CosmeticShelf Privacy Policy
Last updated: 20 August 2026
This Privacy Policy explains how personal data is processed when using the CosmeticShelf online store at cosmeticshelf.com.
1. Controller of Personal Data
The controller of personal data is:
AXIS PÄRNU OÜ
For questions regarding the processing of personal data:
axisest@mail.ru
2. Personal Data We Process
Depending on the user’s activities, the following personal data may be processed:
- first name and last name;
- email address;
- telephone number;
- delivery address or selected pickup point;
- information about ordered products, their quantity and price;
- payment status information;
- delivery and shipment status information;
- account data, if the user creates an account on the website;
- correspondence with CosmeticShelf;
- information and materials provided when returning a product, contacting CosmeticShelf or submitting a complaint;
- IP address, browser and device information, and other technical data related to the operation and security of the website;
- website usage data collected through cookies and similar technologies.
3. Sources of Personal Data
Most personal data is provided directly by the user when placing an order, creating an account or contacting CosmeticShelf.
CosmeticShelf may also receive:
- payment status information from the payment service provider;
- delivery status information from the postal or courier service;
- technical data generated while using the website.
CosmeticShelf does not receive or store the buyer’s bank card details.
4. Purposes and Legal Bases for Processing
Placing and Fulfilling an Order
Personal data is used for:
- placing and confirming an order;
- preparing the products;
- processing payment information;
- arranging delivery;
- communicating with the buyer regarding the order;
- handling returns and complaints.
Legal basis: entering into and performing a contract with the buyer.
Compliance with Legal Obligations
Necessary data is processed in order to comply with accounting, tax and other obligations imposed by law.
Legal basis: compliance with a legal obligation.
Security and Protection of Rights
Personal data may be processed to the extent necessary to ensure the security of the online store, prevent misuse, resolve disputes and protect legal claims.
Legal basis: the legitimate interest of AXIS PÄRNU OÜ in ensuring the security of its activities and protecting its rights.
Analytics and Advertising
If the website uses analytics or advertising technologies that require the user’s consent, the relevant processing is carried out only after such consent has been obtained.
Legal basis: user consent.
Marketing Communications
Contact details may be used to send advertising and informational communications where there is an appropriate legal basis.
The user may opt out of such communications at any time.
5. Data Required for Placing an Order
To place and fulfil an order, the buyer must provide the data necessary for entering into and performing the contract.
Depending on the selected delivery method, this may include:
- first name and last name;
- email address;
- telephone number;
- delivery address or selected pickup point.
If the required data is not provided, CosmeticShelf will not be able to fulfil the order or the relevant part of the service.
Providing other data is voluntary unless such data is required by law or by the nature of the relevant service.
6. Payment
Payments are processed through a payment service provider.
CosmeticShelf does not receive or store the buyer’s bank card details.
CosmeticShelf receives the information necessary to determine the payment status of the relevant order.
7. Delivery
For the purpose of completing a specific delivery, the postal or courier service is provided with the data necessary to deliver the shipment, including:
- first name and last name;
- telephone number;
- delivery address or selected pickup point;
- other information necessary to complete the delivery.
Data is transferred only to the extent necessary to complete the delivery.
8. Recipients of Personal Data
Personal data may be transferred or made available only to the extent necessary for the relevant purpose of processing:
- postal and courier services — for delivery of the order;
- hosting and technical infrastructure providers — in connection with the technical operation of the online store and hosting of data;
- accounting software providers — to the extent necessary for accounting and tax purposes;
- analytics and advertising technology providers — where such technologies are used and there is an appropriate legal basis for the relevant processing.
Personal data is transferred to other recipients only where there is a legal basis provided by applicable law.
9. Retention of Personal Data
Personal data is retained no longer than necessary for the relevant purpose of processing.
Online order data is retained for the period necessary to fulfil the order, process returns and complaints, and protect legal claims.
Once the relevant need no longer exists, the data is deleted or anonymised unless further retention is required by law.
Data contained in accounting documents and required for compliance with accounting and tax obligations is retained for the period prescribed by law.
Data processed solely on the basis of consent is retained until the consent is withdrawn or the relevant purpose of processing ends, unless another legal basis exists for further retention.
Technical data required to ensure the security of the website is retained only for the period necessary for that purpose.
10. Cookies and Similar Technologies
CosmeticShelf uses technically necessary cookies and similar technologies required for the operation of the online store, including for:
- operation of the shopping cart;
- saving the contents of the shopping cart;
- maintaining the user session;
- processing orders;
- operation of the user account;
- ensuring website security.
The website may use analytics and advertising technologies, including Google Analytics, Google Tag Manager and Meta Pixel.
Technologies that require the user’s consent under applicable law are activated only after such consent has been obtained.
The user may accept or reject optional categories of cookies and may later change their choice through the cookie settings on the website.
Detailed information about the cookies actually used, their purposes and retention periods is provided separately in the cookie settings or Cookie Policy.
11. Transfers of Personal Data Outside the European Economic Area
When certain technical, analytics, advertising or other external services are used, personal data may be processed outside the European Economic Area.
Such transfers are carried out only where there is a legal basis under the GDPR, including on the basis of a European Commission adequacy decision or with the use of safeguards provided by law, such as the European Commission’s Standard Contractual Clauses.
12. User Rights
In the cases provided by law, the user has the right to:
- receive information about the processing of their personal data;
- access their personal data;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing;
- exercise the right to data portability where applicable;
- withdraw previously given consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
The right to deletion does not apply where there is a lawful basis for further retention or processing of the data.
To exercise their rights, the user may contact:
13. Complaint to the Supervisory Authority
The user has the right to lodge a complaint with the data protection supervisory authority.
In Estonia, the supervisory authority is:
Andmekaitse Inspektsioon