1. Data controller
The controller of your personal data is:
The Beauty Exchanger
ul. Bolesława Krzywoustego 8
81-036 Gdynia, Poland
VAT ID: PL5811968933 · EORI: PL581196893300000
E-mail: info@beautyexchanger.pl
In this policy "we", "us" and "TBE" refer to The Beauty Exchanger. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Polish Act on the Protection of Personal Data of 10 May 2018 and the Polish Telecommunications Law / Electronic Communications Law as applicable to cookies.
We have not appointed a Data Protection Officer, as we are not required to do so. For any matter concerning your personal data please contact us at the e-mail address above or by post.
2. Scope of this policy
This policy applies to personal data processed in connection with:
- the website thebeautyexchanger.com and its contact form,
- e-mail, telephone and other business correspondence with TBE,
- our relationships with customers, suppliers, brand owners, carriers and other business partners, including their employees and representatives,
- recruitment for positions at TBE,
- our profiles on social media platforms, to the extent we control the data.
We are a business-to-business (B2B) wholesale distributor. We do not sell products to consumers through this website and we do not knowingly collect data of persons under 16 years of age.
3. What data we process, why and on what legal basis
3.1 Contact form and enquiries
When you use the contact form or write to us, we process the data you provide: name, e-mail address, telephone number (optional), company name and country (optional), the subject and content of your message, and technical data needed to deliver and protect the form (time of submission, anti-spam markers, IP address in server logs).
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and handling further correspondence | Art. 6(1)(b) GDPR — steps prior to entering into a contract at your request, or Art. 6(1)(f) GDPR — our legitimate interest in communicating with persons who contact us |
| Protecting the form against spam and abuse, ensuring security of our systems | Art. 6(1)(f) GDPR — legitimate interest |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR — legitimate interest |
Providing data in the form is voluntary, but without your name and e-mail address we cannot reply to you.
3.2 Customers, suppliers and business partners
If you represent a company that trades with TBE (retailer, distributor, brand owner, carrier, service provider), we process the identification and contact data of the company's representatives and contact persons: name, position, business e-mail and telephone, correspondence, order and delivery details, and — for sole traders — the data required to issue invoices and comply with tax and customs law (including VAT and EORI numbers).
| Purpose | Legal basis |
|---|---|
| Negotiating, concluding and performing contracts, processing orders, shipments and payments | Art. 6(1)(b) GDPR (sole traders) or Art. 6(1)(f) GDPR — legitimate interest in performing a contract with the company you represent |
| Issuing and storing invoices, customs and export documentation, accounting and tax reporting | Art. 6(1)(c) GDPR — legal obligation (Polish VAT Act, Accounting Act, Union Customs Code) |
| Verifying contractors (sanctions lists, VAT status, credibility) and preventing fraud | Art. 6(1)(c) and (f) GDPR |
| Maintaining business relations, sending offers and trade information to existing partners | Art. 6(1)(f) GDPR — legitimate interest in direct marketing of our own services to business partners; electronic marketing messages are sent only with consent where required |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR |
3.3 Recruitment
If you apply for a job at TBE (e.g. in response to a vacancy published on our website), we process the data contained in your application and CV: name, contact details, education, work history and any other information you choose to include. We ask you not to include special categories of data (such as health data) unless it is necessary.
| Purpose | Legal basis |
|---|---|
| Conducting the recruitment process for the position you applied for | Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in connection with Art. 221 of the Polish Labour Code (data required by law); Art. 6(1)(a) GDPR — your consent for any additional data you provide voluntarily |
| Considering your application in future recruitments | Art. 6(1)(a) GDPR — only if you give separate consent |
3.4 Website visitors
When you browse our website, our hosting infrastructure automatically records technical information in server logs: IP address, date and time of the request, requested URL, HTTP status, browser and operating system type (user agent) and the referring page. We use this data to deliver the website, keep it secure, detect abuse and diagnose errors (Art. 6(1)(f) GDPR). Server logs are not combined with other data to identify you.
Information on cookies and any analytics tools is provided in section 8.
3.5 Social media
We maintain profiles on social networks (e.g. Facebook, Instagram, LinkedIn). When you interact with our profile, we process publicly available data of your profile and the content of your interactions to communicate with you and promote our business (Art. 6(1)(f) GDPR). The platform operator is a separate controller of your data and processes it under its own privacy policy.
4. Who we share data with
We share personal data only to the extent necessary and with:
- IT and hosting providers that host our website, e-mail and business systems (acting as processors under data processing agreements),
- carriers, freight forwarders and customs agents handling shipments and export/import formalities,
- accounting, legal and consulting firms supporting us,
- banks and payment institutions processing payments,
- brand owners and manufacturers, where required to authorise distribution or handle warranty and quality matters,
- public authorities (tax offices, customs, courts) where we are legally obliged to do so.
We do not sell personal data.
5. Transfers outside the EEA
Our website and business systems are hosted within the European Union. As an international distributor we may, however, transfer contact data of business partners to countries outside the European Economic Area where our customers, suppliers or carriers are located (for example when arranging a shipment to North America, Asia or Australia). Such transfers take place only to the extent necessary for the performance of the contract (Art. 49(1)(b) and (c) GDPR) or on the basis of appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or to countries covered by an adequacy decision.
Some technical providers we use (e.g. Google, for web fonts or — if enabled — analytics) may process data in the United States. These providers are certified under the EU-U.S. Data Privacy Framework and/or rely on Standard Contractual Clauses. You may request a copy of the relevant safeguards by contacting us.
6. How long we keep data
| Category | Retention period |
|---|---|
| Enquiries via contact form or e-mail that do not lead to cooperation | Up to 12 months from the last contact |
| Data of customers, suppliers and business partners | For the duration of the relationship and afterwards until the expiry of limitation periods for claims (generally up to 6 years) |
| Invoices, customs and accounting documents | 5 years counted from the end of the calendar year in which the tax obligation arose (or longer if required by law) |
| Recruitment applications | Until the end of the recruitment process; with your consent — up to 12 months for future recruitments |
| Server logs | Up to 90 days, unless needed longer to investigate a security incident |
| Consents (e.g. cookies, marketing) | Until withdrawn; proof of consent — for 3 years after withdrawal |
7. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy (Art. 15),
- rectify inaccurate or incomplete data (Art. 16),
- erase your data in the cases provided for by law (Art. 17),
- restrict processing (Art. 18),
- data portability where processing is based on consent or contract and carried out by automated means (Art. 20),
- object to processing based on our legitimate interest, including direct marketing (Art. 21),
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
To exercise these rights, contact us at info@beautyexchanger.pl. We will respond within one month; in complex cases this period may be extended by a further two months, of which we will inform you.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. If you live or work in another EU country, you may contact the supervisory authority there.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
8. Cookies and website technologies
Cookies are small text files stored on your device by your browser. Our website uses:
| Type | Purpose | Basis |
|---|---|---|
| Strictly necessary | Ensuring the website works correctly and securely — e.g. protecting the contact form against spam, remembering your cookie preferences. These do not require consent. | Legitimate interest / legal requirement |
| Analytics (if enabled) | Understanding how visitors use the website (pages viewed, time on site, approximate location based on truncated IP) using tools such as Google Analytics 4. Set only after you accept them in the cookie banner. | Your consent |
| Marketing (if enabled) | Measuring the effectiveness of our advertising on platforms such as Meta (Facebook/Instagram) or Google, and showing relevant ads. Set only after you accept them in the cookie banner. | Your consent |
At the time of publication of this version, the website uses only strictly necessary technologies. Should we introduce analytics or marketing tools, they will be activated only after you give consent via a cookie banner, and this section will be updated with the list of tools and their providers.
You can withdraw or change your consent at any time using the cookie settings on the website, and you can delete or block cookies in your browser settings. Blocking strictly necessary cookies may affect the functioning of the website.
The website loads web fonts from Google Fonts. When fonts are loaded, your browser sends your IP address to Google's servers. This is necessary to display the website in its intended design (Art. 6(1)(f) GDPR).
9. Security
We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access control, backups, anti-spam protection of the contact form and confidentiality obligations for staff and contractors. Access to personal data is limited to persons who need it to perform their duties.
10. Changes to this policy
We may update this policy to reflect changes in the law, our services or the technologies we use. The current version is always available at thebeautyexchanger.com/privacy-policy.html, together with its effective date. Material changes affecting how we use your data will be communicated to you in an appropriate manner.