Privacy Policy

1. Data Controller

The controller responsible for your personal data is Skinora, Sofia, Bulgaria. For any question relating to this policy or to your personal data, you can contact us at hello@skinora.com.

2. What Data We Collect

We only collect the data we genuinely need to serve you. Depending on how you interact with us, this may include:

• Order data — your name, phone number, email address, and delivery details (a delivery address or your chosen courier office), together with the contents of your order.
• Contact data — your name, email address, and the content of your message when you write to us through the contact form or by email.
• Functional shopping data — the contents of your shopping cart, stored locally in your own browser (see Section 7).

We do not collect payment card data. Payments are made by cash on delivery or bank transfer.

3. Purposes of Processing

We use your personal data to:

• accept, process and deliver your orders;
• communicate with you about your order, including delivery updates and returns;
• respond to your enquiries and messages;
• handle withdrawals, returns, refunds and complaints;
• comply with our legal obligations, such as accounting and tax requirements.

4. Legal Bases

We rely on the following legal bases under Article 6 GDPR:

• Performance of a contract — (Art. 6(1)(b)) — processing your order data to fulfil and deliver your purchase.
• Legal obligation — (Art. 6(1)(c)) — retaining invoicing and accounting records as required by Bulgarian law.
• Legitimate interests — (Art. 6(1)(f)) — responding to enquiries, preventing fraud and defending legal claims.

5. Sharing Your Data

We never sell your personal data. We share it only where necessary to deliver your order or where the law requires it:

• Courier companies — Econt Express OOD and Speedy AD receive your name, phone number and delivery address or chosen courier office solely to deliver your parcel and, where applicable, to collect cash on delivery.
• Public authorities — where we are legally obliged to disclose data, for example to tax authorities.

Your data is processed within the European Union. We do not transfer your personal data outside the EU/EEA.

6. Data Retention

We keep order and invoicing data for the periods required by Bulgarian accounting and tax legislation (generally up to 10 years for accounting records). Correspondence is kept for as long as needed to resolve your enquiry and for a reasonable period thereafter. When data is no longer needed, it is securely deleted or anonymised.

7. Cookies & Local Storage

We use the Meta (Facebook) advertising pixel to measure the performance of our advertising and to show relevant ads. It sets cookies in your browser and sends Meta Platforms Ireland Limited information about the pages you view, the products you add to your bag and the orders you complete. This processing is based on your consent where required, and you can block it with your browser settings or an ad blocker.

We also use functional local storage that keeps the contents of your shopping cart on your own device so that your selection is not lost between visits. That data never leaves your browser until you place an order, and you can clear it at any time through your browser settings.

8. Your Rights Under the GDPR

You have the following rights regarding your personal data:

• Access — to obtain a copy of the personal data we hold about you;
• Rectification — to have inaccurate data corrected;
• Erasure — to have your data deleted where there is no legal ground for us to keep it;
• Restriction — to limit how we process your data in certain circumstances;
• Portability — to receive the data you provided to us in a structured, commonly used, machine-readable format;
• Objection — to object to processing based on our legitimate interests.

To exercise any of these rights, email us at hello@skinora.com. We will respond within one month, as required by the GDPR.

9. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Bulgarian supervisory authority: the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria (www.cpdp.bg).

10. Data Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or alteration, including encrypted connections (HTTPS) and access limited to those who need it to fulfil your order.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The current version, together with its effective date, will always be published on this page.