Privacy Policy
Last updated September 2026
This Privacy Policy describes how Pandea Beauty Ltd collects, uses, stores and protects the personal data of users of the pandeabeauty.com website.
1. Data controller
The controller of personal data is: Pandea Beauty Ltd Company ID (EIK): 207067555 Address: 45 Spartak St, Smolyan, Bulgaria Website: pandeabeauty.com For questions about the processing of personal data, or to exercise your rights, you can contact us in writing at the address above.
2. What personal data we collect
Depending on how you use the site, we may process the following categories of personal data: name and surname; e-mail address; phone number; delivery and/or billing address; information needed to fulfil the order; invoice data, where applicable; information you voluntarily provide through the site; and technical information related to your use of the site and cookies. We do not collect more personal data than is necessary for the relevant purpose.
3. Purposes of processing
Personal data may be processed to: accept, confirm and fulfil orders placed; deliver purchased products; communicate with the customer about an order; process payments; issue accounting and other mandatory documents; handle complaints, returns and enquiries; comply with the company’s statutory obligations; keep the site running normally and securely; and for advertising and analytics purposes, where necessary and where your consent has been given. Pandea Beauty Ltd does not sell your personal data to third parties.
4. Legal basis for processing
We process your personal data on one or more of the following grounds: where processing is necessary to fulfil an order or contract; where processing is necessary to comply with a legal obligation; where you have given your explicit consent; or where Pandea Beauty Ltd has a legitimate interest that does not unduly affect your rights and freedoms. Where processing is based on consent, you have the right to withdraw it at any time.
5. Who data may be shared with
To fulfil orders and operate the site, part of the data may be shared, only where necessary, with: courier companies, including Speedy; payment service providers, where applicable; accounting and administrative service providers; hosting, technical support and other IT service providers; government and regulatory authorities, where required by law; and advertising and analytics providers, where you have given the necessary consent. These parties only receive the data necessary to perform the relevant service or legal obligation.
6. Data retention period
We retain your personal data only for the period necessary for the purposes for which it was collected. Data related to orders, payments, accounting documents and invoices may be retained for the periods provided for under applicable Bulgarian law. Data processed on the basis of your consent is retained until the consent is withdrawn or the purpose for which it was collected no longer applies, unless the law requires otherwise.
7. Cookies and Meta Pixel
The website uses essential cookies that are necessary for it to function correctly. Once consent is given via the cookie banner, additional technologies for analytics and advertising may also be used, including the Meta Pixel (Facebook/Instagram). These may be used to measure advertising effectiveness, analyse site visits, and show more relevant ads. Non-essential cookies and advertising technologies are only activated once the relevant consent has been given, where such consent is required. More information can be found in the site’s separate Cookie Policy.
8. Transfer of data outside the European Economic Area
When using certain technology, analytics or advertising services, personal data may also be processed outside the European Economic Area. Where applicable, any such transfer is carried out in compliance with Regulation (EU) 2016/679 and with appropriate safeguards and mechanisms in place to protect personal data.
9. Your rights
Under applicable law you have the right to: access your personal data; request correction of inaccurate or incomplete data; request deletion of your personal data, where the legal grounds for this are met; request restriction of processing; object to certain types of processing; data portability, where applicable; withdraw any consent given at any time; and lodge a complaint with the competent supervisory authority. Exercising these rights may be limited in cases provided for by law.
10. Complaints to a supervisory authority
If you believe your personal data is being processed in breach of applicable law, you have the right to lodge a complaint with: Commission for Personal Data Protection (CPDP) 1592 Sofia 2 Prof. Tsvetan Lazarov Blvd.
11. Security of personal data
Pandea Beauty Ltd applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
12. Changes to this Privacy Policy
Pandea Beauty Ltd may periodically update this Privacy Policy. The current version is published on pandeabeauty.com, with the last-updated date stated at the top of the document.