Privacy Policy

1. Introduction

This Privacy Policy explains how BIOBEMA, trading under the name Biobema (“Biobema”, “we”, “us” or “our”), collects, uses, stores and protects personal data when you:

• visit https://biobema.com/ (the “Website”);
• create or use a customer account;
• purchase or return our cosmetics;
• subscribe to our newsletter or other marketing communications;
• contact our customer service;
• interact with us through social media, advertising or other online services.

We are established in Poland and offer our products to customers internationally.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection laws, the data controller is:

BIOBEMA
Trading name: Biobema
Registered address: Radom, Poland
Registration number/KRS:
Tax identification number/NIP: [NUMBER]
Email: bb@biobema.com
Telephone: +48

If we appoint a Data Protection Officer, their contact details will be published in this section.

2. Personal Data We Collect

Depending on how you use our Website and services, we may collect the following categories of personal data.

2.1 Identification and contact data

This may include:

• first and last name;
• billing and delivery address;
• country or region;
• email address;
• telephone number;
• company name and tax identification details, where applicable.
  
  

2.2 Account data

This may include:

• login details;
• encrypted or hashed password;
• account preferences;
• order and account history.

Please keep your login details confidential and notify us if you believe that somebody has gained unauthorised access to your account.

2.3 Order and transaction data

This may include:

• products ordered;
• order value, currency and date;
• billing and delivery information;
• payment status and transaction identifiers;
• returns, refunds, complaints and warranty information;
• correspondence relating to an order.

We generally do not receive or store complete payment-card details. Payments may be processed directly by an independent payment service provider. That provider will process payment information according to its own privacy policy and applicable law.

2.4 Delivery and customs data

When we ship products internationally, we may process or disclose information required to deliver and clear the shipment, including:

• recipient’s name and address;
• telephone number and email address;
• order and parcel information;
• customs declarations;
• tax, import and export information;
• identification information, where legally required by customs or delivery authorities.

Depending on the destination country, customs authorities or delivery providers may request additional information directly from you.

2.5 Communications and customer-service data

This may include:

• emails, messages and contact-form submissions;
• questions about our cosmetics;
• complaints and product reviews;
• records of customer-service interactions;
• information you voluntarily provide when contacting us.

Please do not send us medical records or other sensitive personal data. If you contact us about an allergy, adverse reaction or health concern, we may process health-related information only where necessary and permitted by law, including with your explicit consent or to comply with product-safety and legal obligations.

2.6 Marketing data

This may include:

• newsletter subscription status;
• marketing preferences and consent records;
• responses to promotions or surveys;
• engagement with marketing emails and advertisements.
  
  

2.7 Technical and usage data

When you use the Website, we and our service providers may automatically collect:

• IP address;
• browser and device type;
• operating system;
• language and time-zone settings;
• pages viewed and links selected;
• referring website;
• session identifiers;
• approximate location derived from an IP address;
• cookie identifiers and similar online identifiers;
• dates, times and duration of visits;
• diagnostic, security and error-log information.

More information is provided in Section 9, “Cookies and Similar Technologies”.

2.8 Information from other sources

We may receive personal data from:

• payment processors;
• delivery, fulfilment and customs providers;
• fraud-prevention and security providers;
• analytics, advertising and social-media partners;
• publicly available sources;
• another person who places an order or requests delivery on your behalf.

If you provide another person’s details to us, you should have permission to do so and should make this Privacy Policy available to that person.

3. How and Why We Use Personal Data

Where the GDPR or an equivalent legal framework applies, we rely on the following legal bases.

Where processing is based on our legitimate interests, we assess whether those interests are overridden by your rights and freedoms.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. When Providing Data Is Required

Certain information is necessary to:

• create an account;
• conclude and perform a sales contract;
• process a payment;
• deliver an order;
• comply with invoicing, customs, tax or product-safety requirements.

If you do not provide required information, we may be unable to accept, process or deliver your order. Optional fields will be identified where reasonably possible.

5. How We Share Personal Data

We may disclose personal data to the following recipients where necessary:

• Website hosting, cloud-storage and IT-support providers;
• e-commerce platform and account-management providers;
• payment processors, banks and financial institutions;
• warehousing, fulfilment, courier, postal and logistics providers;
• customs brokers, customs authorities and tax authorities;
• customer-service and communication providers;
• email and newsletter providers;
• analytics, cookie-management and advertising providers, subject to applicable consent requirements;
• fraud-prevention, cybersecurity and identity-verification providers;
• accountants, auditors, insurers, lawyers and other professional advisers;
• courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law;
• a buyer, investor or successor in connection with a merger, sale, restructuring or transfer of our business or assets.

Some recipients, such as payment providers, couriers and customs authorities, may act as independent data controllers and process personal data under their own privacy notices.

We do not sell personal data for money. Certain uses of advertising cookies or sharing online identifiers may nevertheless be treated as a “sale”, “sharing” or use for targeted advertising under the laws of some jurisdictions. Where applicable, you may opt out through our cookie settings or by contacting us.

6. International Transfers

Because we sell and ship products internationally, personal data may be processed in or transferred to countries outside Poland or the European Economic Area (“EEA”).

Where personal data protected by the GDPR is transferred outside the EEA, we use an appropriate transfer mechanism where required, such as:

• a European Commission adequacy decision;
• the European Commission’s Standard Contractual Clauses;
• another legally recognised safeguard;
• a specific statutory exception where strictly applicable, such as a transfer necessary to perform a contract with you.

Where appropriate, we also assess the circumstances of the transfer and implement supplementary technical, contractual or organisational safeguards.

You may contact us for further information about the safeguards relevant to your personal data.

7. Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose and to meet legal, tax, accounting, product-safety and dispute-resolution requirements.

Typical retention periods are:

• Customer account data: until the account is deleted, followed by a limited period required for security, legal claims or legal compliance;
• Orders, invoices and accounting records: for the period required by Polish tax and accounting law;
• Delivery and customs documentation: for the period required by transport, customs, tax and trade laws;
• Complaints, returns and warranty records: until the matter is resolved and for the applicable limitation period;
• Product-safety or adverse-reaction records: for the period required under applicable cosmetics and product-safety laws;
• Customer-service correspondence: generally for up to three years after the matter is closed, unless a longer period is justified;
• Marketing data: until consent is withdrawn or you object, subject to retaining a minimal suppression record so that we can respect your preference;
• Cookie and analytics data: for the period described in our cookie-management tool or Cookie Policy;
• Security logs: for a limited period appropriate to investigating and preventing security incidents.

We may retain information for longer where required by law, where litigation or an investigation is pending, or where necessary to establish, exercise or defend legal claims. Data that has been irreversibly anonymised may be retained and used without further notice.

8. Marketing Communications

We may send marketing communications where you have consented or where another lawful basis permits us to do so.

You can unsubscribe at any time by:

• selecting the unsubscribe link in a marketing email;
• changing your account preferences, if available;
• contacting us at bb@biobema.com

Unsubscribing from marketing does not stop service messages that are necessary to administer your account or fulfil an order, such as payment confirmations, delivery updates, product-safety notices or responses to your requests.

9. Cookies and Similar Technologies

The Website may use cookies, pixels, local storage and similar technologies.

9.1 Strictly necessary technologies

These technologies may be required to:

• keep the Website secure;
• remember cart contents;
• maintain a login session;
• process checkout and payments;
• remember privacy choices;
• prevent fraud.

Where permitted by law, they may operate without consent because they are necessary for the service requested by you.

9.2 Analytics, preference and advertising technologies

With your consent where required, we may use additional technologies to:

• measure Website performance and traffic;
• understand how visitors use the Website;
• remember optional preferences;
• personalise content;
• measure or personalise advertising.

You can manage non-essential cookies through the cookie banner or cookie-preference tool available on the Website. Withdrawing consent will not affect processing that occurred before withdrawal.

A separate Cookie Policy or cookie-preference panel should identify the technologies currently used, their providers, purposes and retention periods.

Browser controls may also allow you to block or delete cookies. Blocking necessary cookies may prevent parts of the Website or checkout process from working correctly.

10. Social Media and External Links

Our Website may contain links or buttons connecting to third-party websites, social-media platforms or payment services. These third parties control their own processing activities, and their privacy policies apply when you use their services.

We are not responsible for the privacy practices or content of third-party websites. We encourage you to review their privacy notices before providing personal data.

11. Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

These measures may include access controls, encryption in transit, system monitoring, backups, staff confidentiality requirements and vendor-management procedures.

No website, transmission method or storage system is completely secure. You should use a unique password, protect your account credentials and contact us promptly if you suspect unauthorised use of your account.

12. Your Rights

Depending on the law applicable to you, you may have the right to:

• obtain confirmation that we process your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• receive certain data in a structured, commonly used and machine-readable format and request its transfer to another controller;
• withdraw consent at any time;
• request information about international-transfer safeguards;
• complain to a data-protection authority;
• appeal our refusal of a privacy request where applicable;
• opt out of the sale or sharing of personal data, targeted advertising or certain forms of profiling where applicable;
• receive equal service and pricing without unlawful discrimination for exercising privacy rights.

These rights are not absolute. We may refuse or limit a request where permitted by law, including where processing is required to comply with a legal obligation, protect the rights of another person, prevent fraud or establish or defend legal claims.

To exercise a right, contact us at bb@biobema.com . Please state the nature of your request and the country or region in which you reside.

We may request information reasonably necessary to verify your identity. An authorised agent may submit a request where permitted by law, but we may require proof of the agent’s authority and direct verification from you.

We will respond within the period required by applicable law. Under the GDPR, this is normally one month, subject to a permitted extension for complex or numerous requests.

13. Automated Decision-Making

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects for customers.

Automated tools may be used to identify unusual transactions, protect accounts, prevent fraud or support payment and security checks. A payment or order may be referred for manual review where appropriate.

If we introduce legally significant automated decision-making, we will provide the information and safeguards required by applicable law.

14. Children’s Privacy

The Website and our products are intended for adults and are not directed to children.

Customers must have the legal capacity required to purchase products under the law of their country. We do not knowingly collect personal data directly from children for marketing purposes.

If you believe that a child has provided personal data to us without valid parental or guardian authorisation, contact us so that we can investigate and take appropriate action.

15. Additional Information for Residents of Certain Jurisdictions

Privacy laws in some countries or states provide additional rights. Where such laws apply to our processing, we will honour the rights they grant.

15.1 EEA residents

You may lodge a complaint with the supervisory authority in the EEA country where you live, work or believe an infringement occurred.

Our lead supervisory authority in Poland is:

President of the Personal Data Protection Office
Urząd Ochrony Danych Osobowych
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland
Website: https://uodo.gov.pl/

We encourage you to contact us first so that we can attempt to resolve your concern.

15.2 United Kingdom residents

Where UK data-protection law applies, you may have rights corresponding to those described in Section 12 and may complain to the UK Information Commissioner’s Office.

If we become legally required to appoint a UK representative, the representative’s details will be added to this Privacy Policy.

15.3 United States residents

Depending on your state of residence and whether the relevant law applies to our business, you may have rights to access, correct or delete personal information, obtain a portable copy, and opt out of targeted advertising, sale, sharing or certain profiling.

We do not knowingly sell personal information for money. To submit a request or opt out of a use treated as a sale or sharing under applicable law, use the Website’s privacy or cookie controls or contact bb@biobema.com .

If we offer a financial incentive related to personal information, we will provide the notices required by applicable law before you participate.

15.4 Residents of other countries

Residents of Canada, Switzerland, Brazil, Australia, New Zealand and other jurisdictions may have additional rights under local law. Requests may be submitted using the contact details in Section 18.

Nothing in this Privacy Policy is intended to limit rights that cannot lawfully be limited.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, service providers, legal obligations or data-processing practices.

The current version will be posted on the Website with a revised “Last updated” date. Where required by law, we will provide additional notice or request renewed consent.

We encourage you to review this Privacy Policy periodically.

17. Language

This Privacy Policy may be made available in more than one language. If translations conflict, the version designated by us as controlling will apply to the extent permitted by law.

This clause does not limit any mandatory consumer or data-protection rights that apply in your country.

18. Contact Us

For questions, privacy requests or complaints, contact:

BIOBEMA / Biobema
Radom, Poland
Email: bb@biobema.com
Customer-service email: bb@biobema.com
Telephone: +48