Privacy Policy

Beautiful People Cosmetic SAS, registered at 66 Avenue des Champs-Élysées, 75008 Paris, France, is the data controller for personal data collected through www.beautifulpeoplecosmetic.com.

For any data protection queries, contact us at: privacy@beautifulpeoplecosmetic.com

We collect the following data:

— Identity: first name, last name, email address

— Contact: postal address, phone number (optional)

— Order data: items ordered, amount, purchase history

— Connection data: IP address, browsing data

— Payment data: we store no card data; payments are processed by Stripe and Alma

Your data is used to:

— Process and dispatch your orders

— Manage your customer account

— Send transactional emails (order confirmation, shipping updates)

— Improve our site and services (anonymised analytics)

— Meet our legal and accounting obligations

— Contract performance: order processing, account management

— Legitimate interest: service improvement, fraud prevention

— Consent: analytics cookies and marketing communications (revocable at any time)

— Legal obligation: accounting document retention

— Customer account data: retained for the duration of the commercial relationship, then archived for 3 years

— Order data: retained for 10 years for accounting purposes

— Browsing data: anonymised or deleted within 13 months

— Payment data: not retained by BPC (processed by Stripe)

Under GDPR (EU Regulation 2016/679), you have the following rights:

— Right of access: obtain a copy of your personal data

— Right to rectification: correct inaccurate or incomplete data

— Right to erasure: request deletion of your data

— Right to data portability: receive your data in a structured format

— Right to object: object to processing based on legitimate interest

— Right to restriction: request temporary suspension of processing

To exercise these rights, contact privacy@beautifulpeoplecosmetic.com. We respond within 30 days. You may also lodge a complaint with your national supervisory authority.

Your data may be shared with:

— Stripe Inc. (card payment processing)

— Alma SAS (instalment payments)

— Resend Inc. (transactional email delivery)

— Vercel Inc. (site hosting)

— Supabase Inc. (customer database)

These providers act as data processors and are contractually required to process your data solely on our instructions and in accordance with GDPR.

Some of our providers (Vercel, Stripe, Resend, Supabase) are based in the United States. Transfers are safeguarded by standard contractual clauses approved by the European Commission, in accordance with GDPR Article 46.

We use essential cookies (required for site operation) and analytics cookies (with your consent). See our Cookie Policy for details.

We implement appropriate technical and organisational measures to protect your data: HTTPS connection, sensitive data encryption, restricted staff access, and access logging.

We reserve the right to update this policy at any time. The last updated date is shown at the top of this page. We will notify you by email of any material changes.