Privacy policy
What personal data we process, why, and what rights you have. In short: what the order and the account need, and nothing else.
Last updated: 14 October 2026
1. Data controller
- Company
- PANOVA HELT EOOD
- Trading name
- ONE Cosmetix
- Company number
- 206476136
- VAT number
- BG206476136
- Address
- ul. San Stefano 13, 6100 Kazanlak, Bulgaria
- info@onecosmetix.com
- Phone
- +359 89 791 1251
We process personal data under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
2. What we collect
- Contact details
- name, email, phone
- Order details
- delivery and billing address, the contents and value of the order
- Account details
- for a business account: company, company number, VAT number and type of business, and the name of the premises with their address, or an online shop’s website
- Review details
- the rating, the comment, and the first name taken from your account and shown under the review
- Basket
- the products and quantities in your basket while you are signed in, without prices
- Withdrawal details
- your name, the order number, the e-mail for the confirmation and what you are returning, when you withdraw from an order through the form on the site
- Salon list details
- the salon’s name and town, and whatever you add for the list in your account: address, telephone, website, social media profiles, booking link, description and therapies
- The chat on the site
- the name and the e-mail or phone you leave if you write without an account, the messages, and the page you write from
- Technical data
- IP address and browser details, in logs and for rate limiting
- Visit statistics
- pages and products viewed, clicks on links and buttons, device type and approximate location, through Google Analytics
We process no card data, because we take no card payments. With a bank transfer we see only what the bank shows on the statement.
3. Legal basis
- Performance of a contract and steps taken before it is concluded: assessing a business application, processing and delivering the order, running the account.
- Legal obligation: receiving and confirming a withdrawal from the contract, and refunding what was paid (Bulgarian Consumer Protection Act).
- Legal obligation: accounting and tax records.
- Consent: the newsletter, the letters with offers (a reminder about products left in the basket, about ordering again, and a request for your opinion of the products) and analytics cookies. The newsletter may be suited to your account’s price level and to the town you gave in it. The links in the newsletter are personal: we record which of them you followed and when, and whether you ordered afterwards, to learn which letters are useful to you. We do not track whether you open the letters. Withdrawable at any time, from the link in every letter.
- Consent: publishing a review. Before you send your rating we show the name it will appear under, and sending it is the consent. We publish the first name alone, with no town and nothing else from the account. Withdrawable at any time by writing to us, and the review comes off the site.
- Consent: the list of salons. A salon is shown with its name and town if you agreed at registration or in your account, and with whatever you add for the list in your account yourself. The address and telephone for invoices and deliveries are never published. Withdrawable at any time from the account, and the salon comes off the site at once.
- Legitimate interest: visit statistics without cookies, to maintain and improve the site.
- Steps before a contract and legitimate interest: answering the question you ask us in the chat on the site, there or by e-mail.
- Legitimate interest: site security and preventing abuse.
5. How long we keep it
- Orders and invoices
- 10 years, under accounting and tax law
- Account
- as long as it exists, and up to 12 months after it is closed
- Form enquiries
- up to 24 months
- Newsletter and offers by email
- until you unsubscribe. When and how you confirmed, and when you left, are kept as proof of the consent
- Unconfirmed subscription
- up to 30 days, if you do not confirm your address
- The e-mails we send you
- their text up to 90 days, and to whom and when they were sent up to 2 years
- Which newsletter links you followed
- up to 2 years after the last one
- Reviews
- for as long as the account that wrote them exists, including the ones we did not publish
- The rating links in the letter asking for your opinion
- 60 days, after which they stop working and we delete them
- Sign-ins to your account
- when you signed in to your account or came back to it, from which device, IP address and town, and failed attempts to sign in with your e-mail: 90 days, for the account's security and to help you if you cannot get in
- Basket in the account
- the products in it: until you empty it or order what is in it, and no longer than 90 days after the last change (an emptied basket keeps only the dates of its last change and of our last letter about it, for the same period)
- Salon list details
- on the site for as long as the salon is on the list. What you filled in stays in your account until you delete it or close the account
- Withdrawals
- 5 years, the general limitation period for claims under the contract, as proof that and when you withdrew
- Chat conversations
- up to 24 months after the last message
- Technical logs
- up to 90 days
6. Your rights
- Access to the data we hold about you.
- Rectification of inaccurate data.
- Erasure, where there is no other basis to keep it.
- Restriction of processing.
- Portability: your data in a structured, machine-readable format.
- Objection to processing based on legitimate interest.
- Withdrawal of consent, without affecting processing up to that point.
Write to info@onecosmetix.com. We answer within one month.
You may complain to the Bulgarian Commission for Personal Data Protection.
7. Security
The site runs entirely over HTTPS. Passwords and access codes are stored as hashes only and are never written down in readable form. The database is in the European Union.
8. Cookies
See the cookie policy.