Privacy Policy

Effective from: 01.01.2011.
Last updated: 10.05.2023.

 

Your personal data controller is CRYSTAL ROSE Ltd, the owner of the online store www.onezerocosmetics.com. Company registration No. 42403037051, legal address: “Annas kalns”, JUSI, Griškānu parish, Rēzekne municipality, LV-4601, Latvia

 

CRYSTAL ROSE Ltd has developed this privacy policy (“Privacy Policy”) to demonstrate our commitment to protecting your personal data and to inform you about how we process your personal data.

This Privacy Policy outlines our information processing practices in connection with the website www.onezerocosmetics.com and ONE:ZERO mobile applications and other services we provide to users (hereinafter collectively referred to as “Services”). We will not disclose your personal data to other persons except in the cases mentioned in this Privacy Policy.

We will process the personal information you provide in Latvia in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council (April 27, 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

 

How to contact us

If you have any questions about how we collect, store, and use your personal information and data, please contact us in one of the ways below:

  • write to us at the email address info@onezerocosmetics.com
  • write to us at the following postal address (with the note “Regarding Privacy”):
    CRYSTAL ROSE Ltd, Rēzekne municipality, Griškānu parish, Jusi, “Annas kalns”, LV-4601

 

ONE:ZERO services

By using the Services, you can view information and content owned and licensed or provided by CRYSTAL ROSE Ltd, its affiliates, and related companies (“ONE:ZERO”). The Services may also include information provided by third parties, distributed based on a license, permission, or other agreement with ONE:ZERO. In this Privacy Policy, the word “we” in the relevant case refers to ONE:ZERO.

 

Use of services and information provision

Occasionally, you may choose to provide us with personally identifiable information. For example, you may wish to register, make purchases, read articles and view information, receive emails from us, receive event invitations, participate in discussions, preview new services, or participate in special promotions. If you register to use the services or conduct transactions through the website www.onezerocosmetics.com or any ONE:ZERO mobile application, we will collect information about your transactions and other activities. We require certain information from you to register and authenticate you as needed, process your records and payments, and send you goods.

In view of the above, the submission of your personal data to us is voluntary. However, if you do not provide them, we will not be able to achieve the purposes stated in the Privacy Policy. In cases where your personal data is processed based on your consent, you can withdraw your consent to the processing of personal data at any time, but this will not affect the lawfulness of the processing of personal data carried out before such withdrawal.

 

Scope, purposes, and duration of personal data processing

We may collect information that you voluntarily provide to us, as well as website visit data, as described below.

Personally identifiable information you submit

Personally identifiable information includes your name, surname, email address, phone number, date of birth, delivery and billing addresses, as well as a permanent identifier associated with personally identifiable information, and other information you may voluntarily provide to us. We collect such personally identifiable information provided by you for the purposes of achieving the following personal data processing goals:

 

1. Registration and participation administration in the ONE:ZERO Loyalty Program

We process your personal data to register you in the ONE:ZERO Loyalty Program and administer your participation. Participation in the ONE:ZERO Loyalty Program can be used to place orders in the ONE:ZERO online store, receive personalized offers, permanent discounts, commercial information about news, and take advantage of other program benefits both in the ONE:ZERO online store and physical stores.

Your data will be used to create or access your ONE:ZERO account and display relevant information in it, respond to your inquiries, ensure that your information is accurate and up-to-date, verify your registration, and contact you if we need to reach you and provide necessary information, such as changes to the ONE:ZERO Loyalty Program rules.

To create your account and manage your participation, you need to provide personal data required for contract conclusion and execution; otherwise, registration in the ONE:ZERO Loyalty Program is not possible. Registration requires your name, surname, and email.

The storage period of personal data depends on the activity of your Member account. If it is inactive for two consecutive calendar years, personal data will be deleted or irreversibly anonymized.

The legal basis for personal data processing - to conclude and execute a contract with you.

 

2. Management of personalized offers and other benefits

Within your membership, we process your personal data to administer personalized offers and other benefits, such as birthday benefits. We process only the personal data necessary for a specific benefit.

We use automated decision-making, including profiling, to provide you with personalized offers and other benefits. To do this, we may analyze your provided personal data and data obtained based on your behavior (e.g., your shopping transactions, activities in the Member account) using general rules or specific algorithms, predictive models. Our actions do not have any legal or similar significance impact on you.

To provide you with basic benefits, we use automated decision-making based solely on general rules applicable to all customers who are members of the ONE:ZERO Loyalty Program. This is not based on your preferences, behavior, or similar attributes, and we do not offer or evaluate any aspects of your behavior or preferences to provide such benefits. For example, based on your entered date of birth, the system determines when birthday benefits apply to you. Based on the benefits you use or do not use, we can determine other available benefits we offer you.

To offer you personalized offers and personalized recommendations (and sometimes other benefits), we need to profile you, i.e., use special algorithms, predictive models to analyze your choices, behavior, or similar attributes. For example, special algorithms analyze your submitted personal data and your shopping transactions (e.g., purchased goods) to develop tailored personalized offers for you. Based on your shopping transaction, we can also create a personalized recommendation for other available benefits we offer you.

Since personalized offers and benefits are the essence and primary goal of membership, you cannot be a member if you do not want automated decisions and profiling to be made about you.

For the management of personalized offers and other benefits, your name, surname, date of birth, purchase history, user-generated personal data, such as activity in information systems (including ONE:ZERO online store) is required.

The storage period of personal data depends on the activity of your Member account. If it is inactive for two consecutive calendar years, personal data will be deleted or irreversibly anonymized.

The legal basis for personal data processing - to conclude and execute a contract with you.

 

3. Purchase administration in the ONE:ZERO online store

We process your personal data to manage your purchases in the ONE:ZERO online store. Your personal data is processed to process your order, payment, send an invoice, contact you regarding the order and order status, deliver your order, and perform similar activities related to order fulfillment.

To fulfill your order, you need to provide personal data required for contract conclusion and execution. For example, to pay for the order, payment details must be provided; if you want home delivery, we need to know the address to which the order should be delivered.

To place orders in the ONE:ZERO online store, it is not necessary to create an account. There is also an option to place an order as a guest, providing only the personal data necessary for order placement, such as name, surname, contact information, and payment information.

We use your mobile phone number and email to contact you regarding your order. For example, to be able to contact you in cases where there are issues with your orders, delivering orders to your address, or to inform you about your order status (order confirmed, ready for delivery, delivered, canceled, not fulfilled, available for pickup after unsuccessful fulfillment, etc.).

To deliver the order, ONE:ZERO may use outsourcing services or offer to use other delivery company services. In this case, limited personal data information may be shared with ONE:ZERO partners acting as separate data processors or controllers. For example, your personal data, contact information, order, and delivery information. If information is shared with another data controller, ONE:ZERO will provide a reference to the data controller's privacy policy.

For purchase administration in the ONE:ZERO online store, your name, surname, all types of contact information, order, payment, transaction, and delivery information is required.

The storage period of personal data depends on the activity of your Member account. If it is inactive for two consecutive calendar years, personal data will be deleted or irreversibly anonymized. Documentation related to orders will be stored in accordance with national law for 10 years from the date of order creation.

The legal basis for personal data processing - to conclude and execute a contract with you.

 

4. Compliance with legal requirements

We process your personal data to comply with various legal requirements applicable to us, such as accounting requirements, product liability, and product safety. For example, we store transaction information and documentation related to your ONE:ZERO online store order (e.g., order data, invoices, return data) for the legally required period.

For compliance with legal requirements, your name, surname, all types of contact information, order, payment, transaction, and delivery information is required.

Documentation related to orders will be stored in accordance with national law for 10 years from the date of order creation. Other information related to compliance with legal requirements will be stored according to the deadlines specified in the legislation.

Legal basis for personal data processing - compliance with legal obligations.

 

5. Management of customer claims, complaints, and suggestions

We process your personal data to process your claims, complaints, suggestions, and other issues, including feedback on our products in the online store.

In case of submitting a claim, please provide the following information: your name, surname, contact information, claim description, and documents supporting the validity of your claim. If this information is not provided, we will not be able to evaluate and resolve your claim. Other categories of personal data mentioned in this privacy policy may also be processed within the scope of reviewing customer claims or complaints.

All personal data related to reviewed claims, complaints, or suggestions are stored no longer than two years from the date of receipt. Personal data may be stored longer if the claim or complaint is not yet reviewed or legal proceedings are ongoing. In this situation, personal data is stored until the review or 1 year after the conclusion of the relevant legal process. Product feedback is stored until the product is available in the online store.

Legal basis for personal data processing - processing is necessary to fulfill the legal obligation applicable to us regarding the review of claims and complaints.

Regarding product feedback in the online store, the legal basis - processing is necessary to fulfill our legitimate interests in receiving customer feedback to improve the shopping experience.

 

6. Surveys

We may process your personal data to invite you to participate in surveys to collect customer feedback to improve and expand our services. If you have agreed to receive marketing information, we may send a survey to your chosen communication channel. In other cases, we may publish our survey on our website, online or physical stores, where you can access them and participate in the survey at your discretion.
Participation in surveys is up to you.

Surveys are anonymous unless participation in the survey is organized simultaneously with participation in a draw.

To ensure participation in the survey, if they are not anonymous, your name, surname, contact information, purchase history, your feedback, and opinion may be required.

Survey data is stored for up to one year after the conclusion of the draw.

Legal basis for participation in the survey - your consent.

 

7. Lotteries

We process your personal data to administer ONE:ZERO or ONE:ZERO supplier lotteries, games, and/or contests if you have expressed a desire to participate in lotteries, games, and/or contests. We process your personal data to determine and announce the winner, identify you when issuing lottery, game, and/or contest prizes, as well as to include your name and surname in the lottery protocol in accordance with the legal obligation.

If you want to participate in a lottery, game, and/or contest, you must submit your personal data to us. If you do not provide your personal data, you will not be able to participate in the lottery, game, or contest, or in case of winning, we will not be able to award you the prize.

When issuing the prize, your identity will be verified, and in case of discrepancies, the issuance will be canceled.

For the lottery, your name, surname, contact information, purchase history, and user-generated personal data, such as information about activity in the ONE:ZERO online store may be required.

If you are a winner, your name and surname are indicated in the prize receipt act and lottery, game, and contest protocol, which are stored for five years from the day of the lottery, game, and contest. In all other cases, personal data obtained during the lottery, game, and contest are stored no longer than two years from the day of the lottery or game conclusion.

Legal basis for personal data processing for lottery purposes - your consent and our legal obligation to prepare the lottery protocol/issue the prize.

 

8. Sending commercial communications

We process your personal data to send you marketing information, such as personalized offers, information about discounts, benefits, sales, special campaigns, our news, events, the latest products in the assortment in your chosen communication channel, such as SMS, email, browser notifications. At the same time, it is possible to register only for receiving commercial communications about various news without registering for the ONE:ZERO Loyalty Program.

We use automated decision-making, including profiling, to ensure personalized and effective direct marketing communication with you. To do this, we take into account your provided personal data and data obtained based on your behavior. Our actions do not have any legal or similar significance impact on you.

You can unsubscribe from commercial communications or direct marketing communications that we send to you at any time. You can do this by contacting us via email: info@onezerocosmetics.com or using the unsubscribe link in the communication sent to you via email.

By unsubscribing from direct marketing communications, we will update your personal data processing settings so that direct marketing communications are no longer provided to you.

For sending commercial communications, your name, surname, date of birth, all types of contact information, information about used benefits, purchase history, customer choice data (e.g., provided consents), user-generated personal data (e.g., about an incomplete shopping cart), connection information (e.g., about the type of device used) may be required.

Data for commercial communication purposes will be processed until you withdraw your consent to receive commercial communications.

Legal basis for commercial communication purposes - your consent.

 

9. Information security, fraud prevention, and management of legal claims

We may process your personal data to defend, establish, and enforce legal claims, including to prevent and/or stop fraudulent or illegal activities, gather evidence of identified issues, and manage the situation, as well as stop the misuse of our products or services.

For fraud prevention and management of legal claims, any information and personal data mentioned in this Privacy Policy that you have previously provided to ONE:ZERO may be required.

In case of legal claims, data will be processed while investigation, settlement, and enforcement of legal claims are ongoing. Data will be stored for three years after the decision to close the investigation or until the final execution of the court decision.

Data, such as audit records for information security purposes, are stored for up to 18 calendar months unless the law provides for a longer storage period.

Processing is necessary to fulfill our legitimate interests in establishing, exercising, or defending legal claims and ensuring information security.

 

10. Statistical and market research purposes

We process your personal data for statistics to be able to observe, evaluate, improve, and expand the online service offering. For these purposes, we will not process your name, contact information, or any other directly identifiable information that can directly point to you as a specific person.

For statistical and market research purposes, information about participant participation in the ONE:ZERO Loyalty Program (e.g., duration, registration year), information about orders, deliveries, payments, purchase history, customer choices, user activities within the ONE:ZERO Loyalty Program, and feedback may be required.

Data for statistical and market research purposes will be stored as long as necessary to fulfill our legitimate interests.

Legal basis for statistical and market research purposes - processing is necessary to fulfill our legitimate interests to improve and expand our services.

 

To protect your privacy and security, we will implement appropriate measures to verify your identity, such as requesting a password and user ID, before granting access to your data. We strive to protect user personal information and privacy; however, we cannot guarantee the security of any information you disclose online, and you do so at your own risk.

 

Information transfer

ONE:ZERO will not disclose any personally identifiable information to third parties without your consent. Exceptions are the following cases:

  • ONE:ZERO may share collected information with its third-party service providers (e.g., our payment service providers or courier services, etc.). If we share information about you, we will require the respective third parties to handle it in accordance with this Privacy Policy and not disclose or use your personally identifiable information for any purposes other than providing services to you or on behalf of ONE:ZERO.

Currently, we use the following third-party service providers:
“OMNIVA Ltd” (registration No.: 40103527192)
We may disclose collected information, including personally identifiable information, to third parties in legally prescribed cases. For example, we may disclose information to supervisory authorities and law enforcement agencies upon their official request.

  • We may disclose collected information, including personally identifiable information, to companies that may partially or fully acquire ownership of ONE:ZERO.
  • We may transfer your personal data to our insurers and professional advisors in connection with risk management, professional advice, or to establish, exercise, and defend legal claims.

We may transfer your personal data not only in the previously mentioned cases but also in fulfilling our legal obligations. For direct marketing purposes, we may transfer personal data with your consent to our partners who will provide us with marketing services.

ONE:ZERO always strives to ensure the processing of your personal data within the EU/EEA.

Your personal data may be transferred to a country outside the EU/EEA or processed in a country outside the EU/EEA where service providers are contracted. To ensure adequate protection of your personal data when transferring data outside the EU/EEA, we ensure that appropriate security measures are in place to protect your personal data. For example, an EU Commission decision that the respective country provides an adequate level of personal data protection, contract standard clauses, etc. Information about the implemented personal data protection measures can be obtained by submitting a written request to us.

ONE:ZERO is not responsible for the protection of information you provide on other websites. You should be aware that if you voluntarily disclose personally identifiable information on other applications and websites, it can be collected and used by other persons, and as a result, you may start receiving unwanted messages.

 

Information storage

Business transactions
There may be situations where we may decide to sell, buy, merge, or otherwise reorganize our company for strategic or other reasons. Such a transaction may involve the disclosure of personally identifiable information to potential or actual buyers or joint venture partners, as well as receiving such information from sellers. In accordance with our standard practice, we strive to ensure appropriate information protection in such transactions.

 

Your rights

This section of the Privacy Policy covers your rights under data protection laws. Some rights cover many aspects, so we only cover the main ones in this Privacy Policy. We recommend familiarizing yourself with the relevant laws and guidelines of supervisory authorities to know all the information about these rights.

You have the following rights related to personal data protection:

  • the right to receive information about personal data processing;
  • the right to access your personal data that we store;
  • the right to request correction of your personal data that we store (most of them can be corrected by logging into your account);
  • the right to request the deletion of your personal data (“the right to be forgotten”);
  • the right to restrict the processing of your personal data;
  • the right to object to the processing of your personal data;
  • the right to object to the processing of your personal data for direct marketing purposes;
  • the right to data portability;
  • the right to withdraw consent for the processing of your personal data;
  • the right to submit a complaint to the supervisory authority.

If you wish to exercise your rights or have questions about personal data processing or rights implementation, contact us via email info@onezerocosmetics.com

ONE:ZERO provides its customers the possibility to exercise the rights listed in this privacy policy in the profile settings on the www.onezerocosmetics.com website.

The right to access your personal data that we process. You have the right to receive confirmation from us whether we process your personal data. When we process your personal data, you have the right to access the processed personal data and information about its processing, such as the purpose of personal data processing, personal data categories, personal data recipients, etc. We will provide you with a copy of your personal data. You have the right to receive your personal data in a structured, commonly used, and machine-readable format. However, you cannot exercise this right in cases where it may negatively impact the rights and freedoms of others.

We have the right to refuse to provide your processed data if there are circumstances specified in the law where personal data is not provided.

The right to request correction of your personal data that we store. You have the right to correct any inaccurate personal data and, considering the purposes of processing, supplement any incomplete personal data.

The right to restrict the processing of your data. This right can be used in the following cases:

  1. you dispute the accuracy of personal data;
  2. personal data is processed unlawfully, but you do not want it to be deleted;
  • personal data is no longer necessary for our data processing purposes, but you request it in connection with legal claim establishment, execution, or defense, or
  1. you object to its processing based on our or third-party legitimate interests until your objection justification is verified.

By restricting the processing of personal data, we may continue to store your personal data but will not continue its processing, except:

  1. with your consent;
  2. in connection with the establishment, execution, and defense of legal claims;
  • to protect the rights of other physical or legal persons or
  1. for important public interest reasons.

The right to object to the processing of your personal data. You can use this right for any purpose for reasons related to your specific situation, but only to the extent that we use the data in connection with our or third-party legitimate interests. If you express an objection, we will not continue the processing of personal data, except in cases where we can prove that the data is processed for compelling legitimate reasons that are superior to your interests, rights, and freedoms, or to establish, exercise, and defend claims and/or legal claims.

The right to object to the processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you object to this, we will no longer process your personal data for these purposes.

The right to data portability. You can exercise this right in cases where we process your personal data with authorized means (computers, etc.) and the legal basis for personal data processing is:

  • Your consent, or
  • contract execution or actions taken at your request before contract conclusion.

The right to withdraw consent for the processing of your personal data. In cases where the legal basis for processing your personal data is consent, you have the right to withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of data processing during the period before withdrawal.

The right to submit a complaint to the supervisory authority. If you believe that we violate data protection laws while processing your personal data, you have the right to submit a complaint to the Data State Inspectorate, located at Elijas iela 17, Riga, LV-1050, https://www.dvi.gov.lv/lv/. In all cases, before submitting a complaint, please contact us to find a suitable solution together.

 

Data deletion

As mentioned earlier, you have the right to request the deletion of your personal data that we hold.

If you wish to delete these personal data, please contact us by writing to the email address info@onezerocosmetics.com;

Upon receiving your request to delete data, we will act in accordance with the General Data Protection Regulation (GDPR) provisions. GDPR provides the right to request the deletion of personal data in certain cases:

  1. personal data is no longer necessary to achieve the purposes for which it was collected or otherwise processed;
  2. you withdraw your consent and there is no other legal basis for data processing;
  • you object to the processing of personal data to achieve legitimate interests of ours or a third party;
  1. personal data is processed for direct marketing purposes;
  2. personal data was processed unlawfully;
  3. personal data must be deleted in accordance with applicable legal requirements.

Please note that in some cases you may not be able to exercise this right due to applicable exceptions. These exceptions include cases where the processed personal data is necessary to:

  1. exercise freedom of expression and information;
  2. fulfill our legal obligations; or
  • establish, exercise, or defend legal claims.

We will verify whether any of the listed cases apply to your situation. If, in accordance with GDPR provisions, personal data must be deleted upon your request, it will be deleted.

Please note that personal data will not be deleted if its processing is necessary for fulfilling legal obligations prescribed by law, as well as if personal data is necessary to establish, exercise, or defend legitimate claims.

 

Effective date

This Privacy Policy is effective from January 2011. We reserve the right to change this Privacy Policy at any time. If we do so, we will publish the current Privacy Policy on this page. Any changes to this Privacy Policy will take effect on the date of publication.