Privacy policy

Privacy Policy

1. General Information

This Privacy Policy (hereinafter referred to as the “Privacy Policy”) sets out the rules for the collection, storage, processing, and protection of personal data of customers using the online store available at www.qualash.com, as well as the rules for the use of cookies.

Personal data is processed in accordance with applicable data protection laws, including:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR),
  • the Polish Data Protection Act of 10 May 2018,
  • and other applicable data protection laws in the jurisdictions where the store operates.

The Controller applies appropriate technical and organizational measures to ensure the security of personal data and to protect it against unauthorized access, loss, misuse, or unlawful processing.

2. Personal Data Controller

The controller of personal data collected via the Online Store is:

Quacosmetics Sp. z o.o.
ul. Domaniewska 37/2.43
02-672 Warsaw
Poland

KRS: 0001136660
NIP (VAT): PL5214093556

Email: contact@qualash.com
Phone: +48 881 507 057

Quacosmetics Sp. z o.o. is the sole data controller for all orders and services provided via the Online Store, regardless of the customer’s location. This entity is responsible for:

  • all sales concluded via the Online Store,
  • fulfillment and logistics,
  • tax, accounting and invoicing obligations,
  • compliance with Regulation (EU) 2016/679 (GDPR).

3. Contact Regarding Personal Data

For all matters related to personal data processing and the exercise of data subject rights, you may contact us at:

Email: contact@qualash.com
Phone: +48 881 507 057
Post: Quacosmetics Sp. z o.o., ul. Domaniewska 37/2.43, 02-672 Warsaw, Poland

4. Data Protection Officer

The Controller has not appointed a formal Data Protection Officer within the meaning of Article 37 GDPR.

All matters relating to personal data protection may be addressed via: contact@qualash.com

5. Purposes and Legal Basis for Data Processing

Personal data is processed for the following purposes:

  • performance of sales contracts (order processing, delivery, order status notifications, invoicing, complaints, returns, guarantees),
  • responding to inquiries and providing customer support,
  • fulfillment of legal obligations, including tax and accounting requirements,
  • creation and maintenance of a customer account (if applicable),
  • sending newsletters and marketing communications (only with the customer’s consent),
  • enabling customers to submit product reviews,
  • establishment, exercise, or defense of legal claims,
  • ensuring the security and proper operation of the online store.

The legal bases for processing personal data are:

  • performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR),
  • compliance with legal obligations (Article 6(1)(c) GDPR),
  • consent of the data subject (Article 6(1)(a) GDPR),
  • legitimate interests of the Controller (Article 6(1)(f) GDPR), including fraud prevention, security, analytics, and internal business administration.

6. Categories of Personal Data Processed

Depending on the services used, the following categories of personal data may be processed:

  • first and last name,
  • billing and delivery address,
  • email address,
  • phone number,
  • account login credentials,
  • company name (for business customers),
  • tax identification number or VAT number (if required for invoicing).

7. Data Retention Period

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including:

  • the duration of the contract and statutory retention periods,
  • the period necessary to establish, pursue, or defend legal claims,
  • until consent is withdrawn (in cases where processing is based on consent).

8. Data Recipients

Personal data may be shared with trusted third parties only to the extent necessary, including:

  • courier, logistics and fulfillment providers,
  • payment service providers (e.g. Przelewy24, Stripe, PayPal, Shop Pay, Klarna),
  • accounting and legal service providers,
  • IT, hosting, and cloud service providers.

All such entities process personal data on the basis of agreements concluded with the Controller and solely in accordance with its instructions.

9. International Data Transfers

Personal data may be transferred to third countries (outside the European Economic Area) where necessary for the provision of services by our processors, using appropriate safeguards, including Standard Contractual Clauses, in accordance with applicable data protection laws.

10. Rights of Data Subjects

You have the right to:

  • access your personal data,
  • rectify inaccurate or incomplete data,
  • request deletion of personal data,
  • restrict processing,
  • object to processing based on legitimate interests,
  • data portability,
  • withdraw consent at any time (where processing is based on consent).

You also have the right to lodge a complaint with the competent supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

11. Cookies

The online store uses cookies to ensure proper operation of the website, improve user experience, generate statistics, and deliver content tailored to user preferences.

You may change cookie settings at any time via your browser settings. Restricting cookies may affect certain functionalities of the website.

12. Final Provisions

Providing personal data is voluntary but necessary to conclude a sales contract, create a user account, or receive certain services. Failure to provide required data may result in the inability to provide services.

This Privacy Policy may be updated from time to time. The current version is always available at www.qualash.com.

Last updated: 29 July 2026