Privacy Policy

This Privacy Policy explains how Skinora (“we”, “us”, “our”) processes personal data when you visit our website or place an order with us. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Bulgarian data protection law.

1. Data Controller

The controller responsible for your personal data is Skinora, Sofia, Bulgaria. For any question relating to this policy or to your personal data, you can contact us at hello@skinora.com.

2. What Data We Collect

We only collect the data we genuinely need to serve you. Depending on how you interact with us, this may include:

• Order data — your name, phone number, email address, and delivery details (a delivery address or your chosen courier office), together with the contents of your order.
• Contact data — your name, email address, and the content of your message when you write to us through the contact form or by email.
• Functional shopping data — the contents of your shopping cart, stored locally in your own browser (see Section 7).

We do not collect payment card data. Payments are made by cash on delivery or bank transfer.

3. Purposes of Processing

We use your personal data to:

• accept, process, and deliver your orders;
• communicate with you about your order, including delivery updates and returns;
• respond to your enquiries and messages;
• handle withdrawals, returns, refunds, and complaints;
• comply with our legal obligations, such as accounting and tax requirements.

4. Legal Bases

We rely on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) — processing your order data to fulfil and deliver your purchase.
• Legal obligation (Art. 6(1)(c)) — retaining invoicing and accounting records as required by Bulgarian law.
• Legitimate interests (Art. 6(1)(f)) — responding to enquiries, preventing fraud, and defending legal claims.

5. Sharing Your Data

We never sell your personal data. We share it only where necessary to deliver your order or where the law requires it:

• Courier companies — Econt Express OOD and Speedy AD receive your name, phone number, and delivery address or chosen courier office solely to deliver your parcel and, where applicable, to collect cash on delivery.
• Public authorities — where we are legally obliged to disclose data, for example to tax authorities.

Your data is processed within the European Union. We do not transfer your personal data outside the EU/EEA.

6. Data Retention

We keep order and invoicing data for the periods required by Bulgarian accounting and tax legislation (generally up to 10 years for accounting records). Correspondence is kept for as long as needed to resolve your enquiry and for a reasonable period thereafter. When data is no longer needed, it is securely deleted or anonymised.

7. Cookies & Local Storage

We do not use advertising or analytics cookies, and we do not track you across the web. The only browser storage we use is functional local storage that keeps the contents of your shopping cart on your own device so that your selection is not lost between visits. This data never leaves your browser until you place an order, and you can clear it at any time through your browser settings.

8. Your Rights Under the GDPR

You have the following rights regarding your personal data:

• Access — to obtain a copy of the personal data we hold about you;
• Rectification — to have inaccurate data corrected;
• Erasure — to have your data deleted where there is no legal ground for us to keep it;
• Restriction — to limit how we process your data in certain circumstances;
• Portability — to receive the data you provided to us in a structured, commonly used, machine-readable format;
• Objection — to object to processing based on our legitimate interests.

To exercise any of these rights, email us at hello@skinora.com. We will respond within one month, as required by the GDPR.

9. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Bulgarian supervisory authority: the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria (www.cpdp.bg).

10. Data Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration, including encrypted connections (HTTPS) and access limited to those who need it to fulfil your order.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The current version, together with its effective date, will always be published on this page.