Privacy policy

This document (“Privacy and Cookies Policy”, hereinafter: “Policy”) defines the rules for processing personal data and the use of cookies and similar technologies in connection with using the online service available at www. molecooles.com (“Service”).

The Policy applies to persons using the Service, in particular to:

1. a.

   persons browsing the Service,

2. b.

   persons placing orders in the online store operated in the Service (“Store”),

3. c.

   persons having an Account in the Service,

4. d.

   persons using the MQLS loyalty program (“MQLS Program”), including the panel presenting MQLS information and related functionalities,

5. e.

   persons using the skin analysis / face scan function (“AI face scan”) available in the Service (if provided).

The Policy is informational in nature and is made available free of charge in the Service in a way that allows it to be saved, reproduced, and recorded.

Terms/concepts appearing in this Policy have the meaning assigned to them in this document, and in the absence of such a definition, in the Service Terms or MQLS Terms found in the Service.

The Policy is prepared in particular based on:

1. a.

   Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “GDPR”),

2. b.

   provisions on privacy in electronic communications (so-called ePrivacy), in particular Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, and national provisions issued for its implementation – in the scope of using cookies and similar technologies,

3. c.

   other mandatory provisions of law applicable to the operation of the Service, including the provision of electronic services and distance sales – to the extent they apply to data operations or Service functionalities.

Depending on how you use the Service, we may process the following categories of data:

1. a.

   Account / profile data (Account in the Service):

2. i.

   name and surname (or name), email address, password (in encrypted/ hashed form), phone number (if required), delivery addresses, history of activity in the Service, Account settings. ii. analysis results saved in the Account and materials sent by the user as part of this function (in accordance with its description in the Service).

3. b.

   Data related to orders in the Store:

4. i.

   information necessary to place and fulfill an order: ordered products, date and order number, price, currency, discounts, delivery costs, delivery method, fulfillment status, invoice data (if provided), history of returns and complaints.

5. c.

   Data related to payments:

6. i.

   We do not process full payment card data; payment processing is handled through the Payment Operator. ii. We may process transaction identifiers, payment status information (e.g., “paid / rejected”), date and payment amount, general payment method, and data necessary for settlements and handling possible refunds.

7. d.

   Communication data:

8. i.

   content of correspondence and reports sent to us (e.g., email), contact details provided in the correspondence, contact dates, information provided during report handling.

9. e.

   Technical and operational data of the Service:

10. i.

    in particular: IP address, device and browser identifiers, operating system, approximate location derived from IP, visit dates and times, event logs, information about activity in the Service (e.g., entering subpages, actions in the Cart), error and performance data.

11. f.

    Cookies and online identifiers

12. i.

    identifiers stored in cookies or similar technologies (e.g., browser storage), which may be used for purposes necessary for the operation of the Service and, depending on your settings, for analytical and marketing purposes. Details are in the cookies section.

Where do we get the data from?

1. a.

   From you, when you provide it in the Service, e.g., you create an Account, place an order, contact us, or use the AI face scan function.

2. b.

   From the Service (automatically generated data) - when you use the Service, some data is generated automatically (e.g., logs, technical data, cookie identifiers, order history).

3. c.

   From our partners / service providers - to the extent necessary for the operation of the Service and provision of services:

4. d.

   Payment Operator - provides us with payment status information and transaction identifiers necessary for order settlement;

5. e.

   MQLS Program Provider - may process data related to MQLS Program functionalities, including wallet functionalities and (if applicable) KYC, in accordance with its terms and rules; we receive from the Program Provider information necessary for presenting and settling the MQLS Program in the Service.

In paragraph 4 below, we present a summary of data processing purposes (“purpose → data → legal basis → recipients → retention period”).

The scope of data and recipients may vary depending on which Service functions you use.

Legal bases (GDPR):

1. a.

   Art. 6(1)(b) - performance of a contract / taking steps at the request of the data subject prior to entering into a contract,

2. b.

   Art. 6(1)(c) - legal obligation,

3. c.

   Art. 6(1)(f) - legitimate interests pursued by the controller,

4. d.

   Art. 6(1)(a) - consent (e.g., marketing/analytical or marketing cookies, if used).

Table: processing purposes. COOKIE PROVIDER PURPOSE RETE Essential cookies (session) - e.g. session_id / csrf_token Molecooles Ensuring proper operation of the Service (session handling, security, login, cart) Sessio X Preference cookies - e.g. lang Molecooles Remembering user settings (e.g. language) Up to CMP / banner cookies - e.g. cookie_consent CMP provider/ Molecooles Storing your cookie preferences Up to mo Google Analytics (if used) - ga, _ga_* Google Statistics and analytics of Service usage Usually years (d on con Meta Pixel (if used) - fbp Meta (Facebook) Marketing/remarketing, ad performance measurement Usually mont pend config Google Ads / Floodlight (if used) Google Remarketing and campaign measurement Depen t Hotjar/Clarity (if used) Hotjar/Microsoft User behavior analysis (e.g. click maps, session recordings) Depe confi YouTube/Vimeo embeds (if used) Google/Vimeo Video playback, potential tracking cookies Depe pro Stripe (payment elements, if cookies are set) Stripe Payment processing and transaction security Depe St

The MQLS loyalty program (“MQLS Program”) is available in the Service. Below, we explain what data is processed in connection with the MQLS Program and what role third parties play in its operation.

In connection with the MQLS Program, we may process in particular:

1. a.

   Account identifiers in the Service (e.g., Account ID, email as login), to assign awards to the correct user;

2. b.

   Data regarding orders necessary for awarding benefits in MQLS, in particular: order identifier, date, order value (e.g., net/gross, depending on Program rules), discount information, return/chargeback information (to the extent necessary for settlements);

3. c.

   Data regarding MQLS awards and settlements, e.g., number of MQLS awarded under Cashback or Affiliation, balance presented in the panel, history of MQLS Program events in the scope presented in the Service;

4. d.

   Affiliation data – in particular, Affiliate Link identifier, information about assigning a purchase to a referral, data necessary for awarding MQLS bonus.

Division of roles – Seller vs. Program Provider:

1. a.

   Seller:

2. i.

   The Seller is responsible for the operation of the Service and the organization of the MQLS Program in the Service, in particular for: ii. defining the rules of the MQLS Program (e.g., awarding Cashback, Affiliation, and rules for using MQLS in the Service), iii. presenting information about the MQLS Program in the Service (e.g., panel/ balance/events), iv. handling inquiries and complaints regarding the operation of the MQLS Program in the Service (to the extent they concern the Seller). ENTION CATEGORY BASIS LINK on / up to days Essential Essential (no consent required) — o X days Functional Consent or essential (depending on implementation) — o X days / onths Essential / Functional Essential (no consent required) (CMP policy link) y up to 2 depending nfiguration) Analytical Consent (Google policy link) y up to 3 ths (deding on guration) Marketing Consent (Meta policy link) nds on the tool Marketing Consent (Google policy link) ends on figuration Analytical Consent (Provider policy link) ends on ovider Functional / Marketing Consent (for optional cookies) (Provider policy link) ends on tripe Essential / Functional Essential or consent (depending on scope) (Stripe policy link)

3. b.

   Program Provider:

4. i.

   Functionalities related to handling the MQLS wallet, performing token operations, and possible KYC verification are carried out by the external provider, the Program Provider, based on its own conditions and rules.

5. c.

   In particular, the Seller:

6. i.

   does not provide CASP/custody services, ii. does not control private keys and does not perform wallet actions on the user’s side, iii. does not conduct the KYC process in connection with wallet operations; if required, it is conducted by the Program Provider.

In connection with using the MQLS Program, data may be transferred to the Program Provider to the extent necessary to ensure the operation of the MQLS Program functionalities, in particular for the purpose of:

1. a.

   launching and maintaining MQLS wallet functions (e.g., assigning/handling MQLS Wallet address in custodial model),

2. b.

   performing token operations (e.g., awards, transfers, withdrawals/deposits, if such functions are available),

3. c.

   handling KYC/access restrictions (if KYC is required for a given function),

4. d.

   ensuring security and preventing abuses within functionalities provided by the Program Provider.

The scope of data transferred to the Program Provider may include in particular: Account identifiers, order and MQLS Program event identifiers, information necessary for awards and settlements, and if the Customer uses functions requiring KYC, data required by the Program Provider as part of its verification process.

Information about possible data transfers outside the EEA, including to the USA, is in the Policy section on data transfers.

The skin analysis / face scan function (“AI face scan”) is available in the Service. Below, we explain what data is processed in connection with this function and on what principles.

Using the AI face scan function is optional. Using or not using this function does not affect the ability to browse the Service or make purchases in the Store (in the scope of standard Service functions).

In the AI face scan, the following data may be processed in particular:

1. a.

   face image (photo or image material taken via the user’s device camera);

2. b.

   analysis results generated based on the submitted image (e.g., information about skin features, matched recommendations, or assessment result);

3. c.

   technical data related to performing and displaying the result (e.g., session dentifier, date and time, device/browser information).

The analysis results may refer to skin features or information that may be interpreted as health-related data. For this reason, to ensure a higher level of protection, data processed in the AI face scan may be treated as special category data within the meaning of Art. 9 GDPR (in particular, if the analysis results indicate features that may be related to health status).

Note: AI face scan is not intended to provide medical services or make diagnoses. The results are informational in nature.

In the scope of processing data in the AI face scan (including face image and analysis results), the legal basis is the user’s consent - Art. 6(1)(a) GDPR.

If special category data is processed in the AI face scan (e.g., health-related data), the legal basis is additionally the user’s explicit consent - Art. 9(2)(a) GDPR.

The user may withdraw consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal.

AI face scan results and saved materials (if the Service provides for their saving) are available only in the user’s Account in the Service. The Seller does not publish these data in the Service nor make them available to other users.

The user may delete saved AI face scan results (if the Service provides such a function) via the Account in the Service or by contacting the Seller.

If the user does not delete these data earlier, they will be stored as a rule until the Account in the Service is deleted, and then deleted or anonymized, unless there is a legal obligation for further storage (as a rule, this does not apply to AI face scan data).

The AI face scan functionality may be implemented using external technology providers (e.g., AI tools or hosting). In such a case, the Seller:

1. a.

   selects providers in a way that ensures an appropriate level of data protection,

2. b.

   transfers data only to the extent necessary for the operation of the AI face scan function (data minimization principle),

3. c.

   ensures an appropriate legal basis for data sharing (e.g., data processing agreement), and describes issues of transfers outside the EEA in the section on data transfers.

Information about the provider/providers used for AI face scan may be indicated in the Service or provided at the user’s request, to the extent required by provisions.

In connection with operating the Service and providing services, your personal data may be shared with recipients only to the extent necessary to achieve the specific purposes mentioned in this Policy.

Main categories of recipients:

1. a.

   Payment Operator - In the scope of payment handling, refunds, and settlements, data may be transferred to the payment operator Stripe (or entities from its capital group) - to the extent necessary for transaction handling and payment security.

2. b.

   MQLS Program Provider - In the scope of MQLS Program functionalities, including those related to the MQLS wallet, token operations, and possible KYC, data may be shared with the Program Provider - to the extent necessary for providing these functionalities.

3. c.

   IT and Service maintenance providers - In particular, these may be:

4. i.

   hosting and server infrastructure, ii. CDN providers (content delivery), iii. IT security, monitoring, and backup service providers, iv. cookie consent management tool providers (CMP) – if used.

5. d.

   Communication and customer service providers - In particular:

6. i.

   email service providers, ii. SMS service providers (if used), iii. helpdesk/CRM system providers (if used).

7. e.

   Analytical and marketing tool providers (if used) - In particular, entities providing analytical, statistical, or advertising/remarketing tools, in the scope depending on your cookie settings and consents granted.

8. f.

   Entities handling order fulfillment - In particular, carriers and logistics operators (couriers), as well as entities supporting warehousing and return handling - if used.

9. g.

   Accounting and settlement support entities - Entities providing accounting, tax, or settlement and audit support services.

10. h.

    Legal advisors and auditors - If necessary (e.g., dispute, debt collection, pursuit or defense of claims), data may be shared with legal advisors, law firms, and auditors.

11. i.

    Public authorities and other authorized entities - Data may be shared with public authorities or other entities entitled to receive them under legal provisions (e.g., courts, law enforcement authorities, tax authorities) - only to the extent required by law.

In many cases, the above recipients act as processors on our behalf (e.g., hosting, email, helpdesk). In such situations, we ensure the legally required safeguards, in particular, we conclude data processing agreements (Art. 28 GDPR), if required.

In connection with using the Service and our providers’ services, your personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States (USA).

Data transfer outside the EEA may occur in particular when:

1. a.

   you use MQLS Program functionalities that are implemented by an external provider (e.g., Enzo) and require data processing on infrastructure located outside the EEA;

2. b.

   we use IT service providers (e.g., hosting, cloud infrastructure, CDN, monitoring and security systems) that have servers outside the EEA or use subcontractors outside the EEA;

3. c.

   we use analytical or marketing tools whose providers are based outside the EEA or process data on servers outside the EEA (if such tools are used).

In the case of data transfer outside the EEA, we ensure the legal basis required by GDPR. Depending on the provider and transfer direction, this may include in particular:

1. a.

   a decision establishing an adequate level of protection issued by the European Commission (if applicable);

2. b.

   standard contractual clauses (SCC) adopted by the European Commission;

3. c.

   other mechanisms provided in GDPR (e.g., additional safeguards or, in exceptional cases, specific derogations), if required and appropriate in a given case.

Detailed information on the transfer mechanism used for a given provider may result from its documentation or agreements concluded with the Seller.

You can obtain a copy of the safeguards applied for data transfer outside the EEA (e.g., a copy of standard contractual clauses, to the extent permissible) or additional information regarding the transfer by contacting us at: hello@molecooles.com

We store personal data for a period no longer than necessary to achieve the purposes for which the data is processed, taking into account legal obligations and limitation periods for claims.

Data related to the Account in the Service is stored:

1. a.

   for the duration of having the Account, and then

2. b.

   after deleting the Account, for the period necessary for:

3. c.

   settlements (if transactions occurred),

4. d.

   handling possible complaints and disputes,

5. e.

   establishment, pursuit, or defense of claims (until the expiry of limitation periods),

6. f.

   fulfillment of legal obligations (e.g., archiving of certain documents).

Data related to order fulfillment, as well as accounting and tax documents (e.g., invoices), is stored for the period required by legal provisions applicable to settlements and accounting, and for the period necessary for defense of claims.

Data related to complaints, returns, withdrawals from contracts, and disputes is stored for the time necessary to handle the matter, and then for the period enabling establishment, pursuit, or defense of claims, i.e., as a rule, until the expiry of limitation periods for claims.

Technical data, system logs, and information related to Service security is stored for a limited time, appropriate to security and accountability purposes (e.g., incident detection, prevention of abuses, event reconstruction). The storage period depends on the type of logs and may be shortened when the data is no longer needed for these purposes.

Data processed in the AI face scan function (in particular, face image and analysis results) is stored:

1. a.

   until deleted by the user (if the Service provides such a possibility) or

2. b.

   until the Account in the Service is closed/deleted, if the user has not deleted them earlier.

After closing/deleting the Account, these data are deleted or anonymized, unless there is an exceptional case requiring their retention (e.g., for dispute resolution purposes, if the data is necessary and proportionate).

In cases where data processing is based on consent (e.g., marketing or certain cookies), data is stored until consent is withdrawn, unless it is no longer needed earlier.

In connection with the processing of your personal data, you have rights arising from GDPR. You can exercise them by contacting us at: hello@ molecooles.com.

Depending on the legal basis and processing circumstances, you have the right to:

1. a.

   access to data (Art. 15 GDPR), you can obtain information whether we process your data, and if so - receive a copy and information about the processing;

2. b.

   rectification of data (Art. 16 GDPR) - if the data is incorrect or incomplete;

3. c.

   erasure of data (Art. 17 GDPR) - in cases provided in GDPR (e.g., when data is no longer needed, and there is no other basis for processing);

4. d.

   restriction of processing (Art. 18 GDPR) - e.g., when you contest the accuracy of data or need the data for establishing claims;

5. e.

   data portability (Art. 20 GDPR) - when processing is based on consent or contract and carried out by automated means;

6. f.

   objection (Art. 21 GDPR) - when we process data based on legitimate interests; in such a case, we will stop processing the data unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms or grounds for establishment, pursuit, or defense of claims.

If we process data based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. This applies in particular to:

1. a.

   consent to use the AI face scan function (including - if applicable - explicit consent for special category data),

2. b.

   consents regarding cookies (analytical/marketing - if used),

3. c.

   marketing consent (e.g., newsletter - if conducted in this form).

If you believe that the processing of your data violates provisions, you have the right to lodge a complaint with a supervisory authority. Due to the Seller’s seat in Estonia, the competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Regardless of the above, as a person residing in another EU country, you also have the possibility to lodge a complaint with the local supervisory authority in your place of habitual residence, place of work, or place of alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (PUODO): ul. Stanisława Moniuszki 1A, 00014 Warsaw, email: kancelaria@uodo.gov.pl, website: UODO (contact).

We make efforts to protect personal data processed in the Service from unauthorized access, loss, destruction, alteration, or disclosure. We apply organizational and technical measures appropriate to the risk and nature of processing.

In particular, we apply (to the extent appropriate to the systems and processes of the Service):

1. a.

   access control to systems and data, access is granted only to authorized persons, to the extent necessary for performing their duties;

2. b.

   limitation of authorizations and registration and verification of access (to the extent justified by security needs);

3. c.

   encryption of data transmission (e.g., HTTPS/TLS connections), to limit the risk of data interception during transmission;

4. d.

   infrastructure and IT environment safeguards, including monitoring of Service operation and responding to incidents to the extent appropriate to the conducted activity;

5. e.

   selection of service providers (e.g., hosting, payments, IT tools) taking into account security requirements and, if required, concluding appropriate agreements and arrangements regarding data protection.

The security of the Account in the Service also depends on you. In particular:

1. a.

   use a strong password and do not share it with third parties;

2. b.

   do not save the password in a way that enables easy access by unauthorized persons;

3. c.

   use trusted devices and up-to-date software;

4. d.

   if you suspect unauthorized access to the Account, change the password immediately and contact us.

We may take actions to protect the Account and the Service (e.g., temporary access restriction or verification of selected actions), if justified by security or suspicion of abuses.

In the Service, we use cookies and similar technologies (e.g., local storage, online identifiers) (“Cookies”) to ensure proper operation of the Service, enhance its functionality, and depending on your settings, conduct analytics and marketing activities.

Cookies are small text files saved on your device (computer, phone, tablet) while using the Service. They enable, among others:

1. a.

   maintaining sessions and proper operation of basic functions (e.g., login, Cart, session retention),

2. b.

   remembering selected settings,

3. c.

   analyzing the use of the Service (statistics),

4. d.

   tailoring content and ads.

Cookies may be set:

1. a.

   by Molecooles (own cookies), to ensure the operation of the Service;

2. b.

   by third parties (external cookies), if the Service uses providers of tools (e.g., analytical, marketing, video tools, maps, chats, etc.). The scope and types of cookies depend on the tools actually used.

The Service may use the following categories of Cookies:

1. a.

   Essential (necessary): They are needed for the proper operation of the Service and its basic functions (e.g., security, login, Cart, session retention). Your consent is not required for these cookies.

2. b.

   Functional: They enable remembering your settings and preferences (e.g., language, display settings) to facilitate using the Service. They may require consent, depending on their nature and national provisions.

3. c.

   Analytical (statistical): They help us understand how users use the Service (e.g., which subpages are visited, how navigation works) to improve it. These cookies are used based on your consent (if used).

4. d.

   Marketing: They may serve to display tailored content and ads and measure campaign effectiveness (e.g., remarketing). These cookies are used based on your consent (if used).

During your first visit to the Service, we display a consent management tool (e.g., banner) that enables:

1. a.

   accepting selected cookie categories,

2. b.

   rejecting optional cookies,

3. c.

   changing settings at any time.

You can change your cookie settings at any time (including withdrawing consent) via the mechanism available in the Service (e.g., “Cookie settings” link/icon or similar function).

You can also manage cookies through your web browser settings (e.g., blocking cookies, deleting saved cookies). Remember that disabling essential cookies may affect the operation of the Service.

Some browsers offer a “Do Not Track” (DNT) setting. Currently, different services and tools may interpret DNT differently, so the Service may not automatically respond to this signal. You can always manage consents in the cookie settings described above.

We may update this Privacy and Cookies Policy, in particular when:

1. a.

   legal provisions or supervisory authority guidelines change,

2. b.

   the way the Service operates changes, the scope of services provided (e.g., MQLS Program, AI face scan functions),

3. c.

   tools or providers used change (e.g., hosting, analytics, payment operator, Program Provider),

4. d.

   it is necessary due to security or improving information transparency.

We may inform about selected changes via the Service (e.g., message) or by email, if we have your address and such channel is appropriate for the type of change.

The updated version of the Policy is effective from the date indicated in its content. In the case of changes that significantly affect data processing (e.g., introduction of new purposes or new recipient categories), we may apply additional information measures or – if required – ask for re-consent (e.g., in the scope of cookies or AI face scan function).

This Privacy and Cookies Policy is informational in nature and describes the rules for processing personal data in the Service and the rules for using cookies and similar technologies.

In matters not regulated by this Policy, the appropriate legal provisions apply, in particular GDPR and national provisions on personal data protection and electronic communications (in the scope of cookies).

If any provision of this Policy proves invalid or ineffective, this does not affect the validity of the remaining provisions. In place of the invalid provision, a solution as close as possible to the economic and legal purpose is applied, while maintaining legal requirements.

The current version of the Policy is always available in the Service.