{"id":71,"date":"2026-07-07T01:32:12","date_gmt":"2026-07-06T22:32:12","guid":{"rendered":"http:\/\/kbeautyone.com\/privacy\/"},"modified":"2026-10-10T22:39:55","modified_gmt":"2026-10-10T19:39:55","slug":"privacy","status":"publish","type":"page","link":"https:\/\/kbeautyone.com\/en\/privacy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<\/p>\n

1. Who controls your data<\/h2>\n

Data controller:<\/p>\n

MB Onebalt<\/strong> (trading as the KBeautyOne webshop)
\nCompany registration number 308099546<\/code>, Krokuvos g. 53-3, LT-09306 Vilnius, Lithuania
\nData protection contact: privacy@kbeautyone.com<\/code><\/p>\n

We have not appointed a Data Protection Officer; Article 37 GDPR does not require one in our case. Please send all data questions to the address above.<\/p>\n

2. What we collect, why, and on what legal basis<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n
Data<\/th>\nPurpose<\/th>\nLegal basis<\/th>\nRetention<\/th>\n<\/tr>\n<\/thead>\n
Name, e-mail, phone, delivery and billing address linked to an order<\/td>\nFulfilling and delivering the order, contacting you and keeping accounting records<\/td>\nContract and legal obligation (Art. 6(1)(b), (c) GDPR)<\/td>\n10 years where needed for order and accounting records<\/td>\n<\/tr>\n
Order contents, amount, payment status<\/td>\nFulfilment and accounting<\/td>\nContract and legal obligation (Art. 6(1)(b), (c))<\/td>\n10 years<\/td>\n<\/tr>\n
Account data (e-mail, password hash, preferences)<\/td>\nRunning your account<\/td>\nPerformance of a contract (Art. 6(1)(b))<\/td>\nUntil deletion or 3 years of inactivity; order\/accounting records remain under their separate period<\/td>\n<\/tr>\n
Returns and complaints data<\/td>\nHandling returns and statutory claims<\/td>\nLegal obligation and legitimate interest (Art. 6(1)(c), (f))<\/td>\nCorrespondence 3 years; accounting documents 10 years<\/td>\n<\/tr>\n
Contact and complaint e-mails (name, e-mail, order no., message)<\/td>\nAnswering an enquiry or complaint<\/td>\nLegitimate interest and, where applicable, legal obligation (Art. 6(1)(f), (c))<\/td>\n3 years<\/td>\n<\/tr>\n
Newsletter e-mail address<\/td>\nSending the newsletter<\/td>\nConsent (Art. 6(1)(a)), confirmed by double opt-in<\/td>\nUntil you withdraw consent<\/td>\n<\/tr>\n
Technical and security records (IP address, browser data, server logs)<\/td>\nSite operation, security, fraud prevention<\/td>\nLegitimate interest (Art. 6(1)(f))<\/td>\nSiteGround archived access logs: 30 days<\/td>\n<\/tr>\n
Cookies<\/td>\nSee the Cookie Policy<\/a><\/td>\nEssential: technical necessity \/ legitimate interest. All others: consent<\/td>\nSee cookie policy<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

You provide the data yourself. Name, address, e-mail and payment details are necessary to conclude the contract \u2014 without them we cannot fulfil an order.<\/p>\n

We do not knowingly collect children's data.<\/strong> The shop is intended for adults.<\/p>\n

3. Who we share data with<\/h2>\n

We do not sell your data. We share only what is necessary, with:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Recipient<\/th>\nFor<\/th>\nLocation<\/th>\n<\/tr>\n<\/thead>\n
SiteGround<\/strong> (hosting and server-based e-mail sending)<\/td>\nSite and MailPoet data storage, backups, message delivery<\/td>\nEU \/ subject to provider service terms<\/td>\n<\/tr>\n
Warehouse and fulfilment partner (processor)<\/strong><\/td>\nName, delivery address, phone and e-mail to prepare the parcel<\/td>\nEU<\/td>\n<\/tr>\n
LP EXPRESS \/ Lietuvos pa\u0161tas<\/strong> (delivery)<\/td>\nName, delivery address or locker, phone and e-mail<\/td>\nEU<\/td>\n<\/tr>\n
Paysera<\/strong> (payments; may act as an independent controller for a payment)<\/td>\nPayment and order identifiers<\/td>\nSubject to Paysera's privacy policy<\/td>\n<\/tr>\n
MailPoet<\/strong> (newsletter tool installed on our site)<\/td>\nE-mail and subscription status stored on our site; current sending method is our host's PHPMail, not MailPoet Sending Service<\/td>\nSiteGround server<\/td>\n<\/tr>\n
Google Ireland \/ Google LLC<\/strong>, only if you use the active Google sign-in<\/td>\nSign-in identity data<\/td>\nEU \/ USA under provider terms<\/td>\n<\/tr>\n
Our accountant<\/td>\nAccounting records<\/td>\nEU<\/td>\n<\/tr>\n
Public authorities<\/td>\nOnly where the law requires it<\/td>\nLT<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

No analytics or advertising pixels are active on this site today.<\/strong> We will update this and the cookie policy before enabling such a tool.<\/p>\n

4. Transfers outside the EU<\/h2>\n

We seek to keep data in the EU\/EEA. If you use Google sign-in, identity data may be transferred to Google group companies outside the EEA. Paysera may use other recipients for payments, including outside the EEA, as described in its privacy policy<\/a>. Where a transfer outside the EEA applies, appropriate GDPR Chapter V safeguards must be in place. We will confirm the relevant provider contracts and transfer grounds before publication.<\/p>\n

5. Your rights<\/h2>\n

You have the right to:<\/p>\n