PhytoEssence Biocosmetics

Privacy Policy

Last updated: July 2026

This Privacy Policy describes how ODONATA COSMETICS LTD (the "Controller", "We") collects, uses and protects your personal data when you visit the online store phytoskinlab.com and place orders. Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Bulgarian Personal Data Protection Act.

1. Data controller

  • Company name: ODONATA COSMETICS LTD
  • Address: 93 Tsar Boris III Blvd, 1000 Sofia, Bulgaria
  • Company ID (ЕИК): 204287083
  • Email for data protection enquiries: [email protected]

2. What data we collect

Depending on how you use the Website, we may process the following categories of personal data:

  • Order and delivery data: first and last name, email address, phone number, delivery address or selected courier office/parcel station, order contents and value.
  • Invoicing data: where an invoice is issued — details of an individual or a company (name, company ID, VAT number, address, representative).
  • Account data: email and encrypted password, order history (for registered customers).
  • Newsletter data: email address provided when subscribing to the newsletter.
  • Contact form data: name, email and the content of your enquiry.
  • Technical data: IP address, device and browser type, data from cookies and similar technologies (see the "Cookies" section).

We do not knowingly collect or process special categories of personal data. Card payment data is entered into and processed directly by the payment provider myPOS — we do not have access to your full card details.

3. Purposes and legal bases

  • Processing your order and delivering the Goods — basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Issuing accounting documents and complying with tax and accounting requirements — basis: legal obligation (Art. 6(1)(c) GDPR).
  • Sending newsletters and marketing communications — basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
  • Handling enquiries via the contact form, customer support and complaint handling — basis: performance of a contract and legitimate interest (Art. 6(1)(f) GDPR).
  • Improving the Website, statistics and preventing abuse — basis: legitimate interest, and for analytics/marketing cookies — your consent.

4. Recipients and processors

We do not sell your personal data. We share it only with carefully selected partners who process it on our behalf under a contract and in compliance with the GDPR:

  • The couriers Econt and Speedy — to deliver the ordered Goods (name, phone, delivery address/office).
  • myPOS — to process online payments by card, Apple Pay and Google Pay.
  • Email service provider — to send order confirmations, status notifications and the newsletter.
  • Website hosting and technical support providers.
  • Accounting and legal advisers, as well as competent public authorities where required by law.

5. Retention periods

  • Order data and accounting documents — up to 10 years in accordance with applicable tax and accounting law.
  • User account data — for as long as the account is active; upon a deletion request the account is closed unless there is a legal ground to retain it.
  • Newsletter data — until consent is withdrawn / you unsubscribe.
  • Contact form enquiries — until the matter is resolved and for a reasonable period thereafter.

6. Your rights

As a data subject you have the following rights under the GDPR:

  • Right of access to your personal data.
  • Right to rectification of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten").
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, you can contact us at [email protected]. You also have the right to lodge a complaint with the supervisory authority — the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, cpdp.bg.

7. Cookies

The Website uses cookies and similar technologies to function properly and to improve your experience. We distinguish the following types:

  • Strictly necessary cookies — provide the store's core functions (cart, session, account login, language settings). They are always active because the Website cannot work without them and do not require consent.
  • Analytics and marketing cookies — for example Google Analytics and the Meta Pixel. These are loaded only after your explicit consent given through the cookie banner. You can accept or decline them and change your choice later.

On your first visit to the Website we show a cookie banner through which you manage your consent. You can also delete or block cookies from your browser settings, bearing in mind that blocking necessary cookies may limit the store's functionality.

8. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including an encrypted connection (SSL/TLS), access controls and storage of passwords in encrypted form.

9. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or in the law. The current version is always published on the Website with the date of the last update indicated.

10. Contact

For questions regarding the processing of your personal data, contact us by email at [email protected].