1. Data controller
INOVA DIGI-TECH, SAS, Bâtiment D1, 16 rue de la Côte, 54000 Nancy, France, is the controller of the Esthetic Point shop’s data. For any question or request, write to contact@esthetic-point.com with the subject “Personal data”. The company has not appointed a data protection officer.
2. Data we process
Depending on how you interact with us: name and contact details, delivery and billing addresses, products ordered and order history, exchanges with customer service, professional status and company details, account data, preferences and consents, and technical connection and security data. Mandatory fields are needed for the service concerned; without them we cannot provide it.
Card details are entered on the secure page of our payment provider: we only receive the transaction identifier, status and amount. Never send customer service your full card number or security code. For a claim, attach only useful photos, without other people, medical documents or third-party data.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Ordering, payment, delivery and after-sales service | Performance of the contract or pre-contractual steps at your request |
| Invoicing, accounting and legal obligations | Legal obligation |
| Creating and managing your account | Performance of the requested service |
| Website security and fraud prevention | Legitimate interest |
| Handling disputes and defending our rights | Legitimate interest |
| Newsletter and optional trackers | Consent |
| Information about products similar to those already bought | Legitimate interest, with a simple right to object at any time |
Consent to marketing is never a condition of purchase. We do not take decisions based solely on automated processing that produce legal effects concerning you.
4. Recipients
Authorised INOVA DIGI-TECH staff access data within the limits of their duties. Depending on your order, our service providers receive only the information they strictly need:
-
Payment
Stripe, for card payment when offered.
-
Hosting
Hosting Ukraine LLC, the website host.
-
Delivery
Carriers and logistics partners who prepare and ship your order (name, address, delivery contact details).
-
Email
The provider that delivers our emails.
-
Advisers and authorities
Where a legal obligation or the defence of our rights requires it.
A logistics partner may not use your data for its own marketing. Your personal data is never published in a review without prior information.
5. Hosting and transfers outside the EEA
The website and its backups are hosted on a server located in Ukraine, outside the European Economic Area. Ukraine is not covered by an adequacy decision of the European Commission. You can ask us for information about the safeguards for this transfer at contact@esthetic-point.com. Other providers, such as the payment provider, may process data in other countries under their own safeguards.
6. Retention periods
-
Invoices and accounting records
10 years.
-
Online contracts of 120 euros or more
10 years, with access on request.
-
Data needed for a claim, guarantee or dispute
For the duration of the procedure and the applicable limitation periods, in a restricted-access archive.
-
Marketing
During the customer relationship and 3 years after the last active contact, unless you withdraw consent or object earlier. Simply opening an email does not extend this period.
-
Customer account
While the account is active; on closure, only data the law requires us to keep is retained.
7. Your rights
Under the conditions of the GDPR, you may request access to your data, rectification, erasure, restriction of processing and portability, and object to certain processing. You may withdraw consent at any time without affecting earlier processing, and set instructions for your data after your death. Unsubscribing from marketing is simple and free.
Write to us at contact@esthetic-point.com; in your account, the “Privacy” section also lets you download your data and request account deletion. Proof of identity is requested only where there is reasonable doubt. We reply within one month, which may be extended for complex requests with notice within the first month. You can lodge a complaint with the CNIL — www.cnil.fr — or with the authority in your country.
8. Security and changes
Access to data, its transmission (HTTPS) and backups are protected by appropriate measures; no system, however, is free of all risk. Never share your password and report any suspicious activity to us. Any significant change to this notice will be brought to your attention appropriately. Cookies are described on the Cookies page.