Privacy Policy

Last Updated: August 7, 2026

This Privacy Policy applies to arbū cosmetics, operated by:

Arbu Cosmetics Ltd.

BULGARIA, Sofia, Lozenets district, 1407, 22-24 Krichim Str.

Company registration number: 204313553

VAT number: BG204313553

For the purposes of this Privacy Policy, the company will be referred to as “arbū”.

1. General Information and Mandatory Disclosures

We take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations and this Privacy Policy.

Controller responsible for data processing: Arbu Cosmetics Ltd. Registration number: 204313553 Email: arbu@arbucosmetics.com, BULGARIA, Sofia, Lozenets district, 1407, 22-24 Krichim Str.

Full legal and regulatory disclosures are provided on the Impressum (Legal Notice) page.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

2. Scope of Data Collection

2.1 Information Provided Voluntarily: We collect personal data when you voluntarily provide it to us during the registration process, when placing an order, or when subscribing to our newsletter. This includes, but is not limited to, your full name, shipping and billing addresses, email address, and telephone number. We also note that your IP address is stored temporarily during the checkout process to prevent fraud.

2.2 Automated Data Collection: Upon accessing our website, certain technical data is automatically recorded by our IT systems. This includes technical metadata such as browser type, operating system, IP address, and the specific time of access.

2.3 Legal Basis for Processing:

  • Contractual Necessity (Art. 6 (1) (b) GDPR): For the fulfillment of purchase agreements and delivery of goods.
  • Explicit Consent (Art. 6 (1) (a) GDPR): For marketing communications and the use of non-essential cookies.
  • Legal Obligation (Art. 6 (1) (c) GDPR): To comply with statutory tax and commercial retention requirements.
  • Legitimate Interests (Art. 6 (1) (f) GDPR): To maintain website security, integrity, and performance.

3. Utilization of Data

Personal data is processed exclusively for the following purposes:

  • Contractual Fulfillment: Managing orders, processing payments, and coordinating logistics with shipping partners.
  • Customer Relationship Management: Facilitating professional support and responding to inquiries submitted via contact forms.
  • Marketing Communications: If you have provided explicit double opt-in consent, we will utilize your email address for promotional updates. You may revoke this consent at any time via the “unsubscribe” link located in each communication.
  • System Optimization: Analyzing anonymized data to improve website functionality and user experience.

Storage Duration: We store your data only as long as necessary for the purpose of processing. Commercial and tax-related data (e.g., invoices) must be stored for 10 years or the respective statutory period. Newsletter data is deleted immediately upon unsubscription.

4. Disclosure to Marketing Tools

We do not sell or trade your personally identifiable information to external parties for commercial gain. Data is only shared with trusted service providers to the extent necessary for business and marketing operations:

  • Logistics Partners: For the physical delivery of ordered merchandise.
  • Financial Institutions & Payment Processors: For secure transaction handling.
  • Technical Service Providers: For hosting and maintaining the digital infrastructure.

Marketing and Analytical Tracking (Meta Pixel, Google Ads, CAPI): Our website utilizes advanced tracking technologies, including the Meta Pixel, Facebook Conversion API (CAPI), and Google Ads Conversion Tracking. These tools allow us to measure the effectiveness of our advertisements and display personalized content based on your browsing behavior.

  • Consent Requirement: The processing of data through these tools occurs exclusively on the basis of your explicit consent pursuant to Art. 6 (1) (a) GDPR. By providing consent via our Consent Management Platform (Cookie Banner), you agree that your data (such as IP address, browser information, and purchase events) may be transmitted to and processed by these providers for marketing and retargeting purposes.
  • Data Processing in Third Countries: Please note that using these tools may involve the transfer of data to servers in the United States. We ensure that such transfers are governed by the EU-U.S. Data Privacy Framework or Standard Contractual Clauses to maintain a level of protection equivalent to the GDPR.
  • Revocation of Consent: You may revoke your consent for marketing tracking at any time with future effect by adjusting your preferences in our [Cookie Settings].

5. Cookies and Analytical Tools

Our website utilizes cookies and similar technologies to enhance functionality and security. Cookies are small text files that are stored on your device and help us improve our website and marketing activities.Cookies are only set after you have given your explicit consent, except for strictly necessary cookies required for the operation of the website.

  • Strictly Necessary Cookies: These are essential for the technical operation of the online shop and do not require prior consent.
  • Analytical/Marketing Cookies: These are deployed only following your explicit consent via our Consent Management Platform (Cookie Banner). You have the right to “Reject All” with the same ease as “Accept All.”

5.1. Consent Management

We use Borlabs Cookie as our Consent Management Platform (CMP). Borlabs enables us to obtain, manage and document your consent for the use of cookies and similar technologies in accordance with Art. 6(1)(a) GDPR and applicable ePrivacy regulations.

5.2 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4 processes data such as:

  • IP address (automatically shortened and anonymized within the EU)
  • Device and browser information
  • Pages visited
  • Interaction and event data

IP anonymization is enabled by default in GA4.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR.

Google may process data on servers outside the European Union, including the United States. In such cases, data transfers are safeguarded through the EU-U.S. Data Privacy Framework or Standard Contractual Clauses pursuant to Article 46 GDPR.

You may withdraw your consent at any time via the Cookie Settings.

5.3. Google Ads

We use Google Ads conversion tracking, provided by Google Ireland Limited.

Conversion tracking allows us to measure the effectiveness of our advertising campaigns and to optimize our marketing activities.

Conversion tracking cookies are only set after you have provided your explicit consent.

Legal basis: Article 6(1)(a) GDPR.

5.4. Google Tag Manager

We use Google Tag Manager, a tag management system provided by Google Ireland Limited.

Google Tag Manager itself does not set cookies or process personal data. It is used to manage and deploy tracking scripts on our website.

Tags that collect personal data are only activated after you have provided your consent.

Legal basis: Article 6(1)(a) GDPR (where applicable).

5.5. Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

The Meta Pixel enables us to measure the effectiveness of our advertisements and to optimize marketing campaigns.

Data processing only occurs after you have provided your consent pursuant to Article 6(1)(a) GDPR.

Meta may process data outside the European Union, including in the United States. Appropriate safeguards are applied in accordance with Article 46 GDPR.

You may withdraw your consent at any time via the Cookie Settings.

6. Your Legal Rights (Art. 15–22 GDPR)

As a data subject, you have the following rights:

  • Right to Access: To know what data we store about you.
  • Right to Rectification: To correct inaccurate data.
  • Right to Erasure (“Right to be Forgotten”): To have your data deleted when no longer needed.
  • Right to Data Portability: To receive your data in a machine-readable format.
  • Right to Object: To object to processing based on legitimate interests or for direct marketing.
  • Right to Lodge a Complaint: You have the right to complain to a data protection supervisory authority (e.g., the BfDI in Germany or DSB in Austria, Commission for Personal Data Protection (CPDP), Bulgaria.).

To exercise your rights, contact us at: [arbu@arbucosmetics.com]

7. Data Security Measures

To protect the integrity and confidentiality of your data, we employ industry-standard SSL/TLS encryption for all data transmissions. This ensures that sensitive information, such as payment details and login credentials, cannot be intercepted by unauthorized third parties. We also implement internal technical and organizational measures (TOMs) to protect against unauthorized access, loss, or destruction.