EFFECTIVE DOCUMENT · VERSION privacy-ua-en-2026-09-19-v3-sms
Privacy Policy
How ART BEAUTY uses information for orders, your account and support, and how you control its use.
1. Who is responsible for your information
The controller for artbeautybio.com is ART BEAUTY INDUSTRY LTD (Ukrainian registered name: ТОВАРИСТВО З ОБМЕЖЕНОЮ ВІДПОВІДАЛЬНІСТЮ "АРТ Б'ЮТІ ІНДАСТРІ"), EDRPOU company code 39816929. Registered address: Apartment 8, building 11, Azerbaidzhanskyi Passage, Kharkiv, Kharkiv region, 61124, Ukraine. For access, correction, deletion or consent requests, contact info@artbeautybio.com or +380 99 527 64 77. This policy covers the website, support enquiries, partner and influencer applications, and related portals.
2. Orders and delivery
Checkout requires your first name, last name, email, phone number and delivery details: region, city, courier address or selected branch or parcel locker. We keep the items, quantities, amount, promo code, payment method, statuses, order number and time, and accepted terms version. This information supports fulfilment, delivery, records, returns and customer service. Order emails are service messages, not a marketing subscription. Please do not include medical information or unnecessary personal details in comments.
3. Registration, security and reviews
An account is optional. Sign-in uses a verified email, registration method and protected session. When you choose Google, it supplies an account identifier, email and basic profile, including your name; the website does not receive your Google password or access to Gmail or Google Drive. A website password is stored only as a protected hash. When you choose phone sign-in or link a phone to your account, an SMS code verifies the number through AlphaSMS Verify. A review, rating and displayed name may be published after moderation; contacts and delivery addresses are not published with reviews.
4. Partners and influencers
Applications use the contacts, company or personal name, profile links and enquiry you provide. Approved cooperation adds access records, promo codes, statistics and remuneration records. An influencer receives only permitted information for orders attributed to their code: items, date, amount, status and earnings, without the buyer’s identity, address or payment method. Connecting Telegram is a separate action and uses your Telegram ID and, for phone-based onboarding, the contact number you choose to share.
5. Legal grounds and marketing
We process information for steps you request before a contract, performance of a contract, legal duties, and proportionate legitimate interests in security and protecting rights. Optional analytics and marketing require separate consent. Registration, a purchase or an enquiry does not subscribe you to marketing. The marketing option is not preselected and declining it does not prevent a purchase. Withdraw consent through an unsubscribe link in a marketing email or contact support. Withdrawal does not end processing that has another lawful basis.
6. Service providers and international processing
CRM access is limited by staff roles. The store server is hosted in Germany according to the infrastructure owner. Resend (Plus Five Five, Inc.) delivers service emails, Google Workspace handles corporate email, Google provides sign-in when you choose it, and Telegram supports connected staff bots. These services may also process information outside Ukraine and the EEA; the relevant provider’s processing terms and legally required international-transfer safeguards apply. Resend uses data-protection contractual terms, including EU Standard Contractual Clauses for applicable transfers. Information is not sold. Nova Poshta receives the details needed for delivery when the shipment is arranged; AlphaSMS processes SMS-verification data as described under SMS sign-in. Optional Google Analytics 4 and Microsoft Clarity operate only after your separate consent, as described below and in the Cookie Policy.
7. Retention and protection
Account information is kept while the account is used, then deleted or anonymised after closure unless a lawful accounting or rights-protection basis requires retention. Completed or expired sign-in secrets are cleared; temporary verification records are deleted 24 hours after completion or expiry through scheduled cleanup. Server backups are retained for up to 30 days and are not used for normal customer service. Restoring a backup must reapply previously completed deletions. Email and log data in the current standard Resend plan are retained for 30 days under its rules; its backups have a separate 7-day cycle. These technical periods do not shorten statutory order-record retention. Access, sessions and staff actions are protected, but absolute security cannot be guaranteed.
8. Your rights
You may obtain information about processing, access your information, request correction or deletion on lawful grounds, object to processing and withdraw consent. Email info@artbeautybio.com or call +380 99 527 64 77. We may request sufficient identity verification to protect your information, but not your password or PIN. Access requests are assessed within 10 working days and fulfilled within 30 calendar days unless the law provides otherwise. Complaints may be made to the Ukrainian Parliament Commissioner for Human Rights or a court. Cookies and analytics choices are described separately.
Optional analytics
With your consent, Google Analytics 4 (Google) measures public-page views and permitted product actions, while Microsoft Clarity (Microsoft) helps analyse clicks, scrolling, heatmaps and masked session replays with strict text and field masking. Providers receive connection data, including IP address, browser information and the permitted page address; this is not fully anonymous information. We do not send names, emails, phone numbers, delivery addresses, form contents or your account identifier. Portals, CRM, bag, checkout, search, intimate categories and URLs containing parameters are excluded. Advertising features and personalisation are disabled. Google and Microsoft may process data outside Ukraine and the EEA, including in the USA, under their data-protection terms and applicable international-transfer safeguards. GA4 event and user data retention is 2 months without renewal through new activity; aggregated reports have separate retention periods. Clarity ordinary recordings are kept for 30 days; sampled or favourite recordings are kept for up to 9 months. Aggregated report retention follows the service’s separate rules. Decline or withdraw through Cookie settings without limiting use of the store.
SMS sign-in
When you request an SMS code to sign in or link a Ukrainian phone number, our server sends AlphaSMS Verify your number and message language; verification also sends the entered code and request identifier. The provider is ТОВ «ІНВЕСТУМ» (INVESTUM LLC, Ukraine, EDRPOU 36852257), operating AlphaSMS. It creates and sends the code, checks it and returns the result. Its policy provides for processing message content on the customer's instructions and sharing with telecom operators and service providers for delivery; AlphaSMS may determine its own processing purposes for some metadata. For this verification we do not send bag contents, delivery address, email or account password. The code lasts 5 minutes, with up to 5 verification attempts. This does not mean AlphaSMS deletes the data after 5 minutes: its exact processing countries and Verify retention periods have not been confirmed to us. Our own temporary website records and backups follow the periods in the retention section. An SMS code is not a marketing subscription or analytics consent. Google, email and guest checkout remain available. For data access or deletion, contact info@artbeautybio.com.
Document version
Effective 19 September 2026. Version privacy-ua-en-2026-09-19-v3-sms. This document covers personal information and sign-in; it does not itself open ordering or payments.