Privacy policy

The controller of your personal data is Pelart Laboratory LLC (EDRPOU code 37517967), Premises 743, 44A Yevhena Konovaltsia Street, Kyiv 01133, Ukraine.

We receive data from you through the forms on the website and in your requests and, for technical data, when you open its pages. If a salon or treatment room attaches a document of one of its specialists to an application, we receive that data from the applicant. We process it in accordance with the Law of Ukraine “On Personal Data Protection”.

• Placing an order — first name, surname, phone number, e-mail address; delivery details (town or city, Nova Poshta branch or parcel locker, or an address for the courier); a note to your order; the contents and total of the order; the payment method. No registration is needed.
• Your account — e-mail address (your login), first name, surname, phone number, delivery addresses, order history, password (we keep only a hash) and, if you sign in with Google, the name and e-mail address from Google. The account is created automatically with your first order from a new e-mail address, or when you register; you can delete it under “Profile” or on request.
• Bonus programme — bonuses earned and spent on your orders, your personal promo code and invitation link; if you placed an order with someone else’s promo code or via an invitation link, who invited you. The person who invited you sees only the amount, date and status of the bonuses they earned and gets an email when they are added — not your name, contact details or what you ordered.
• Recommendations — products you have viewed, your skin type if you chose one, and your previous orders: the website uses them to suggest products in your account and cart.
• Website statistics — pages and products viewed, search queries (except ones that look like a phone number or e-mail address), items added to the cart or wishlist, starting checkout, the payment method and promo code, the order number and total, requests (“Call me back”, partnership), registration and sign-in, and taps on the phone number, Viber, e-mail and social media links; where you came to the website from (for example, an ad), your device and browser type, and your approximate location based on your IP address. Google Analytics and the Meta pixel collect this through cookies (see “Cookies and browser storage”); your name, phone number, e-mail address and delivery address are not included.
• “Call me back” on the Contact page — your name and phone number.
• Partnership application on the For professionals page — full name, phone number, e-mail address, role (skincare specialist, dermatologist, beauty salon or treatment room), place of work or salon name, town or city, Instagram or website, a comment, and scans or photos of a diploma or certificate (up to 3 files).
• Your requests (returns, claims, personal data requests) — your name, the contact details you used (e-mail, phone, Viber), order number, description, photos of the product, its packaging and labelling; for refunds of bank transfer or cash-on-delivery payments — your IBAN.
• Technical data — server logs: IP address, time of the request, page address, browser details.

We do not receive your card details: you enter them on the secure WayForPay page. We do not ask for anything we do not need for these purposes.

Scans or photos of a diploma or certificate are used only to verify your qualifications and open access to the partner account.

• You may cover the photo and the document number if they are not needed for the check. Your name and qualification must remain visible.
• The files are kept in closed storage. Only the staff who review applications have access to them.
• We delete the scans within 30 days of the decision on the application. The partner record keeps only a note of the check: the type of document and the date.

If a salon or treatment room applies and attaches a specialist’s document, it must tell the specialist and obtain their consent. The specialist has the same rights as those described under “Your rights”.

• Orders — to conclude and perform the contract: to process, take payment for and deliver your order, contact you about it and handle return requests.
• Your account — so you can sign in, see the history and status of your orders and avoid entering your details and addresses each time.
• Bonus programme — to add cashback and invitation bonuses and let you use them to pay for orders.
• Recommendations — to suggest products that complete your routine and, if you agreed, to remind you when it may be time to reorder.
• Statistics and advertising — to understand how the website is used and what gets in the way of placing an order, and to measure whether our advertising on Google, Facebook and Instagram works.
• “Call me back” — to call you back.
• Partnership application — to verify your qualifications and open access to the partner account.
• Your requests — to handle returns, claims and personal data requests and reply to them.
• Technical data — to keep the website running reliably and securely.
• Accounting — to meet our legal obligations in accounting and tax.

We do not send newsletters. We send reorder reminders only if you agreed to them (in your account or after placing an order); you can switch them off in your account or via the link in every such email. Other promotional messages are possible only with your separate consent, and every one of them lets you opt out.

The grounds are set by Article 11 of the Law of Ukraine “On Personal Data Protection”:

• orders — concluding and performing the contract (see the Public offer), and the obligations the law places on us (accounting and tax);
• your account — concluding and performing the contract: the account is part of how we serve your orders on the website; it is created with an order or at your request when you register;
• bonus programme and recommendations — performing the contract: they are part of the service in your account; reorder reminders — your consent;
• statistics and advertising — our legitimate interest (Article 11(6) of the Law): improving the website and measuring our advertising. You can object to this by writing to us (see “Contact”) and limit it in the ways described under “Cookies and browser storage”;
• “Call me back” — your request: steps taken before a contract is concluded;
• partnership application — your request: steps taken before a contract is concluded; for a specialist’s document attached by a salon or treatment room — the specialist’s consent, obtained by the applicant;
• your requests — performing the contract and the obligations the law places on us (consumer protection, personal data protection);
• technical data — our legitimate interest in protecting the website from failures and abuse.

Only those we need in order to fulfil your order, run the website, keep statistics and advertise, or comply with the law:

• Nova Poshta / NovaPay — the data needed for delivery and cash on delivery;
• Financial Company WAY FOR PAY LLC (WayForPay) — for online payment: first name, surname, e-mail address, phone number, products and amount; WayForPay processes the payment under its own agreement with the payer;
• hosting provider — the website’s servers are located in the European Union;
• order and enquiry management system (CRM) — order, enquiry and application data;
• e-mail service — through which we send order confirmations and e-mails about your order and account;
• Telegram — the staff group in which our managers handle orders, partnership applications (including the qualification document) and call-back requests: name, contact details, order contents and delivery; only our staff have access to it;
• Google — only if you sign in with Google: Google passes us your name and e-mail address and knows that you signed in to our website;
• Google (Google Analytics) and Meta Platforms (the Meta pixel — Facebook, Instagram) — the website statistics described under “The data we collect”; we do not pass them your name, phone number, e-mail address or delivery address;
• public authorities — only where the law provides for it.

We do not sell personal data or pass it on for anyone else’s advertising. Meta also uses Meta pixel data to deliver advertising on its platforms, under its own rules.

Transfers abroad. The website’s servers are located in the European Union. EU member states belong to the European Economic Area and are parties to Council of Europe Convention No. 108, and so provide adequate protection of personal data (Article 29 of the Law of Ukraine “On Personal Data Protection”). Google processes data under its own rules when you sign in with Google. Google Analytics and the Meta pixel are services of Google and Meta Platforms; the data they collect may be processed on their servers outside Ukraine, including in the USA, under those companies’ rules.

Retention periods:

• orders — 3 years from the order date (the limitation period); accounting records — as long as the law requires;
• your account — for as long as it exists: you can delete it at any time, after which order data is kept as set out above;
• bonus account — for as long as your account exists; bonuses earned on orders — together with the order data;
• statistics — up to 14 months in Google Analytics; in Meta, under Meta’s rules;
• your requests — with the order data, 3 years from the order date;
• “Call me back” — up to 6 months;
• partnership application — for as long as the partnership lasts or, if the application is not approved, up to 6 months; document scans — up to 30 days after the decision on the application;
• server logs — 7 days.

After that, we delete or anonymise the data.

Your data is protected by organisational and technical measures: only staff who need it for their work have access to it, and the website uses a secure connection.

Under Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right:

1. to know the sources from which your personal data was collected, where it is held, the purpose of processing and the location of the controller or processor, or to authorise others to obtain this information for you;
2. to receive information on the conditions of access to your personal data, including the third parties to whom it is passed;
3. to access your personal data;
4. to receive, within 30 calendar days of your request, an answer as to whether your personal data is being processed, and its content;
5. to submit a reasoned objection to the processing of your personal data;
6. to submit a reasoned demand that your personal data be changed or destroyed if it is processed unlawfully or is inaccurate;
7. to have your personal data protected from unlawful processing, accidental loss, destruction or damage, and from the disclosure of information that is inaccurate or harms your honour, dignity and business reputation;
8. to complain about the processing of your personal data to the Ukrainian Parliament Commissioner for Human Rights or to a court;
9. to use legal remedies if the law on personal data protection is breached;
10. to make reservations restricting the processing of your personal data when giving consent;
11. to withdraw your consent to processing;
12. to know how automated processing of personal data works;
13. to be protected from an automated decision that has legal consequences for you.

To exercise these rights, write to [email protected] or call +38 099 089 89 26. We consider requests within 10 working days and answer and act on them within 30 calendar days of receipt.

Cookies are set for:

• signing in to your account — the WordPress session cookie (wordpress_logged_in_…) keeps you signed in for up to 14 days or until you choose “Sign out”;
• Google Analytics (Google) — _ga and _ga_…, for up to 2 years: visit and order statistics;
• the Meta pixel (Facebook, Instagram) — _fbp and, if you arrived from an ad, _fbc, for up to 90 days: they measure whether our advertising works and help show it to people who may be interested.

Google Analytics and Meta receive only events from the website: pages and products viewed, search queries (except ones that look like a phone number or e-mail address), items added to the cart or wishlist, starting checkout, the payment method and promo code, the order number and total, requests (“Call me back”, partnership), registration and sign-in, and taps on the phone number, Viber, e-mail and social media links. We do not pass your name, phone number, e-mail address or delivery address; the website removes the service parts of links from our e-mails (e-mail address, keys) from the page address before these services can see it. If you are signed in to Facebook or Instagram in this browser, Meta may link the visit to your account under its own rules. Analytics is never switched on for website staff signed in to the admin area.

To make the cart, wishlist and forms work, the website stores data in your browser, on this device:

• localStorage (until you clear it): pel.cart.v1 — cart; pel.wish.v1 — wishlist (when you are signed in, a copy is also kept in your account so it is the same on all your devices); pel.seen.v1 — products you have viewed (also kept in your account when you are signed in); pel.skin.v1 — your skin type, if you chose one; pel.ref.v1 — an invitation code, if you followed an invitation link (for the period set by the programme, currently 30 days); pel.pro.v1 — the status of your partnership application and the details you entered in it; pel.cab.* — the partner account cart and account service data on this device. Your account details (e-mail, name, phone, addresses, orders, and your password, stored only as a hash) are kept on the website’s server.
• sessionStorage (until you close the tab): pel.checkout.draft — checkout draft; pel.checkout.promo — the promo code for this checkout (typed in or taken from an invitation link); pel.an — analytics service marks (which events have already been sent), so that a purchase is not counted twice; pel.order.pending and pel.order.done — your latest order; pel.cab.* — account session data.

You can clear this data and block cookies in your browser settings — the cart, wishlist and checkout work without analytics cookies. You can stop events being sent to Google Analytics altogether with the Google Analytics Opt-out browser add-on or a third-party script blocker; you can change how Meta uses data from other websites in Facebook or Instagram under “Your activity off Meta technologies” and in your ad settings.

We may update this policy. A new version takes effect once it is published on this page; the date of the latest version is shown at the top.