Privacy policy

PERSONAL DATA PROTECTION

I. DATA CONTROLLER

The data controller within the meaning of Regulation (EU) 2016/679 (GDPR) is SKINTELLECT Ltd. (СКИНТЕЛЕКТ ЕООД), UIC 208484644, VAT No. BG208484644, with its registered office and address of management at 155 Cherni Vrah Blvd., 1407 Sofia, Bulgaria, owner of the online store www.rootina.com. For questions related to the processing of personal data, you can contact us at: connect@rootina.com

II. WHAT DATA WE COLLECT

Depending on how you use the Site, we may process the following categories of personal data:

• Data you provide when placing an order or registering: name, delivery address, phone number, email address.

• Payment-related data - processed directly by the payment service provider; the Seller does not store bank card data.

• Technical data: IP address, device and browser type, cookie identifiers, data about your behavior on the Site (pages visited, products clicked, shopping cart history).

• Data you provide voluntarily when subscribing to the newsletter or contacting the Rootina team.

III. FOR WHAT PURPOSES WE USE YOUR DATA

• Processing and delivering orders, communication about order status and returns.

• Accounting and compliance with legal obligations (issuing invoices, accounting records).

• Analyzing traffic and improving the functionality of the Site (Google Analytics, Google Tag Manager).

• Showing relevant ads and measuring their effectiveness (Google Ads, Meta Pixel).

• Sending marketing messages, newsletters and personalized offers - only with your explicit consent (Klaviyo).

The legal basis for processing is the performance of a contract (for orders and deliveries), a legal obligation (accounting), legitimate interest (analytics and service improvement) or explicit consent (marketing messages and ad targeting), which may be withdrawn at any time.

IV. COOKIES AND THIRD PARTIES USED ON THE SITE

To achieve the purposes above, the Site uses the following third-party tools, through cookies and similar technologies:

Tool	Purpose	Data processed	Provider / retention
Google Tag Manager	Managing and loading marketing and analytics tags/scripts on the Site.	Technical data for loading tags; GTM itself does not store personal data.	Google Ireland Ltd. / up to 2 years
Google Analytics	Statistics on traffic and User behavior on the Site, and improving content.	IP address (anonymized), device/cookie identifier, behavior data on the Site.	Google Ireland Ltd. / up to 14 months
Google Ads	Showing personalized ads and measuring the effectiveness of ad campaigns (remarketing).	Cookie identifier, browsing history, ads the User has interacted with.	Google Ireland Ltd. / up to 540 days
Meta (Facebook) Pixel	Measuring the effectiveness of Facebook/Instagram ads and remarketing to Site Users.	Cookie identifier, IP address, actions on the Site (product views, add to cart, orders).	Meta Platforms Ireland Ltd. / up to 180 days
Klaviyo	Sending email marketing, automated messages, newsletters and personalized offers.	Name, email address, order history, behavior on the Site (for personalization).	Klaviyo, Inc. / until unsubscribe

Analytics and advertising cookies are loaded only after the User has given consent through the cookie banner on the Site, in accordance with Regulation (EU) 2016/679 and the Electronic Communications Act. The User may withdraw consent or change cookie preferences at any time through their browser settings or the cookie banner on the Site.

V. TRANSFER OF DATA TO THIRD PARTIES AND OUTSIDE THE EU

Google Ireland Ltd., Meta Platforms Ireland Ltd. and Klaviyo, Inc. act as processors of personal data on behalf of the Seller and may transfer data to servers outside the European Union (including the USA). In such cases, appropriate safeguards under Art. 46 GDPR apply, including standard contractual clauses approved by the European Commission. The Seller does not sell personal data to third parties.

VI. RETENTION PERIOD

Personal data is stored only for the period necessary to achieve the purposes for which it was collected, or as required by law (e.g. accounting documents are kept for 10 years under the Accountancy Act). Data used for marketing purposes is stored until the User withdraws consent.

VII. USERS' RIGHTS

Under the GDPR, Users have the right to: access their personal data; rectification of inaccurate data; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing based on legitimate interest or direct marketing; withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, please contact us using the contact details above. Users also have the right to lodge a complaint with the Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg).

VIII. DATA SECURITY

The Seller applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure, including an encrypted connection (SSL) and restricted access to information systems.

IX. CHANGES TO THIS POLICY

The Seller reserves the right to update this Privacy Policy; changes take effect from their publication on the Site.