📞 Contact an advisor +48 733 340 790
Privacy Policy
The data controller responsible for processing personal data is:
BUCE EUROPE Ltd
39B Krakowska Street
50-424 Wrocław
biuro@premiumsalon.pl
Telephone: 733 340 790
Thank you for your interest in our online shop. Protecting your privacy is very important to us. Below you will find detailed information on how we handle your data.
1. Access details and hosting
You can visit our websites without providing any personal data. Whenever a webpage is accessed, the server automatically records only so-called server logs, e.g. the name of the requested file, your IP address, the date and time of the request, the amount of data transferred and the internet service provider making the request (so-called access logs), and documents the page view. This data is analysed solely for the purpose of ensuring the proper functioning of our website and improving our offering. This serves, in accordance with Article 6(1)(f) of the GDPR, to safeguard our legitimate interest in the optimal and correct presentation of our websites and our offering. All access data is deleted within seven days of the end of your visit to the website.
Web hosting
Website hosting and display services are provided in part on our behalf by our service providers under a data processing agreement. Unless otherwise stated in this privacy policy, all access data and data collected via the forms provided for this purpose on our website will be processed on their servers. If you have any questions regarding our service providers and the basis of our cooperation with them, please contact us. You will find our contact details under „Our contact details and your rights”.
2. Collection and processing of data for the purposes of contract performance and communication
2.1 Data processing for the purposes of contract performance
We process the personal data you voluntarily provide when placing an order for the purpose of fulfilling the contract (including enquiries regarding the handling of claims under the warranty for defects or guarantees, and in relation to the obligation to inform you of necessary updates). The legal basis for this is Article 6(1)(b) of the GDPR. Mandatory fields are marked as such because they relate to data that is necessary for the fulfilment of the order and without which we are unable to fulfil it. The data collected is directly indicated in the forms into which the data is entered.
Further information regarding the processing of your data, in particular regarding the transfer of data to our service providers for the purposes of order fulfilment, payment and dispatch, can be found in the following sections of this privacy policy. Once the contract has been fulfilled, the processing of your data will be restricted, and after the expiry of the retention periods required under tax regulations and the Accounting Act, this data will be deleted (Article 6(1)(c) of the GDPR), unless you give your explicit consent (Article 6(1)(a) of the GDPR) to the further use of this data for other purposes, or we reserve the right to continue using it in cases permitted by law, in which case we will inform you of this in this privacy policy.
Inventory management system
We also use an external inventory management system to process orders and fulfil the contract. Our service providers provide us with services in this regard under a data processing agreement. If you have any questions regarding our service providers and the basis of our cooperation with them, please contact us. You will find our contact details under „Our contact details and your rights”.
2.2 Customer account
If, in accordance with Article 6(1)(a) of the GDPR, you give your consent to the creation of a customer account, we will process your personal data as necessary for this purpose. This data will also be used for future orders on our website. Your customer account can be deleted at any time. To do so, please send a message to our contact address listed under „Our contact details and your rights” or use the relevant function in your customer account settings. Once your customer account has been deleted, the processing of your data will be restricted, and after the retention periods specified in tax regulations and the Accounting Act have expired, this data will be deleted (Article 6(1)(c) of the GDPR), unless you give your explicit consent (Article 6(1)(a) of the GDPR) to the continued use of this data, or unless, in accordance with applicable law, we reserve the right to continue using the data for other purposes, in which case we will inform you of this in this privacy policy.
2.3 Data processing for contact purposes
As part of our communication with you, we process personal data for the purpose of handling your enquiries (Article 6(1)(b) of the GDPR). You provide this data to us voluntarily when you contact us (e.g. via the contact form or by email). Mandatory fields are marked as such because they relate to data that is necessary to process your enquiry. The data collected is directly indicated in the forms into which the data is entered. Once your enquiry has been fully processed, your data will be deleted, unless you give your explicit consent (Article 6(1)(a) of the GDPR) to the further use of this data for other purposes, or we reserve the right to further use it in cases permitted by law, in which case we will inform you of this in this privacy policy.
Userlike Live Chat Tool
When you use the Userlike Live Chat Tool to contact us, the data you voluntarily provide (name, email address, message content) will be processed by us in order to respond to your enquiry. This serves our legitimate interests (Article 6(1)(f) of the GDPR) in ensuring an effective means of contacting us. The live chat tool is a service provided to us by an external service provider – Userlike UG, Probsteigasse 44-46, 50670 Cologne, Germany – which ensures the tool remains functional. All data collected through the use of this tool is stored on this service provider’s servers. Data processing in connection with the services provided by Userlike takes place within the framework of a data processing agreement.
3. Data processing for the purpose of fulfilling a delivery
In order to perform the contract (Article 6(1)(b) of the GDPR), we will pass on your data to the delivery company you selected during the ordering process, which has been commissioned to deliver the products you have ordered.
The same applies to the transfer of data to our manufacturers or wholesalers with whom we collaborate, where they handle shipments on our behalf (dropshipping). For the purposes of this privacy policy, they are regarded as service providers in the field of freight forwarding.
4. Data processing for the purpose of processing payments
In order to process payments in our online shop, we work with external service providers that handle online electronic payments, and we pass on your data to the payment service provider you select during the ordering process. This is necessary for the performance of the contract (Article 6(1)(b) of the GDPR).
Data processing for the purpose of preventing fraud and optimising payments
In certain situations, we may provide our service providers with additional information, which they may use in conjunction with the information necessary to process the payment. These service providers then act on our behalf as data processors and provide us with services relating to fraud prevention and the optimisation of payment processes (e.g. invoicing, analysis of rejected payments, accounting support). In accordance with Article 6(1)(f) of the GDPR, this serves our legitimate interests in protecting against fraud and abuse and in the effective management of payments.
5. Marketing channels: email
Sending an invitation to leave a review of a purchase
If you have given your consent to this during or after placing your order (Article 6(1)(a) of the GDPR), we will use your email address to send you an electronic invitation to review your purchase from our shop. Reviews/ratings are submitted via the review system we use. You may withdraw your consent at any time by sending a message stating your withdrawal of consent to our contact address indicated in the section „Our contact details and your rights”. Alternatively, you may also use the link to unsubscribe from the newsletter mailing list included in the message inviting you to submit a review.
Invitations to leave a review are sent by our service provider, Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany (Trusted Shops). As part of the invitation process, we receive status information from Trusted Shops (e.g. whether a particular invitation to leave a review has been sent and whether it has reached the recipient). This is carried out in accordance with Article 6(1)(f) 1(f) of the GDPR to pursue our legitimate interest in receiving information regarding review invitations so that we can optimise our processes where necessary, as well as to pursue Trusted Shops’ legitimate interest in being able to offer this service.
We are jointly responsible with Trusted Shops for sending out invitations to leave reviews and for collecting and displaying information relating to reviews, ratings and status.
As part of the joint responsibility between us and Trusted Shops, please contact Trusted Shops if you have any questions regarding the protection of your data or wish to exercise your rights. Contact details are available on this page. There you will also find further information on data protection at Trusted Shops. Regardless of this, you can always contact us directly. If necessary, your enquiry will be forwarded to Trusted Shops, which is jointly responsible for data processing.
6. Cookies and similar technologies
General information
To enhance your experience on our website and enable you to use its key features, we use various technological tools, including cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted at the end of your web browser session, i.e. when you close your browser (so-called session cookies). Other cookies are stored on your device and enable us to recognise your browser the next time you visit the website (so-called persistent cookies).
Endpoint privacy protection
When you use our online services, we employ technologies that are absolutely essential to ensure the proper and optimal functioning of our website’s essential features. In this regard, the storage of information on the user’s device or access to information already stored on their device does not require the user’s consent.
For features that are not strictly necessary, the storage of information on the user’s device or access to information already stored on their device requires the user’s consent. Please note that if consent is not given, some features or elements of the website may not be fully accessible. Any consent given by the user remains valid until such consent is withdrawn, the settings are configured, or the relevant settings on the end-user’s device are reset.
In addition, we also use technological tools to comply with the legal obligations to which we are subject (e.g. to demonstrate that we have obtained consent to process your personal data), as well as for web analytics and online marketing. Further information on this subject, including the relevant legal bases for data processing, can be found in the following sections of this privacy policy.
7. Use of cookies and similar technologies for web analytics and marketing purposes
Provided you have given your consent (Article 6(1)(a) of the GDPR), we use the cookies listed below and other similar technological tools provided by third-party service providers on our website. Once the purpose of processing has been fulfilled and use of the relevant technological tool has ended, the data collected through the use of these tools will be deleted. You may withdraw your consent at any time. Detailed information regarding the possibility of withdrawing consent and your right to object can be found in the section „Cookies and similar technologies”. Further information can be found on the websites of the individual service providers. If you have any questions regarding our service providers and the basis of our cooperation with them, please contact us. You will find our contact details in the section „Our contact details and your rights”.
Any further processing of data using cookies and other technologies
We use technologies that are absolutely essential to ensure the proper and optimal functioning of our website’s essential features (e.g. the shopping basket function). These technologies process data such as your IP address, the time of your visit to the website, information about your device and browser, as well as information about your use of our website (e.g. the contents of your shopping basket). This serves, in accordance with Article 6(1)(f) of the GDPR, to pursue our legitimate interest in the optimal presentation of our offering.
You will find instructions on how to change your cookie settings in your web browser’s help menu. These are available via the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™
Where you have given us your consent to use specific technological tools (Article 6(1)(a) of the GDPR), you may withdraw that consent at any time. To withdraw your consent, please contact us via the contact details provided in the section „Our contact details and your rights”.
7.1 Use of Google services
We use the following technological tools provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland („Google”). Information collected automatically by Google’s technologies regarding the use of our website is usually transmitted to a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. The European Commission has not issued a decision on the adequacy of data protection for the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission. Where your IP address is processed as part of the use of Google’s technological tools, your IP address is truncated before being stored on Google’s servers thanks to IP anonymisation being enabled. Only in exceptional cases will the full IP address be transmitted to a Google server and truncated there. Unless otherwise specified for the individual Google technologies described in this privacy policy, data processing takes place on the basis of a joint controller agreement concluded with Google in accordance with Article 26 of the GDPR. Further information regarding data processing by Google can be found in the privacy policy on Google’s website.
Google Analytics
To analyse the use of our website, we use Google Analytics – a web analytics tool provided by Google – which automatically processes your data for this purpose (IP address, duration of visit, device and browser information, as well as information regarding the use of our website) and creates pseudonymised user profiles based on this data. Cookies may be used for this purpose. As a rule, your IP address is not combined with other data collected by Google. Data processing within the Google Analytics service is carried out on the basis of a data processing agreement concluded with Google.
In order to optimise and enhance the user experience on our website, we have also activated data sharing settings for „Google products and services”. This enables Google to access data collected and processed as part of the Google Analytics service and to use it to improve the products and services provided by Google. The sharing of data with Google for this purpose is based on a separate agreement between the data controllers. We have no influence over the subsequent processing of data by Google.
We also use a tool to create and run A/B tests on our website Google Optimize, which is an extension of Google Analytics. We also use the tool Google Signals, which is an extension of Google Analytics and enables so-called „cross-device tracking” (identifying users who use multiple devices). This means that if your internet-connected devices are linked to your Google account and you have enabled „personalised advertising”, Google may generate reports on how our website is used (in particular regarding the number of users using different devices), even if you switch devices. We do not process your personal data in this regard; we only receive statistics based on the features and technologies of Google Signals.
For the purposes of analysing the use of our website and for advertising purposes, we also use so-called cookies as part of the Google Analytics service DoubleClick cookie, which enables your browser to be recognised when you visit other websites. Google will use this information to compile reports on your activity on our website and to provide other services relating to the use of the website.
Google Ads
We use Google Ads to promote our website in search results and on third-party websites. To do this, a file will be automatically stored on your device when you visit our website retargeting cookie Google, which uses the pages you visit to display adverts tailored to your interests, processing your data for this purpose using a pseudonymous identifier (ID) (IP address, time of visit, device and browser information, as well as information regarding your use of our website). Further data processing only takes place if you have enabled the ‘personalise ads’ option in your Google account settings. In this case – if you are logged into Google whilst visiting our website – Google will use your data together with the data collected via Google Analytics to create and define so-called target audience lists for cross-device remarketing purposes.
For web analytics purposes, we use the tool Google Ads Conversion Tracking, to measure and analyse your behaviour when you visit our website via an advert displayed through Google Ads. For this purpose, cookies may be used and data such as your IP address, time of visit, device and browser information, as well as information regarding your use of our website (e.g. website visits or newsletter subscriptions) may be processed. Pseudonymised user profiles are then created on the basis of this data.
Google's privacy and terms of service page https://policies.google.com/technologies/partner-sites
Google Privacy & Terms website – https://policies.google.com/technologies/partner-sites
Google Maps
In order to display geographical information visually, Google Maps will store and process information regarding your use of the maps and specific features, including, for example, your IP address and location data. We have no influence over this data processing by Google.
YouTube Video Plugin
When integrating third-party content using the YouTube video plugin, Google processes the following data when the video is played: IP address, time of visit, and information about the user’s device and browser.
7.2 Use of Facebook services
Facebook Pixel
We use the Facebook Pixel tool provided by Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland („Facebook”). The scope of the Facebook Pixel tool’s functionalities that we use is set out below. The Facebook Pixel automatically collects and stores data (your IP address, time of visit to the website, device and browser information, as well as information regarding your use of our website, e.g. a visit to the website or registration for the newsletter). Pseudonymised user profiles are then created on the basis of this data.
As part of the so-called ‘extended data comparison’ feature in Facebook Analytics, hashed information that can be used to identify individuals (e.g. first names and surnames, email addresses and telephone numbers) is also collected and stored for comparison purposes.
To this end, when you visit our website, the Facebook Pixel places a cookie on your device which, using a pseudonymised cookie ID, enables your browser to be automatically recognised when you visit other websites. Facebook will combine this information with other data from your Facebook account and use it to compile reports on website activity and to provide other services relating to your use of websites, in particular for the purpose of personalising advertising. Information collected automatically by Facebook technologies regarding your use of our website is usually transmitted to a server of Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025, USA, and stored there. The European Commission has not issued a decision confirming an adequate level of data protection in relation to the USA. To the extent that the transfer of data to the USA is our responsibility, our cooperation is based on the European Commission’s standard data protection clauses. Further information regarding data processing by Facebook can be found in Facebook’s privacy policy.
Facebook's analytics tools
As part of Facebook Business tools, statistics on user activity on our website are generated based on data collected via the Facebook pixel regarding your use of our website. Data processing by Facebook is carried out on the basis of a data processing agreement. The analysis of data (website usage statistics) serves to optimise and improve our website.
Facebook Ads (ad management)
Facebook Ads enables us to advertise our website on Facebook and other platforms. We set the parameters for each advertising campaign. Facebook is responsible for the precise implementation of the campaign and, in particular, for deciding which users to show a particular advert to. Unless otherwise specified for individual functions and tools, data processing takes place on the basis of a joint controller agreement in accordance with Article 26 of the GDPR. Joint responsibility is limited to the collection of data and its transfer to Facebook Ireland. This does not include the subsequent processing of data by Facebook Ireland. Based on statistics regarding the activity of users visiting our websites, generated using the Facebook Pixel tool, we use the Facebook Custom Audience advertising to the relevant audience, whilst defining the profile/characteristics of the target group in question. As part of the extended data comparison function (see above), Facebook acts as a data processor on our behalf.
Based on the pseudonymised Cookie ID stored by the Facebook Pixel and the information collected about user activity on our website, we use the Facebook Pixel Remarketing personalised advertising.
For the purposes of web analytics and optimising our offering – using the Facebook Pixel Conversions We analyse the activity of users who visit our website via adverts displayed through the Facebook Ads service. Facebook processes this data on the basis of a data processing agreement.
8. Integration with the Trusted Shops Trustbadge and other widgets
In order to display the reviews collected via the Trusted Shops review system and the Trusted Shops offer available to buyers after they have placed an order, the Trustbadge from Trusted Shops is integrated into our website.
This serves, in accordance with Article 6(1)(f) of the GDPR, to pursue our legitimate interest in optimising the marketing of our services by enabling secure online shopping. The Trustbadge and the services advertised via it are provided by Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, Germany (hereinafter „Trusted Shops”), with whom we are jointly responsible for the protection of jointly controlled data in accordance with Article 26 of the GDPR. We hereby inform you of the essential content of the joint arrangements between the joint controllers (Article 26(2) of the GDPR). If you have any questions regarding the processing of your data jointly controlled by us and Trusted Shops GmbH, or if you wish to exercise your rights, please contact Trusted Shops. You will find the contact details in Trusted Shops’ privacy policy, available here. Further information regarding data processing and data protection by Trusted Shops is available here. Notwithstanding the above, you may always contact us using the contact details provided in this privacy policy under the heading “Our contact details and your rights”. If necessary, your enquiry or request may be forwarded to the other joint controller (Trusted Shops) for processing and a response.
8.1 Data processing in connection with the integration of Trustbadge and other widgets
The Trustbadge is made available through joint processing by an American CDN (Content Delivery Network) provider. An adequate level of data protection is ensured by standard data protection clauses and additional contractual agreements. Further information on data protection by Trusted Shops GmbH can be found here. When the Trustbadge is accessed, the web server automatically stores a so-called log file (server logs), which also contains your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. The IP address is anonymised immediately upon collection so that the stored data cannot be attributed to a specific individual. The anonymised data is used in particular for statistical purposes and error analysis.
8.2 Data processing after placing an order
Once you have placed an order in our shop, your email address – encrypted using a one-way cryptographic function – will be forwarded to Trusted Shops GmbH. The legal basis for this processing is Article 6(1)(f) of the GDPR. This is done to check whether you are already registered with Trusted Shops GmbH and is necessary to pursue overriding legitimate interests – both ours and those of Trusted Shops – consisting of the ability to provide buyer protection in connection with a specific order and the provision of transaction evaluation services. If you are already registered to use Trusted Shops’ services, further data processing in this case takes place in accordance with the agreement between you and Trusted Shops. Those who have not registered will have the opportunity to register for the first time. Further data processing after registration also depends on the type of contract you have concluded with Trusted Shops GmbH. If you do not register to use Trusted Shops’ services, all data submitted will be automatically deleted by Trusted Shops GmbH, and it will not be possible to link it to a specific individual.
Trusted Shops uses external service providers for hosting, monitoring and log recording. This is to ensure the smooth operation of the systems; the legal basis for this is Article 6(1)(f) of the GDPR. Data processing may take place in third countries (the USA and Israel). In the case of the USA, an adequate level of data protection is ensured through contractual provisions requiring the application of standard data protection clauses and further contractual measures, and in the case of Israel through the existence of a decision confirming an adequate level of data protection.
9. Social media
9.1 Social media plugins: Facebook (Meta)
Our website uses social media plugins (buttons). These plugins are accessible via an HTML link, which ensures that when you visit our website containing such plugins (buttons), no automatic, direct connection is established with the servers of the respective social media provider. When you click on one of the buttons (plugins), a new window will open in your browser displaying the page of the relevant social media platform, where you can confirm the use of the button, e.g. „Like” or „Share”.
9.2 Our social media presence: Facebook, Instagram, YouTube
If you have given your consent to the relevant social media platform in this regard (Article 6(1)(a) of the GDPR), when you visit our account/profile on the aforementioned social media platforms, your data will be automatically collected and stored for web analytics and marketing purposes. Pseudonymised user profiles are created on the basis of this data. These may be used, for example, to display so-called personalised advertisements within and outside social media platforms that are likely to match your interests. Cookies are usually used for this purpose. Detailed information regarding the processing and use of your data by individual social media platforms, as well as information regarding your rights and the options for configuring privacy settings, as well as contact details for enquiries, are set out in the privacy policies of the respective social media platforms linked below. Should you require assistance in this regard, you may also contact us.
Facebook (by Meta) is a social media platform provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland („Meta Platforms Ireland”). Information processed automatically regarding your activity and how you use our Facebook (by Meta) fan page is generally transmitted to the server of Meta Platforms Ireland, Inc., 1 Hacker Way, Menlo Park, California 94025 in the USA and stored there. The European Commission has not issued a decision confirming an adequate level of data protection in relation to the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission. Data processing in connection with visits to the Facebook (by Meta) fan page takes place in accordance with Article 26 of the GDPR on the basis of the joint controller agreement, which is available here. Further information regarding the processing of your personal data when visiting the Facebook fan page (information regarding page statistics) is available here.
Instagram (by Meta) is a social media platform provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland („Meta Platforms Ireland„). Information processed automatically regarding your activity and how you use our fan page on Instagram is generally transmitted to and stored on a server operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA. The European Commission has not issued a decision confirming an adequate level of data protection in relation to the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission. Data processing in connection with visits to the Instagram fan page (by Meta) takes place in accordance with Article 26 of the GDPR on the basis of joint arrangements between the joint controllers. Further information regarding the processing of your personal data when visiting our Facebook fan page (information regarding page statistics) is available here.
YouTube is a social media platform provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland („Google”). Information processed automatically regarding your activity and how you use our YouTube profile is generally transmitted to and stored on a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The European Commission has not issued a decision confirming an adequate level of data protection in relation to the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission.
10. Our contact details and your rights
10.1 Your rights
Data subjects have the following rights:
- in accordance with Article 15 of the GDPR: the right to obtain information about the processing of data within the scope specified in that article;
- in accordance with Article 16 of the GDPR: the right to have your inaccurate or incomplete personal data rectified;
- In accordance with Article 17 of the GDPR: the so-called „right to be forgotten”, i.e. the right to have your personal data stored by us erased, provided that its further processing is not necessary:
- to exercise the right to freedom of expression and information;
- to comply with a legal obligation;
- in the public interest;
- for the purpose of establishing, pursuing or defending claims;
- in accordance with Article 18 of the GDPR: the right to restrict the processing of personal data, provided that:
- you dispute the accuracy of this personal data;
- the processing is unlawful and you object to the erasure of your data;
- we no longer require your personal data, but you need it to establish, pursue or defend legal claims;
- you have objected to the processing of your data pursuant to Article 21;
- in accordance with Article 20 of the GDPR: the right to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller;
- In accordance with Article 77 of the GDPR: the right to lodge a complaint with a supervisory authority (the President of the Personal Data Protection Office, „UODO”).
Right to object
If we process your personal data as described in this privacy policy in order to safeguard our legitimate interests, you may object to the processing of your data for this purpose – with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise your right to object at any time. If the processing is carried out for other purposes, you may only object on grounds relating to your particular situation.
Once you have exercised your right to object, we will not continue to process your personal data, unless we demonstrate compelling legitimate grounds for the processing which override your interests and rights, or where the processing is necessary for the establishment, exercise or defence of legal claims.
The previous sentence does not apply where data is processed for direct marketing purposes. In such cases, we will always cease further processing of your personal data once you have objected.
10.2 Contact us
If you have any questions regarding the collection, processing and use of your personal data, or if you wish to request information, correction, restriction of processing or erasure of data, or to withdraw your consent or object to the use of specific data, please contact the data controller directly, as indicated at the beginning of this privacy policy.