Privacy and Cookie Policy

Last updated: 20/07/2026

This Privacy and Cookie Policy explains how personal data is collected, used, stored and protected when you visit or make a purchase through https://hc.zenacosmetics.com/, hereinafter referred to as the “Website” or the “Store”.

1. Data Controller

The controller responsible for processing personal data through the Website is:

Impex MBS Sp. z o.o.
Zurawia 45
00-680 Warsaw Poland
Email: hc@zenacosmetics.com

The company is hereinafter referred to as “ZENA Cosmetics”, “we”, “us” or the “Controller”.

Questions concerning this Privacy and Cookie Policy or the processing of personal data may be sent to the email address indicated above.

2. Scope of this Policy

This Policy applies to visitors, customers and registered users of the Website.

It covers personal data collected when you:

• browse the Website;
• create or manage a customer account;
• place or pay for an order;
• contact us through a form, email, telephone or messenger;
• subscribe to marketing communications;
• submit a review or other content;
• interact with our advertisements or social media pages;
• use other features made available through the Website.

3. Personal Data We Collect

Depending on how you use the Website, we may process the following categories of personal data.

Identification and contact information

This may include:

• first and last name;
• email address;
• telephone number;
• billing and shipping address;
• country, city, postal code and other address details;
• company name and tax identification number, where applicable.

Order and transaction information

This may include:

• products ordered;
• order number, date and status;
• purchase value and currency;
• selected payment and delivery method;
• discount or promotional code;
• returns, complaints and refund information;
• communication concerning an order.

We do not normally receive or store complete payment card details. Payment information is processed by the selected payment service provider.

Customer account information

This may include:

• email address or username;
• encrypted account password;
• saved addresses;
• previous orders;
• account preferences.

Communications

We may process information provided when you contact us, including:

• the content of messages;
• attachments;
• telephone or messenger communication;
• customer service and support history.

Technical and usage information

This may include:

• IP address;
• browser type and version;
• device type and operating system;
• approximate location based on IP address;
• referring page;
• visited pages and products;
• time and duration of visits;
• shopping-cart activity;
• cookie identifiers;
• information about interactions with advertisements and emails.

4. How We Collect Personal Data

We collect personal data:

• directly from you when you submit information through the Website;
• automatically through cookies, server logs and similar technologies;
• from payment providers, delivery companies and other parties involved in fulfilling an order;
• from advertising, analytics and social media platforms, subject to your settings and consent;
• from publicly available sources where permitted by law.

Providing personal data is generally voluntary. However, certain information is required to process an order, arrange payment or delivery, create an account, respond to a request or meet legal obligations.

Without the necessary information, we may be unable to provide the requested service.

5. Purposes and Legal Bases for Processing

We may process personal data for the following purposes.

Processing and fulfilling orders

We use personal data to:

• confirm and process orders;
• arrange payment;
• prepare and deliver products;
• send order and delivery notifications;
• handle returns, refunds, complaints and warranty requests.

The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

Customer accounts

We process account information to create and maintain customer accounts, display order history and provide account-related functions.

The legal basis is the performance of a contract and our legitimate interest in providing convenient customer services.

Customer service and communication

We process personal data to respond to questions, provide assistance and resolve technical, payment, delivery or product-related issues.

The legal basis may be the performance of a contract, our legitimate interests or consent, depending on the nature of the request.

Legal and accounting obligations

We may process and retain order, payment and invoicing information to comply with tax, accounting, consumer-protection and other legal requirements.

The legal basis is compliance with a legal obligation.

Website operation and security

We process technical information to:

• operate the Website;
• maintain shopping-cart and checkout functionality;
• prevent fraud, misuse and unauthorised access;
• diagnose errors;
• maintain system and network security.

The legal basis is our legitimate interest in operating and protecting the Website and, where applicable, compliance with legal obligations.

Analytics and service improvement

Subject to the required consent, we may analyse how visitors use the Website to understand performance, improve navigation, products, content and marketing activities.

The legal basis is your consent where required by applicable cookie and privacy laws.

Marketing and newsletters

Where you have provided consent, we may send information about:

• products and product launches;
• special offers and promotions;
• events, training or brand news;
• abandoned shopping carts;
• other commercial information.

You may withdraw marketing consent at any time by using the unsubscribe link in an email or contacting us.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Advertising and remarketing

Subject to your consent, we may use advertising technologies to:

• measure advertising performance;
• show relevant advertisements;
• create or use advertising audiences;
• understand whether an advertisement resulted in a visit or purchase.

The legal basis is your consent where such consent is required.

6. Recipients of Personal Data

We may disclose personal data only where necessary and to appropriate recipients, including:

• hosting and IT service providers;
• website developers and technical support providers;
• payment gateways, banks and payment processors;
• courier, postal, logistics and fulfilment companies;
• accounting, tax, legal and professional advisers;
• customer service and communication providers;
• email and newsletter service providers;
• analytics and advertising platforms;
• fraud-prevention and security providers;
• government bodies, courts or law-enforcement authorities where disclosure is required by law;
• a purchaser, investor or successor in connection with a merger, reorganisation or sale of the business.

Service providers may process personal data only for the agreed purposes and under appropriate contractual and security obligations.

We do not sell personal data.

7. International Data Transfers

Some service providers may process personal data outside the European Economic Area.

Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we use legally recognised safeguards where required. These may include European Commission standard contractual clauses and additional technical or organisational safeguards.

Information about applicable transfer safeguards may be requested using the contact details stated in this Policy.

8. Data Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, tax, accounting and reporting requirements.

Typical retention periods may include:

• order, invoice and accounting information: for the period required under applicable tax and accounting laws;
• customer account information: while the account remains active and for a reasonable period afterwards;
• customer service correspondence: for as long as necessary to resolve the matter and protect legal claims;
• marketing information: until consent is withdrawn or an objection is made;
• cookie and analytics information: according to the duration indicated in the cookie settings or by the relevant service provider;
• technical and security logs: for a limited period necessary for security, troubleshooting and fraud prevention.

We may retain certain information for a longer period where necessary to establish, exercise or defend legal claims.

9. Your Data Protection Rights

Subject to applicable law, you may have the right to:

• receive information about how your personal data is processed;
• access your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• receive personal data in a structured, commonly used and machine-readable format;
• request the transfer of eligible data to another controller;
• withdraw consent at any time;
• lodge a complaint with the competent data-protection authority.

Some rights are subject to legal conditions and exceptions. For example, we may be required to retain transaction information to comply with tax or accounting obligations.

To exercise a right, contact us at hc@zenacosmetics.com. We may ask for information necessary to confirm your identity.

10. Automated Decision-Making

We do not normally make decisions that produce legal or similarly significant effects based solely on automated processing.

Certain automated tools may be used for fraud prevention, payment verification, product recommendations or advertising. Where applicable, these tools are used with appropriate safeguards and do not replace legally required human review.

11. Security

We apply reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• destruction;
• misuse.

These measures may include encrypted connections, access controls, backups, security monitoring, software updates and restricted access to personal data.

No method of internet transmission or electronic storage is completely secure. Therefore, absolute security cannot be guaranteed.

Cookie Policy

12. What Are Cookies?

Cookies are small text files or similar technologies stored on a user’s device when a website is visited.

Cookies may be used to operate website features, remember preferences, maintain a shopping cart, analyse traffic, prevent fraud and support advertising.

Some cookies are placed directly by us. Others may be placed by third-party service providers.

13. Categories of Cookies We Use

Strictly necessary cookies

These cookies are required for essential Website functions, including:

• page navigation;
• shopping-cart operation;
• checkout and order processing;
• account login;
• security and fraud prevention;
• language and cookie-consent preferences.

Strictly necessary cookies cannot generally be disabled through the Website because the requested service may not function without them.

Functional cookies

Functional cookies help remember selected options and provide enhanced functionality, such as:

• preferred language;
• region or currency;
• saved settings;
• customer-service or communication tools.

Where required by law, these cookies are activated only after consent.

Analytics cookies

Analytics cookies help us understand:

• how visitors arrive at the Website;
• which pages and products are viewed;
• how visitors navigate the Website;
• whether technical errors occur;
• how Website performance can be improved.

Analytics information may be aggregated or linked to cookie and device identifiers.

These cookies are used only after consent where required.

Marketing and advertising cookies

Marketing cookies may be used to:

• measure advertising campaigns;
• limit how frequently advertisements are displayed;
• personalise advertisements;
• build advertising audiences;
• identify whether a visitor completed a purchase after viewing or clicking an advertisement.

These cookies may be placed by advertising and social media providers and are activated only after the required consent.

Non-essential cookies should not be placed before valid consent has been obtained. Users must receive clear information and a genuine ability to accept or reject them.

14. Third-Party Technologies

Depending on the Website configuration and the choices made in the cookie banner, the Website may use services provided by third parties, such as:

• Google Analytics;
• Google Ads;
• Google Tag Manager;
• Meta Platforms, including the Meta Pixel;
• social media platforms;
• payment providers;
• customer-service or messaging services;
• embedded video, map or media providers.

These providers may collect technical and usage information and may process it under their own privacy policies.

The exact providers and cookie durations should be displayed in the Website’s cookie settings panel or cookie declaration.

15. Managing Cookie Preferences

When you first visit the Website, you may be presented with a cookie banner that allows you to:

• accept all cookies;
• reject non-essential cookies;
• select individual cookie categories;
• review more detailed information.

You may change or withdraw your consent at any time through the Cookie Settings link available on the Website.

You may also control cookies through your browser settings. Blocking certain cookies may affect shopping-cart, account, language or other Website functionality.

Deleting cookies may cause previously selected preferences to be forgotten.

16. Children’s Privacy

The Website is not directed at children and is intended for persons who have the legal capacity to purchase products online under the laws applicable to them.

We do not knowingly collect personal data from children without the consent or authorisation required by applicable law.

A parent or legal guardian who believes that a child has provided personal data may contact us to request appropriate action.

17. External Links

The Website may contain links to websites or services operated by third parties.

We are not responsible for the privacy, security or content practices of external websites. Users should review the privacy policies of those services before providing personal data.

18. Changes to this Policy

We may update this Privacy and Cookie Policy when:

• Website functions change;
• new service providers are introduced;
• data-processing activities change;
• legal or regulatory requirements change.

The current version will be published on this page together with the date of the latest update.

Material changes may also be communicated through the Website or by other appropriate means.

19. Contact and Complaints

Questions, requests and complaints concerning privacy or cookies may be sent to:

Impex MBS Sp. z o.o.
Email: hc@zenacosmetics.com

You also have the right to lodge a complaint with the data-protection supervisory authority responsible for your place of residence, place of work or the location of the alleged infringement.