B2B platform privacy policy

1. General information and the Data Controller

This Privacy Policy describes the principles of processing personal data of users of the B2B platform available at b2b.beautycareglobal.com (hereinafter: the “Platform”, the “Service”). This document applies exclusively to B2B relationships (business–to–business).

Data Controller:
Beauty Care Global Sp. z o.o.
ul. Annopol 4, HALA H, 03‑236 Warsaw
KRS: 0000685838 (District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register), TAX ID (NIP): 5252716172, REGON: 367770653, share capital: PLN 5,000.00.

Correspondence address: ul. Annopol 4a, HALA H, 03‑236 Warsaw
E‑mail: kontakt@beautycareglobal.com

2. Scope of processed data

• B2B registration and account data: first and last name, business e‑mail address and phone number, company details (company name, VAT ID, address, REGON/KRS), login credentials (username, password – stored in encrypted form), role/function (optional).
• Transactional data: order history, cart and offers, payments, settlements, data required for invoices and accounting documents.
• Technical data: IP address, device/browser identifiers, operating system, server logs, activity data (e.g. login dates and times, operations in the Panel).
• Data sources: directly from you (forms, B2B Panel) and from public registers (e.g. CEIDG/KRS) for business verification purposes.

3. Purposes and legal bases for processing

• B2B account registration and management – Article 6(1)(b) GDPR (performance of a contract / provision of electronic services).
• Order and sales processing (payments, invoicing, shipment preparation, statuses) – Article 6(1)(b) GDPR.
• Handling inquiries and communication (e‑mail/Panel) – Article 6(1)(f) GDPR (legitimate interest of the Controller in providing support).
• Legal obligations (accounting, taxes, archiving) – Article 6(1)(c) GDPR.
• Service security (fraud prevention, login verification, outage monitoring) – Article 6(1)(f) GDPR.
• Establishment, assertion or defense of claims – Article 6(1)(f) GDPR.

4. Cookies and similar technologies

• Essential cookies – session maintenance, login, cart, B2B account configuration.
• Functional cookies – saving preferences (e.g. list views).
• Analytical/statistical cookies (if enabled) – aggregated measurement of traffic and service performance.

You can manage cookies in your browser settings. Restricting essential cookies may limit the use of certain functions (login, cart, account panel).

5. Data recipients

• IT support/hosting/infrastructure: processors maintaining the service, servers, backups.
• Accounting and advisors – fulfillment of legal obligations.
• Payment operator: Paynow – processing and settlement of electronic payments.
• Logistics and carriers: DHL (and potentially equivalent carriers) – deliveries, returns, transport claims.
• Public authorities – where required by law.

Data is transferred each time only to the extent necessary to achieve a given purpose (e.g. address and contact details for the carrier, identifiers and amounts for the payment operator).

6. Entrusted processing – Hosting

The Platform is hosted on servers operated by dhosting.pl Sp. z o.o., Al. Jerozolimskie 98, 00‑807 Warsaw, TAX ID: 7010198361, REGON: 141998822, KRS: 0000336780. dhosting.pl acts as a data processor (hosting provider) with regard to server services and technical infrastructure. Contact details provided for information purposes:

7. Transfer of data outside the EEA

As a rule, we do not transfer data to countries outside the European Economic Area. If such transfer were necessary (e.g. when using selected IT tools), we apply mechanisms provided for by the GDPR (in particular standard contractual clauses – SCC) and appropriate security measures.

8. Data retention period

• B2B account and profile data – until account deletion or termination of cooperation (subject to claim archiving periods).
• Accounting and settlement documents – for the period required by law (generally 5 years from the end of the tax year).
• Technical logs – up to 24 months, unless longer retention is necessary for establishing, asserting or defending claims.

9. Rights of data subjects

• Access to data and obtaining a copy.
• Rectification of incorrect or incomplete data.
• Erasure of data (“right to be forgotten”) – if there are no grounds for further processing.
• Restriction of processing – in cases specified by the GDPR.
• Data portability – where the basis is a contract or consent and processing is automated.
• Objection to processing based on legitimate interest.
• Complaint to the Personal Data Protection Authority (PUODO – the President of the Personal Data Protection Office).

Requests regarding the exercise of rights should be sent to the following address:

10. Data security

We apply appropriate technical and organizational measures, including transmission encryption (SSL), access control, user authentication, environment segmentation and backups. We regularly review permissions and maintain the principle of least privilege.

11. Automated decisions and profiling

We do not make decisions producing legal effects based solely on automated processing. We may apply basic profiling necessary for account and order handling (e.g. assignment to discount groups, segmentation by company status) – based on Article 6(1)(b)/(f) GDPR.

12. Policy changes

We reserve the right to introduce changes to this Policy. A new version will be published in the Service together with its effective date. Processing started before the change is governed by the version applicable at the time of data collection, unless the user accepts the new Policy to the relevant extent.

13. Contact

For matters related to personal data protection, please contact us at: kontakt@beautycareglobal.com. In the subject line, indicate which section your inquiry concerns (e.g. GDPR rights, security, cookies).

---

This document concerns the processing of data within the B2B Platform b2b.beautycareglobal.com in a B2B relationship.