Privacy policy

Privacy and Cookie Policy

1. Data Controller

The controller of your personal data is BAD BEAUTY sp. z o.o., with its registered office in Wrocław, ul. Św. Jerzego 1A, 50-518 Wrocław, Poland, KRS 0001185040, NIP 8993030943, REGON 542277851. For privacy matters, contact us at kontakt@badnailz.com or in writing at the registered office address.

2. Data We Process

Depending on how you use the Store, we may process identification and contact data, shipping and billing addresses, data relating to orders, payments and returns, correspondence, Customer account data, marketing preferences, and technical data relating to your device, browser, IP address, online identifiers and use of the Store.

We do not receive full payment card details. They are processed by the payment operator.

3. Purposes and Legal Bases

We process data for the following purposes:

  • entering into and performing a contract, delivery, payment, returns and account management — Article 6(1)(b) GDPR;
  • issuing and retaining accounting documents and complying with tax, consumer and other legal obligations — Article 6(1)(c) GDPR;
  • handling enquiries before entering into a contract — Article 6(1)(b) GDPR, and in other matters our legitimate interest in conducting communications — Article 6(1)(f) GDPR;
  • handling complaints, preventing abuse, ensuring Store security, and establishing, pursuing and defending claims — Article 6(1)(c) or (f) GDPR;
  • running newsletters and electronic marketing — consent required under the applicable electronic communications rules and Article 6(1)(a) GDPR, or legitimate interest to the extent permitted by law; consent may be withdrawn at any time;
  • analytics, personalisation and marketing using non-essential cookies or similar technologies — consent, Article 6(1)(a) GDPR;
  • customer satisfaction research and development of the Store where consent is not required — legitimate interest, Article 6(1)(f) GDPR.

4. Recipients of Data

Data may be received by entities that support us in operating the Store, in particular Shopify, payment operators, banks, carriers and logistics operators, providers of hosting, email, analytics tools, customer service, reviews, marketing, accounting, legal advice and IT services. Recipients receive data only to the extent necessary to perform the tasks entrusted to them or as required by law.

Current information about processing by Shopify can be found in Shopify's privacy documentation. This does not change the fact that BAD BEAUTY sp. z o.o. is responsible for providing Customers with the information required under the GDPR in relation to its own processing.

5. Transfers Outside the EEA

Some technology providers may process data outside the European Economic Area. In such cases, we use the mechanisms required by the GDPR, in particular an adequacy decision of the European Commission or Standard Contractual Clauses, together with additional safeguards where necessary.

6. Retention Period

We retain data no longer than necessary for the purpose for which it was collected:

  • order data and accounting documents — for the period required by tax and accounting laws;
  • data connected with complaints and claims — until the matter is concluded and the relevant limitation periods expire;
  • account data — until the account is deleted, and afterwards to the extent necessary to comply with legal obligations or protect claims;
  • correspondence — for the period necessary to handle the matter and protect claims;
  • marketing data — until consent is withdrawn, an objection is raised, or the purpose ceases to apply;
  • data based on consent to cookies — for the operating period of the relevant tool or until consent is withdrawn.

7. Your Rights

In the cases specified by the GDPR, you have the right to access your data, obtain a copy, rectify it, erase it, restrict its processing, receive and transfer it, object to processing, and withdraw consent at any time without affecting the lawfulness of processing carried out before consent was withdrawn.

You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, https://uodo.gov.pl.

8. Voluntary Provision of Data

Providing data is voluntary, but some data is necessary to enter into and perform a contract, arrange shipping, process payment or respond to an enquiry. If required data is not provided, we may be unable to carry out those activities.

9. Automated Processing

We may use data to automatically tailor content and marketing communications where permitted by law and by the consent granted. We do not make decisions concerning a Customer that produce legal effects or similarly significantly affect the Customer solely by automated means, unless we inform the Customer separately and provide the rights required by law.

10. Cookies and Similar Technologies

The Store uses:

  • essential cookies, without which the cart, checkout, security and basic functions do not work;
  • functional, analytics and marketing cookies — only in accordance with the applicable rules and after consent is obtained where required.

On the first visit, we display a consent settings panel. Refusing consent must not block purchases or other essential functions. Consent can be changed or withdrawn using the “Privacy/Cookie Settings” link available in the footer. Cookies can also be restricted in browser settings, which may affect how the Store works.

11. Changes to this Policy

This Policy may be updated if the law, providers or methods of processing change. The current version and effective date are published on this page.

This Policy is effective from: 24 August 2026.