PROOFY.SKIN PRIVACY AND COOKIES POLICY

Effective date: 05.10.2026

§ 1. General information and personal data controller

  1. This Privacy Policy describes the rules governing the processing of personal data of users and customers of the Proofy.skin online store available at https://proofyskin.com.

  2. The controller of personal data is Anastasiia Marchenko, conducting business activity under the business name Anastasiia Marchenko, NIP: 5842861952, address: al. Rzeczypospolitej 4B/48, 80-369 Gdańsk, Polska, hereinafter referred to as the “Controller” or the “Store”.

  3. For matters related to the processing of personal data, the Controller may be contacted:

  4. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), applicable Polish personal data protection legislation, electronic communications legislation and other applicable laws.

§ 2. Personal data we process

Depending on how a person interacts with the Store, the following categories of personal data may be processed.

1. Orders and delivery

When an order is placed and fulfilled, the following data may be processed:

  • first and last name;
  • delivery address;
  • email address;
  • telephone number;
  • information about ordered products;
  • order value;
  • selected payment method;
  • selected delivery method;
  • information about the status of the order and payment;
  • information about the selected collection point or parcel locker, where applicable.

2. Payments

When a payment is made, information necessary to initiate, identify and confirm the payment may be processed, including:

  • order identifier;
  • payment amount and currency;
  • payment status;
  • transaction identifier;
  • contact details to the extent necessary to provide the payment service.

Payment data is also processed by PayPro S.A., the operator of the Przelewy24 payment service, in accordance with the rules applicable to that service and PayPro S.A.’s own privacy information.

The Store does not receive the full payment card number, CVV/CVC or other data that is processed directly by the relevant payment service provider and is not required by the Store for order fulfilment.

3. Invoices and accounting documents

For the purpose of issuing an invoice or another sales document, the following data may be processed:

  • first and last name or business name;
  • address;
  • NIP;
  • information about the purchase;
  • other data required under applicable tax legislation.

4. User account

When registering and using an account, the following data may be processed:

  • email address;
  • name;
  • information provided by the user in the account;
  • data necessary for authentication;
  • order history;
  • technical information related to the use of the account.

User passwords are not stored in plain text.

5. Enquiries, returns and complaints

When contacting the Store, the following data may be processed:

  • contact details;
  • correspondence content;
  • information about the order;
  • information concerning a return or complaint;
  • documents or photographs provided by the user;
  • bank or payment details necessary to issue a refund, where applicable.

6. Newsletter

When subscribing to the newsletter, the following data is processed:

  • email address;
  • information necessary to manage the subscription;
  • information allowing the provision or withdrawal of consent to be demonstrated.

7. Technical data

When using the website, the following data may be processed automatically:

  • IP address;
  • date and time of the request;
  • requested URL;
  • browser and device information;
  • technical logs;
  • session information;
  • technical identifiers necessary for the operation of the website, security and error diagnostics.

Such information may constitute personal data.

§ 3. Purposes and legal bases for processing

Purpose of processing Legal basis
Placing and fulfilling an order Article 6(1)(b) GDPR — entering into and performance of a contract
Arranging delivery Article 6(1)(b) GDPR
Processing and confirming payment Article 6(1)(b) GDPR
Creating and maintaining a user account Article 6(1)(b) GDPR
Issuing invoices, accounting and tax records Article 6(1)(c) GDPR — compliance with a legal obligation
Handling returns and complaints Article 6(1)(b) and/or Article 6(1)(c) GDPR
Responding to enquiries before a purchase Article 6(1)(b) GDPR
General correspondence and customer support Article 6(1)(f) GDPR — legitimate interests of the Controller
Ensuring website security and preventing abuse Article 6(1)(f) GDPR
Diagnosing technical errors and ensuring website stability Article 6(1)(f) GDPR
Establishing, exercising and defending legal claims Article 6(1)(f) GDPR
Newsletter subscription and sending newsletters Article 6(1)(a) GDPR — consent
Retaining evidence of granting or withdrawing consent Article 6(1)(f) GDPR

§ 4. Newsletter and electronic marketing

  1. Subscription to the newsletter is voluntary and is not a condition for making a purchase or using the main functions of the Store.

  2. The user provides an email address for the purpose of receiving the Proofy.skin newsletter and commercial information.

  3. The newsletter is sent on the basis of the user’s prior consent in accordance with the applicable requirements of the GDPR and Polish electronic communications legislation.

  4. The user may withdraw consent at any time without providing a reason:

    • by using the unsubscribe mechanism included in the newsletter;
    • by sending a message to [email protected].

  5. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

  6. After unsubscribing from the newsletter, the email address is removed from the active mailing list. Limited information concerning the granting and withdrawal of consent may be retained in order to demonstrate compliance with legal requirements and to defend against potential claims.

  7. Google Workspace is used for email services and newsletter handling.

§ 5. Whether providing data is mandatory

  1. Providing personal data is voluntary unless otherwise required by law or by the nature of the relevant service.

  2. Providing data indicated as necessary for placing an order is required to enter into and perform the contract. Without such data, fulfilment or delivery of the order may not be possible.

  3. Providing data necessary to process a payment is required in order to use the selected payment method.

  4. Providing data necessary for issuing an invoice is required to the extent prescribed by law.

  5. Creating a user account is voluntary.

  6. Subscription to the newsletter is voluntary and does not affect the ability to make a purchase.

  7. Consent to electronic marketing is not a condition for fulfilling an order.

§ 6. Recipients of personal data

Personal data is provided to recipients only to the extent necessary for the relevant purpose of processing.

Recipients of personal data may include:

1. Payment operator

PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, Poland — in connection with the processing of online payments.

Within the scope of the payment service it provides, PayPro S.A. may process personal data as an independent controller in accordance with applicable law, its own terms of service and privacy information.

2. Delivery operators

Depending on the delivery method selected by the user:

  • InPost;
  • DPD;
  • Poczta Polska.

They receive the data necessary to deliver the order, in particular the first and last name, address or selected collection point, telephone number, email address and information necessary to identify the shipment.

3. Infrastructure providers

DigitalOcean and providers associated with the provision of infrastructure — in connection with hosting and technical maintenance of the Store’s systems.

The main infrastructure used by the Store is located in a European Union region.

4. Email services

Google, in connection with the use of Google Workspace for email, correspondence and the newsletter.

5. Accounting

An external accounting services provider — to the extent necessary to fulfil accounting and tax obligations.

6. Other recipients

Data may also be provided to:

  • IT service and technical maintenance providers;
  • security and backup service providers;
  • legal, tax and other professional advisers;
  • public authorities and other authorised entities where disclosure is required by law.

Depending on the nature of the service, such entities may act as processors on behalf of the Controller or as independent controllers.

§ 7. Transfers of personal data outside the EEA

  1. The Store’s main infrastructure is located within the European Union.

  2. Some international service providers used by the Store may process data or provide access to data from countries outside the European Economic Area.

  3. Where personal data is transferred outside the EEA, the Controller uses mechanisms provided for in Chapter V of the GDPR, in particular:

  • an adequacy decision of the European Commission;
  • an applicable EU-U.S. Data Privacy Framework mechanism;
  • Standard Contractual Clauses adopted by the European Commission;
  • other safeguards permitted under the GDPR.
  1. The user may request additional information about the applicable data transfer mechanisms by contacting [email protected].

§ 8. Personal data retention periods

Data is retained no longer than necessary for the purpose of processing, taking into account legal requirements and the need to defend legal claims.

1. Orders

Order data is processed during the performance of the contract and subsequently retained to the extent necessary for:

  • accounting and tax obligations;
  • handling returns and complaints;
  • establishing, exercising or defending legal claims.

2. Payments

Payment information held by the Store is retained together with order documentation and accounting records for the relevant applicable periods.

Data processed directly by PayPro S.A. through Przelewy24 is retained in accordance with the data retention rules applicable to that payment service and the legal requirements applicable to payment institutions.

3. Accounting and tax documents

They are retained for the periods prescribed by applicable Polish law.

4. User account

Account data is retained for the duration of account maintenance.

To delete an account, the user may send a request to:

[email protected]

After the account is deleted, data that the Controller is legally required to retain or that is necessary to defend legal claims may continue to be retained to the appropriate extent.

5. Correspondence, returns and complaints

Data is retained for the duration of handling the relevant matter and subsequently for the period necessary to comply with legal obligations and defend claims.

6. Newsletter

Data is used for the newsletter until consent is withdrawn.

After consent is withdrawn, the data is removed from the active mailing list. Information necessary to demonstrate the granting or withdrawal of consent may be retained for the period necessary to defend against potential claims.

7. Technical logs

Technical logs are retained in accordance with the settings and rotation mechanisms of the infrastructure used, only for the period necessary to ensure security, system stability and error diagnostics.

Data relating to a specific security incident or legal claim may be retained for longer where reasonably necessary.

§ 9. User rights

In the cases and under the conditions provided for by the GDPR, the user has the right to:

  • access their personal data and obtain a copy;
  • request rectification of personal data;
  • request erasure of personal data;
  • request restriction of processing;
  • exercise the right to data portability;
  • object to processing based on the Controller’s legitimate interests;
  • withdraw consent at any time where processing is based on consent.

Where data is processed for direct marketing purposes, the user has the right to object to such processing at any time.

To exercise these rights, the user should contact the Controller at:

[email protected]

Where there are reasonable doubts concerning the identity of the person making the request, the Controller may request additional information necessary to verify that person’s identity.

The request is handled without undue delay and, as a rule, within one month of receipt. In the cases provided for by the GDPR, this period may be extended by up to two additional months, taking into account the complexity and number of requests.

The right to erasure is not absolute. Data may continue to be retained, for example, where this is required by tax legislation or necessary for the establishment, exercise or defence of legal claims.

The user has the right to lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO).

§ 10. Cookies and similar technologies

1. General information

Cookies and similar technologies are used to store or access information on the user’s device and to ensure the operation of the website.

Similar technologies may include, in particular:

  • local storage;
  • session storage;
  • technical browser identifiers;
  • other mechanisms used by the web application.

2. Necessary technologies

Proofy.skin uses technologies necessary to provide the functions of the online store, in particular for:

  • maintaining the user session;
  • ensuring security;
  • user authentication;
  • operation of the shopping cart;
  • placing orders;
  • maintaining the technical state of the website;
  • processing the localisation and language selected by the user.

For technologies whose use is strictly necessary to provide an electronic service requested by the user, prior consent is not required to the extent permitted by the exceptions provided for under applicable law.

3. Optional technologies

For technologies that are not strictly necessary to provide a service requested by the user and that require access to information on the user’s device, a consent mechanism is applied in accordance with applicable law.

Such technologies are activated only after the required consent has been provided.

The user must be able to:

  • provide consent;
  • reject optional technologies;
  • change their choice;
  • withdraw previously granted consent.

Rejecting optional technologies must not prevent the use of the main functions of the online store.

4. Browser settings

The user may restrict or delete cookies through the settings of their browser.

Blocking strictly necessary technologies may cause certain website functions, such as authentication, the shopping cart or order placement, to operate incorrectly.

§ 11. Automated decision-making

The Controller does not make decisions concerning customers based solely on automated processing that produce legal effects or similarly significantly affect the user within the meaning of Article 22 GDPR.

If the nature of such processing changes, the user will be provided with the relevant information in accordance with the requirements of the GDPR.

§ 12. Protection of personal data

  1. The Controller applies technical and organisational measures appropriate to the nature of processing, the volume of data and the risks associated with processing.

  2. Access to personal data is granted only to persons and service providers who require such access to perform their functions.

  3. Measures are taken to protect data against:

  • unauthorised access;
  • unlawful disclosure;
  • accidental or unlawful loss;
  • destruction;
  • alteration;
  • other unlawful processing.
  1. The level of protection and the measures used are reviewed taking into account changes in technology, the nature of processing and the associated risks.

§ 13. Changes to the Policy

  1. The Policy may be updated in the event of changes to:
  • the functionality of Proofy.skin;
  • methods of processing personal data;
  • payment or delivery methods;
  • service providers and services used;
  • cookies and similar technologies;
  • legal requirements.

  1. The current version of the Policy is published on the Proofy.skin website.

  2. In the event of material changes to the methods of processing personal data, users will be informed in an appropriate manner where required by law or by the nature of the change.

  3. An amendment to this Policy does not replace obtaining the user’s consent where such consent is required.

  4. Effective date: 05.10.2026