Privacy Policy
1. Who We Are
This Privacy Policy explains how ESTHE DEPOT sp. z o.o., trading as Esthe Depot, collects and processes personal data when you visit esthedepot.com, create an account, place an order, contact us, request training or technical support, subscribe to marketing, or otherwise interact with us.
For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the data controller is:
ESTHE DEPOT sp. z o.o. ul. FRANCISZKA KLIMCZAKA 5/95, 02-797 Warszawa Email: info@esthedepot.eu Telephone: +48732227973
2. Personal Data We Collect
Depending on how you use our website and services, we may collect:
Identity and contact data
Your name, business name, billing and delivery address, email address, account details and any contact information you provide.
Order and transaction data
Products ordered, order value, currency, payment status, invoices, VAT details, delivery information, returns, refunds, warranty claims and previous transactions.
Payment data
Our payment providers process payment card or account information. Esthe Depot does not ordinarily receive or store your complete payment-card number. We may receive limited information such as payment method, payment confirmation, card type, last digits, transaction identifier and fraud-screening result.
Account data
Login details, saved addresses, preferences, wish lists and account activity.
Technical and usage data
IP address, browser type, device information, time zone, cookie identifiers, pages viewed, referral source, interactions with the website and diagnostic or security data.
Communications and support data
Emails, contact-form submissions, chat messages, product enquiries, training bookings, technical-support requests, photographs, videos, serial numbers and other information you choose to provide.
Please do not send client medical records, special-category health data or other unnecessary sensitive information through ordinary email or website forms.
Marketing data
Your marketing preferences, newsletter subscriptions and interactions with marketing communications.
3. How We Collect Personal Data
We collect personal data:
- directly from you when you order, register, contact us or submit a form;
- automatically through cookies, pixels, logs and similar technologies;
- from payment, fraud-prevention, delivery and fulfilment providers;
- from business partners where this is lawful and transparent;
- from publicly available business sources, where permitted by law.
4. Why We Process Personal Data and Our Legal Bases
We process personal data only when we have a lawful basis.
| Purpose | Typical legal basis |
|---|---|
| Creating and administering an account | Performance of a contract or steps requested before a contract |
| Processing orders, payments, delivery, returns and refunds | Performance of a contract |
| Providing product guidance, training, warranty and technical support | Performance of a contract and legitimate interests |
| Issuing invoices and maintaining tax or accounting records | Legal obligation |
| Preventing fraud, misuse and security incidents | Legitimate interests and legal obligation where applicable |
| Improving website performance and customer service | Legitimate interests; consent where required for cookies or tracking |
| Sending direct marketing | Consent, or legitimate interests where permitted by law |
| Personalised advertising and non-essential analytics | Consent where required |
| Establishing, exercising or defending legal claims | Legitimate interests and legal obligation |
| Responding to regulators, courts or lawful authority requests | Legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations.
5. Cookies and Similar Technologies
We use essential cookies to operate the website, keep the shopping basket active, maintain security and support checkout.
With your consent where required, we may also use functional, analytics and advertising cookies to remember preferences, understand website performance and measure marketing.
You can accept, reject or manage non-essential cookies through the cookie banner or cookie-preferences link. Withdrawing consent does not affect processing that took place before withdrawal. Blocking some cookies may affect website functionality.
Further information should be provided in a separate Cookie Policy or cookie-preferences panel listing the active cookies and providers.
6. How We Share Personal Data
We may share relevant personal data with:
- Shopify and providers that host or operate our online store;
- payment processors, banks and fraud-prevention providers;
- delivery carriers, freight companies, warehouses, manufacturers and fulfilment partners;
- providers of email, customer support, training-booking and technical-support systems;
- professional advisers, insurers, accountants, auditors and legal advisers;
- analytics and advertising providers, subject to your consent where required;
- public authorities where disclosure is required by law;
- a buyer, investor or successor in connection with a lawful corporate transaction.
Service providers may use personal data only for the agreed service or as otherwise permitted by applicable law. We do not sell personal data in the ordinary meaning of selling customer lists for money.
7. Shopify and Payment Providers
Our store is hosted by Shopify. Shopify processes information required to provide and secure the online-store and checkout services. Shopify and individual payment providers maintain their own privacy notices explaining their processing activities.
When you choose a payment method, the relevant provider may process your information as an independent controller or processor under its own terms.
8. International Data Transfers
Some service providers or support teams may process data outside Poland or the European Economic Area.
Where personal data is transferred outside the EEA, we use a lawful transfer mechanism where required, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another legally recognised safeguard. You may contact us for information about the safeguard relevant to a particular transfer.
9. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including:
- order, invoice, accounting and tax information for the period required by Polish and EU law;
- account information while the account remains active and for a reasonable period afterwards;
- warranty, technical-support and training records for the duration of the service relationship and relevant claim periods;
- correspondence for as long as required to resolve the enquiry, complaint or dispute;
- marketing data until consent is withdrawn, an objection is made, or the data is no longer needed;
- security logs for a limited period appropriate to fraud prevention and system security.
Data may be kept longer where necessary to establish, exercise or defend legal claims or comply with a legal obligation.
10. Your GDPR Rights
Subject to applicable conditions and exceptions, you may have the right to:
- receive information about how your data is processed;
- request access to your personal data;
- correct inaccurate or incomplete data;
- request deletion of personal data;
- restrict processing;
- receive data in a portable format;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- withdraw consent at any time;
- lodge a complaint with a data-protection supervisory authority.
To exercise a right, email info@esthedepot.eu. We may ask for information needed to confirm your identity and protect your data. We normally respond within the period required by applicable law.
You may complain to the supervisory authority in your country of residence or work. The Polish supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), whose current contact information is available at https://uodo.gov.pl.
11. Automated Decisions
We may use automated tools to identify possible fraud or security risks. We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without an appropriate lawful basis and the safeguards required by law.
12. Data Security
We use reasonable technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, misuse, alteration or disclosure.
No internet transmission or storage system can be guaranteed completely secure. Customers are responsible for keeping account passwords confidential and should contact us if they suspect unauthorised account activity.
13. Children
Our products and online store are intended for adults and professional users. We do not knowingly collect personal data directly from children.
14. Third-Party Links
Our website may contain links to external websites. We are not responsible for the privacy practices of third parties, and we recommend reviewing their privacy notices before providing personal data.
15. Changes to This Policy
We may update this Privacy Policy to reflect changes in our services, providers or legal obligations. The revised version will be posted on this page with an updated date. Where required, we will provide additional notice.
16. Contact
Questions, privacy requests and complaints may be sent to:
ESTHE DEPOT sp. z o.o. ul. FRANCISZKA KLIMCZAKA 5/95, 02-797 Warszawa Email: info@esthedepot.eu Telephone: +48732227973