you give consent (including if you refuse), they do not store or read Google cookies (e.g. _ga, _gcl_au) and send Google only signals without identifiers from these cookies: your choice in the cookie banner, the address of the page you are visiting and of the referring page, the time, browser information, your IP address (which Google does not store in full) and the Google ad click identifier (gclid), which we carry between pages of the Store in the page address. Google uses these signals to estimate (model) conversions from ads. The legal basis is our legitimate interest in measuring the effectiveness of our ads (Art. 6(1)(f) GDPR). Once you give consent, the tags work fully, with the cookies described below.
The main cookies used in the Store and their validity periods:
| cookie name | validity period | cookie function |
|---|---|---|
| cookieconsent_status, cookieconsent_preferences_disabled, _tracking_consent | up to 12 months | Consentmo and Shopify - remembering your banner choice (essential) |
| cart, cart_sig, _shopify_essential, localization, cart_currency | session / up to 1 year | Shopify - cart, checkout, language and currency (essential) |
| __cf_bm, _cfuvid | session / up to 30 min | Cloudflare - bot protection (essential) |
| mdApp_countryCodeDomain, mdApp_showRecommendationLang | 60 days | Orbe - remembering your country and language (functional) |
| _ga, _ga_* | up to 2 years | Google Analytics - website traffic statistics (statistics) |
| _shopify_analytics, _shopify_y, _shopify_s | up to 1 year | Shopify - store statistics (statistics) |
| _gcl_au, _gcl_ls, IDE | 90 days / up to 13 months | Google Ads - ad conversion measurement (marketing) |
| YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA | session / up to 6 months | YouTube - embedded videos (marketing) |
| _fbp, _fbc | 90 days | Meta Pixel - ad conversion measurement (marketing) |
| _ttp, ttcsid, ttcsid_* | session / up to 13 months | TikTok Pixel - ad conversion measurement (marketing) |
| __oaiq_consent, oaiq_consent | up to 1 year | OpenAI - ad conversion measurement in ChatGPT (marketing) |
| __kla_id | 2 years | Klaviyo - email marketing profile recognition (marketing) |
| _shopify_marketing | up to 1 year | Shopify - marketing consent and measurement (marketing) |
You can also delete or block cookies in your browser settings. Instructions are available here:
Deleting cookies in your browser does not replace changing your choice in the banner: we will ask you again on your next visit.
SHARING PURCHASE DATA WITH ADVERTISING PARTNERS
If you consent to marketing cookies, the Store also sends information about your visit and purchase to advertising partners from a server (the Shopify platform or the partner's conversions API gateway acting as an intermediary), not only from your browser. This keeps ad measurement working even when your browser blocks pixels. Without your consent we do not share this data.
| Purpose |
|---|
| measuring the effectiveness of our advertising and settling campaigns |
| Data |
| event type (e.g. product view, add to cart, purchase), order number, date and value, products purchased, the partner's cookie identifiers (e.g. the ad click identifier), IP address and browser information, and, in hashed form (transformed with SHA-256): your email address, phone number, first and last name, and city, postal code, region and country. Hashing makes the data harder to read but does not make it anonymous: the partner can match it to an account on its service. |
| Legal basis |
| your consent (Art. 6(1)(a) GDPR). If you do not consent or withdraw your consent, we do not share this data about your further visits and purchases. |
| Recipients |
|
Meta Platforms Ireland Ltd. (Dublin, Ireland) - via the Conversions API. For the collection and transmission of this data we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR): we are responsible for collecting the data in the Store and transmitting it, and Meta is responsible for its further processing. Meta makes the essence of the arrangement available at https://www.facebook.com/legal/controller_addendum. You can exercise your rights against us or against Meta. OpenAI Ireland Ltd. (Dublin, Ireland) - via the ChatGPT ads conversion measurement interface. OpenAI processes this data as a separate controller, as described in its privacy policy: https://openai.com/policies/privacy-policy. TikTok Technology Limited (Dublin, Ireland) - via the TikTok Pixel and the Events API (TikTok app in the Store), with advanced matching, and, for purchases made through the Store checkout opened inside the TikTok app, also information about that purchase. For the collection and transmission of this data we are joint controllers with TikTok: we are responsible for collecting the data in the Store and transmitting it, and TikTok is responsible for its further processing, including creating audiences and showing ads, which it does as a separate controller. The rules are set out in TikTok's terms: https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms. You can exercise your rights against us or against TikTok. Google Ireland Ltd. (Dublin, Ireland) - measurement of purchases from Google ads, described below, also through the Google & YouTube app in the Store (enhanced conversions: your hashed email address and phone number at purchase). Google uses this data as our processor, solely to measure the effectiveness of our ads. |
| Retention period |
| for the retention period set by the partner for ad measurement; sharing of data about further events stops when you withdraw your consent |
Measuring purchases from Google ads
If you consent to statistics or marketing cookies and there is a product in your cart, we record in the cart (in fields not visible on the page) and, once the order is placed, also in the order: information on which cookie categories were consented to, the browser and session identifier assigned by Google Analytics (with consent to statistics cookies), and the Google ad click identifier (gclid, gbraid or wbraid) together with information about arriving on the website from an ad: campaign parameters, visit start time, landing page address, referring page address and browser type (with consent to marketing cookies). This information is used to attribute the order to the ad whose click led to the visit to the Store. If you have consented to marketing cookies at the time of purchase, we send Google Ireland Ltd. from our server the order number, date and value, the ad click identifier and your email address and phone number in hashed form, together with information about your consent. Google uses this data as our processor, under the Google Ads data processing terms, solely to measure the effectiveness of our ads. We do not send orders without marketing consent. The legal basis is your consent (Art. 6(1)(a) GDPR; storing and accessing information in your browser: Art. 399(1) of the Polish Electronic Communications Law). If you withdraw your consent before placing the order, we remove this information from the cart. Information recorded in the order is kept for as long as the order (point 1).
CUSTOMER LISTS IN ADVERTISING
We show SkinVibe ads on Meta services (Facebook, Instagram), Google services (Search, YouTube, Gmail) and, when we run campaigns there, TikTok. To make sure an ad reaches the right people, or skips people who have already bought, we share lists of our customers with these services. This does not use cookies.
Who is on the lists? The lists include people who have bought from the Store, also without subscribing to the newsletter (e.g. owners of our hair dryers or straighteners, people who have not shopped for a while), and newsletter subscribers (including people who completed our product quiz). Unsubscribing from the newsletter removes you from the lists of newsletter subscribers, but not from the lists of people who have bought. We will remove you from all lists if you object (see below, „Legal basis and your choice”).
What data? Your email address and, on some services, also your phone number, if you have provided it. Before the data leaves our systems, it is hashed (transformed with SHA-256). Hashing makes the data harder to read but does not make it anonymous: the service compares the hashes with its users' accounts. We do not share what exactly you bought, only that you belong to a given group.
How does it work?
- Exclusion - if you have bought a product, we will not show you its ad again.
- Ads for our customers - if you have bought from the Store or subscribe to our newsletter, you may see an ad for a matching new product or offer.
- Similar audiences - based on a list, Meta and Google may look for other people with similar characteristics. We receive no data about you or about those people, only aggregate campaign results.
Who sends and who receives? The lists are sent by our email marketing provider Klaviyo, Inc. They are received by:
- Meta Platforms Ireland Ltd. (Dublin, Ireland) - matches the list on our instructions, as a processor (Meta's Customer List Custom Audiences Terms: https://www.facebook.com/legal/terms/customaudience), and deletes the uploaded data after matching;
- Google Ireland Ltd. (Dublin, Ireland) - matches the list as our processor under the Google Ads data processing terms;
- TikTok Technology Limited (Dublin, Ireland) - when we run TikTok campaigns; matches the list as a processor.
Meta, Google and TikTok display the ads on their services under their own privacy policies. Transfers outside the EU are described in the recipients table below.
Legal basis and your choice. The legal basis is our legitimate interest in direct marketing of our products (Art. 6(1)(f) GDPR, Recital 47 GDPR). You can object at any time without giving a reason: write to contact@skinvibe.eu (EU) or contact@skinvibe.global (other countries), and we will remove you from all lists within 14 days and will not add you again. You can also hide a specific advertiser's ads in the ad settings of Facebook, Instagram, Google and TikTok.
EXTERNAL SERVICES / DATA RECIPIENTS
We use the services of external entities that support us in conducting our business. We entrust most of them with your data for processing - they process it only on our documented instructions. Exceptions (joint controllership or a separate controller) are described next to the recipient concerned.
Below you will find a list of recipients of your data:
| ACTION | DATA RECIPIENTS | TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION |
|---|---|---|
| any activity related to the Store | Shopify Inc. (Ottawa, Canada) - e-commerce platform | yes - Canada (European Commission adequacy decision) + Standard Contractual Clauses (SCC) |
| entity providing technical/IT support | does not take place | |
| persons cooperating with us on the basis of civil law contracts, supporting our ongoing business activities | does not take place | |
| BaseLinker Sp. z o.o. (Poland) - sales management software | does not take place | |
| hosting provider | does not take place | |
| consent to marketing cookies | Google Ireland Ltd. (Dublin, Ireland) and Google LLC (Mountain View, USA) - Google Ads, YouTube | yes - USA (EU-US Data Privacy Framework) |
| Meta Platforms Ireland Ltd. (Dublin, Ireland) and Meta Platforms, Inc. (Menlo Park, USA) - advertising, remarketing, Conversions API (joint controllership, see the „Sharing purchase data with advertising partners” section) | yes - USA (EU-US Data Privacy Framework) | |
| TikTok Technology Limited (Dublin, Ireland) - advertising, TikTok Pixel and Events API (joint controllership, see the „Sharing purchase data with advertising partners” section) | yes - including the USA and Singapore, and remote access from China (Standard Contractual Clauses SCC) | |
| OpenAI Ireland Ltd. (Dublin, Ireland) - ad measurement in ChatGPT (separate controller) | possible - USA (OpenAI Ireland Ltd. transfers data under the mechanisms of Chapter V GDPR) | |
| Klaviyo, Inc. (Boston, USA) - recognising newsletter subscribers and tailoring messages | yes - USA (EU-US Data Privacy Framework) | |
| customer lists in advertising (point 13) | Meta Platforms Ireland Ltd. (Dublin, Ireland) - list matching (processor); Google Ireland Ltd. (Dublin, Ireland) - list matching (processor); TikTok Technology Limited (Dublin, Ireland) - list matching (processor), only when we run TikTok campaigns; Klaviyo, Inc. (Boston, USA) - sending the lists | yes - USA (EU-US Data Privacy Framework); TikTok: Standard Contractual Clauses SCC |
| consent to statistics cookies | Google Ireland Ltd. (Dublin, Ireland) and Google LLC (Mountain View, USA) - Google Analytics and Google BigQuery (copy of statistical data on servers in the European Union) | yes - USA (EU-US Data Privacy Framework) |
| Judge.me (New Zealand) - review widget statistics | yes - New Zealand (European Commission adequacy decision) | |
| displaying the cookie banner and recording your choice | iSense Ltd. (Sofia, Bulgaria), trading as Consentmo - consent management; the consent record includes a consent identifier, your choice, date and time, browser and device information, approximate region, language and the IP address or information derived from it; records are kept for 12 months | does not take place (data stored in the EU, Amsterdam); sub-processors outside the EU only under a European Commission adequacy decision, the EU-US Data Privacy Framework or SCC |
| chat on the Store website, product availability notifications and pre-orders | Shopify Inc. (Ottawa, Canada) - website chat (Shopify Inbox) | yes - Canada (European Commission adequacy decision) + Standard Contractual Clauses (SCC) |
| Notify Me! Software Ltd. (Vancouver, Canada) - product availability notifications and pre-order handling (Notify Me! app) | yes - Canada (European Commission adequacy decision) | |
| geolocation and Store version personalisation | Mushdesk S.L. (Madrid, Spain) - provider of the Orbe geolocation service | does not take place |
| placing an order in the Store | payment provider (PayU S.A., PayPo Sp. z o.o. - Poland) | does not take place |
| entity delivering the product to you (InPost, DPD, Orlen Paczka and others) | does not take place | |
| accounting software provider | does not take place | |
| accounting office | does not take place | |
| Google Cloud Poland Sp. z o.o. (Warsaw, Poland) and Google LLC (Mountain View, USA) - Google Workspace: mailboxes and standard office software | yes - USA (EU-US Data Privacy Framework) and other countries where Google and its sub-processors may process data (European Commission adequacy decision or Standard Contractual Clauses SCC); you can find the list of these countries and sub-processors on Google's website: Google Workspace sub-processors | |
| subscribing to the newsletter or consenting to receive marketing messages | Klaviyo, Inc. (Boston, USA) - email, SMS and WhatsApp marketing platform | yes - USA (EU-US Data Privacy Framework) |
| consent to WhatsApp messages | Meta Platforms Ireland Ltd. (Dublin, Ireland) - operator of the WhatsApp service | yes - USA (EU-US Data Privacy Framework) |
| using services provided to us in connection with the Store by social media platforms | social media platforms (Meta, TikTok, Google/YouTube) | yes - see above |
| request for a product review (email, SMS) | Klaviyo, Inc. (Boston, USA) - sending review requests | yes - USA (EU-US Data Privacy Framework) |
| participating in a satisfaction survey regarding our services or products | Judge.me (New Zealand) - product review platform | yes - New Zealand (European Commission adequacy decision) |
| contacting us (e.g. asking a question) | Google Cloud Poland Sp. z o.o. (Warsaw, Poland) and Google LLC (Mountain View, USA) - Google Workspace: mailboxes and standard office software | yes - USA (EU-US Data Privacy Framework) and other countries where Google and its sub-processors may process data (European Commission adequacy decision or Standard Contractual Clauses SCC); you can find the list of these countries and sub-processors on Google's website: Google Workspace sub-processors |
| post-purchase survey answer | Shopify Inc. (Ottawa, Canada) - Store platform, saves the answer with the order; EvoSolve Solutions sp. z o.o. - Checkout Essentials app, which passes the answer to Shopify (app server in the EU, Frankfurt) | yes - Canada (European Commission adequacy decision) + Standard Contractual Clauses (SCC) |
| checkout analytics (detecting errors in the checkout) | EvoSolve Solutions sp. z o.o. - Checkout Essentials app, whose pixel in the checkout passes on the data; Supabase Pte. Ltd. (Singapore) - checkout analytics database (servers in the EU, Frankfurt) | does not take place (data stored in the EU, Frankfurt); access by the provider from outside the EU only under Standard Contractual Clauses (SCC) |
| return of goods and withdrawal from the contract | AlleKurier Sp. z o.o. (Kraków, Poland) - Wygodne Zwroty service: withdrawal form (link in the skinvibe.pl footer), confirmation of its submission and return label; iSense Ltd. (Sofia, Bulgaria), trading as Consentmo - withdrawal form (link in the skinvibe.eu and skinvibe.global footer) and confirmation of its submission | does not take place; confirmation emails for the Consentmo form are sent by Twilio SendGrid (USA) - EU-US Data Privacy Framework |
The above-mentioned recipients based in the USA are participants in the EU-US Data Privacy Framework, which has been recognised by the European Commission as providing an adequate level of protection for personal data. In the event that the Data Privacy Framework adequacy decision is invalidated, we will base data transfers on Standard Contractual Clauses (SCC) adopted by the European Commission.
In addition:
relevant public authorities to the extent that we are obliged to disclose data to them.
