Privacy policy

PRIVACY POLICY

 

Effective Date: June 30, 2025

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

JF Beauty-Lab SLU

Avinguda de Joan Miró 360
07015 Palma, San Agustí Mallorca
Spain

Phone: +34 611075567

Email: info@junkfreemarket.com

2. Collection and Processing of Personal Data

2.1 When Visiting the Website

When accessing our website, the following data is automatically collected:

• IP address of the accessing computer

• Date and time of access

• Name and URL of the retrieved file

• Amount of data transferred

• Message about successful retrieval

• Browser type and version

• User's operating system

• Referrer URL

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the proper functioning of the website).

2.2 During Registration and Ordering Process

The following data is collected:

• First and last name

• Email address

• Billing address

• Delivery address (if different)

• Payment information

• Phone number (optional)

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance).

2.3 When Contacting Us

When using the contact form or email contact, the transmitted data is stored to process the inquiry.

Processing is based on Art. 6 para. 1 lit. a GDPR (consent) and lit. f (legitimate interest in processing the inquiry).

3. Cookies

3.1 Technically Necessary Cookies

These are required for the basic functions of the website. Legal basis: Art. 6 para. 1 lit. f GDPR.

3.2 Analytics and Marketing Cookies

These are only set after explicit consent. Legal basis: Art. 6 para. 1 lit. a GDPR.

4. Data Sharing

Personal data is only transmitted to third parties:

• For contract fulfillment (payment processing, shipping)

• When legally required

• With explicit consent

4.1 Payment Service Providers

Payment data is transmitted to the selected payment provider.

4.2 Shipping Service Providers

Delivery data is transmitted to the shipping company.

5. Hosting by Shopify

Our website is hosted via Shopify. Shopify processes data on our behalf according to Art. 28 GDPR. A data processing agreement has been concluded. Data transfers to the USA are based on the EU-U.S. Data Privacy Framework.

Should data be transferred to other third countries, this occurs in compliance with the requirements of Art. 44 ff. GDPR, e.g., through standard contractual clauses.

6. Newsletter

For newsletter registration, the email address is processed using the double opt-in procedure. Legal basis: Art. 6 para. 1 lit. a GDPR. Revocation possible at any time.

You have the right to object to the processing of your personal data for direct marketing purposes at any time (Art. 21 GDPR).

7. Storage Period

Personal data is deleted as soon as the purpose of storage ceases, unless legal retention obligations exist.

8. Data Subject Rights

You have the right to:

• Information (Art. 15 GDPR)

• Rectification (Art. 16 GDPR)

• Erasure (Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Object (Art. 21 GDPR)

• Withdraw consent (Art. 7 para. 3 GDPR)

• Lodge a complaint with the supervisory authority (Art. 77 GDPR)

9. Data Security

We implement technical and organizational measures to protect your data. Data transmission is SSL/TLS encrypted.

10. Changes to this Privacy Policy

This privacy policy may be adapted as needed. The current version is always available on our website.

Contact for data protection matters: [Email address] [Postal address]