Privacy Policy
Privacy Policy
Last updated: 20 October 2026
This Privacy Policy explains how HERBARISE collects and uses personal data when you visit https://herbarise.com/en/, shop with us, contact our team or subscribe to our communications. It also explains how you can manage your privacy choices and exercise your rights.
1. Who we are
The controller responsible for your personal data is Active Protect Cosmetics OOD (Актив Протект Козметикс ООД), trading as HERBARISE.
Company registration number (UIC/EIK): 204658348. VAT number: BG204658348.
Registered address: 6 Sv. Sedmochislenitsi Street, Apartment 2, 1421 Sofia, Bulgaria.
Email: info@herbarise.com. Telephone: +359 877 821 961.
You can contact us using these details for any question about this policy or the processing of your personal data.
2. Information we collect
Information you provide. When you place an order, create an account or contact us, we collect the details needed to provide the service you request. These may include your name, email address, telephone number, billing and delivery addresses, account information, invoice details, selected products and order notes.
Orders and payments. We process order contents and values, payment method, transaction references, payment status, delivery information and refund records. The payment information required depends on the method you select. Please do not send payment card security codes through email or customer support messages.
Enquiries and returns. We process your messages, contact details and information relating to enquiries, complaints, returns or refunds. This may include an order number, a description of an issue and any supporting material you choose to provide.
Subscriptions and preferences. If you subscribe to marketing, we process your email address, subscription status and the preferences you provide. We also process records of consent and withdrawal where needed to respect and demonstrate your choices.
Website activity. When you browse our website, technical information may be collected, including your IP address, browser, operating system, device type, language settings, referring source, pages visited, interactions and online identifiers. The information collected through optional tracking depends on the relevant features and your privacy choices.
Please provide only information relevant to your request. You do not need to provide a medical history to purchase our products. Avoid including diagnoses or other sensitive personal information in order notes or general enquiries.
3. How we obtain your information
We receive information directly from you when you use our website, place an order, manage an account, subscribe or communicate with us.
Some information is collected automatically through website requests, cookies and similar technologies. We also receive payment confirmations, delivery updates and related transaction information from the providers involved in fulfilling your order.
If you give us another person's details, for example as the recipient of a delivery, please ensure you are entitled to provide them and make this policy available to that person.
4. Why we process personal data
Purchases and customer accounts. We use the necessary information to process your order, administer your account, arrange payment and delivery, send service messages and provide contractual support. Our legal basis is performance of a contract or steps you request before entering a contract under Article 6(1)(b) of the General Data Protection Regulation (GDPR).
Enquiries. We handle purchase-related enquiries on the same contractual or pre-contractual basis. For other correspondence and business enquiries, we rely on our legitimate interest in responding to requests and managing business relationships under Article 6(1)(f).
Legal obligations. We process records needed for accounting, taxation, consumer rights and other applicable legal requirements under Article 6(1)(c). This includes relevant invoices, returns, refunds and complaint records.
Security and legal claims. We process relevant technical and transaction information to protect the website, prevent misuse and fraud, investigate problems and establish or defend legal claims. Our legal basis is our legitimate interest in protecting our customers, services and business under Article 6(1)(f), subject to your rights and interests.
Marketing and optional tracking. We rely on consent under Article 6(1)(a) for newsletter subscriptions and optional analytics or advertising processing where consent is required. You may withdraw consent at any time. Consent to marketing is not a condition of purchasing a product.
Providing information needed to fulfil an order or meet a legal obligation is necessary for the relevant service. If you do not provide it, we may be unable to process your order or request. Optional fields and choices are not required.
5. Cookies and privacy choices
Cookies are small files stored on your device. Together with similar technologies, they can support website functions, remember preferences, measure website use and assist advertising.
Necessary functions include maintaining your shopping basket, supporting secure access and remembering privacy choices. Blocking essential storage in your browser may prevent some functions from working.
Optional analytics helps us understand visits, navigation and the performance of the store. Optional marketing helps measure campaigns and, where enabled and consented to, show advertising relevant to your interests. Embedded content can involve additional requests to the service providing that content.
You can accept or refuse optional categories through the privacy panel and change your choices using Cookie Settings in the website footer. Where consent is required, optional storage or access to information on your device is subject to that consent.
Measurement technologies may process interaction, conversion and technical information. Refusing cookies does not necessarily prevent every technical request or the exchange of limited consent-status information. Data is not automatically anonymous simply because cookies are not used.
You can also manage or delete cookies through your browser. Clearing stored preferences, changing browsers or using another device may require you to make your choices again. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
6. Marketing and advertising
If you subscribe, we use your contact details to send product news, offers and other marketing communications. You can unsubscribe using the link in a marketing email or by contacting info@herbarise.com.
Order confirmations, delivery updates and communications needed to handle your purchases are service messages and are separate from marketing.
Where the relevant features are enabled and the required consent has been given, website activity, purchase events and online identifiers may be used to measure advertising effectiveness, understand interests and create advertising audiences. Relevant customer identifiers may also be used to match interactions with an advertising service. Encoding or hashing an identifier does not, by itself, make it anonymous.
You can change advertising choices through Cookie Settings. You also have the right to object to direct marketing, including profiling related to that marketing, at any time.
7. Who may receive personal data
We share relevant information with recipients only where there is an appropriate legal basis and a purpose connected with the processing described in this policy.
Delivery and payment providers receive the information necessary to handle payments, refunds, shipments and related communications.
Technology and operational service providers may process information needed for website hosting, maintenance, security, customer communications and the operation of our online store.
Analytics, advertising and marketing service providers may receive the information needed for the relevant functions, subject to applicable consent requirements and privacy choices.
Accountants, legal advisers and other professional advisers may receive information necessary to meet legal obligations or establish and defend legal claims. Public authorities may receive information where disclosure is required or otherwise authorised by law.
A provider processing data on our instructions acts under appropriate contractual requirements. Some recipients, such as payment or delivery providers, may independently determine certain purposes and means of processing and are responsible for those activities under their own privacy notices.
8. Processing outside the European Economic Area
Some services involved in operating the website or providing communications, analytics and advertising may involve processing or access outside the European Economic Area.
Where personal data is transferred internationally, applicable data protection requirements must be met. Depending on the recipient and destination, the relevant protection may be an adequacy decision or appropriate safeguards, such as approved contractual clauses and additional measures where necessary.
To ask whether your data is subject to an international transfer, obtain details of the safeguards applicable to it or request a copy of those safeguards, contact info@herbarise.com.
9. How long we retain information
We keep personal data only for as long as needed for its purpose, applicable legal requirements and the establishment or defence of legal claims. The retention period depends on the type of record and the reason for keeping it.
Order, payment, invoice and refund records are retained for fulfilment and for the periods required by applicable accounting, tax and consumer-protection rules. Records relevant to a dispute may be retained until that dispute and the related legal retention needs have ended.
Account information is retained while needed to provide your account. If an account is closed, information that is no longer needed is deleted or anonymised, while records needed for legal obligations or claims may be retained separately.
Enquiry and complaint information is retained while your request is being handled and for any further period necessary to meet related legal obligations or resolve claims.
Marketing information is used while your subscription remains active and the information remains necessary. After you unsubscribe, a limited record may be retained to respect your choice and demonstrate compliance, without continuing to send marketing.
Technical and measurement information is retained according to the operational, security or reporting purpose for which it is needed. Retention takes account of whether identifiable information is still necessary, whether the purpose can be met using aggregated data and whether an incident or legal obligation requires preservation. Cookie lifetimes and the retention of information already collected are separate matters.
When information is no longer needed, it is deleted or irreversibly anonymised. You can contact us for information about the retention applicable to a particular record.
10. Protecting your information
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, misuse, loss, alteration or disclosure. The measures must reflect the nature of the information and the risks of processing.
No website or method of electronic transmission can guarantee absolute security. Please protect your account credentials and contact us if you suspect unauthorised use.
11. Your rights
Under the GDPR, and subject to its conditions, you have the right to request access to your personal data, correction of inaccurate or incomplete information, erasure and restriction of processing.
Where processing is automated and based on consent or contract, you may request the data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, its transmission to another controller.
You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time, including profiling related to it.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect earlier lawful processing. You also have rights concerning solely automated decisions producing legal or similarly significant effects, including the right to human intervention where applicable.
To exercise your rights, email info@herbarise.com or write to our registered address. We may request proportionate information to confirm your identity and protect your data.
We respond without undue delay and normally within one month of receiving your request. Where permitted because of the complexity or number of requests, this period may be extended by up to two further months. We will inform you of the extension and the reasons within the first month.
Requests are normally free of charge. If a request is manifestly unfounded or excessive, we may apply the measures permitted by law and explain our reasons.
12. Complaints
You may raise a privacy concern with us, but you are not required to contact us before approaching a supervisory authority.
You have the right to lodge a complaint with a competent data protection authority, particularly in the country of your habitual residence, place of work or the alleged infringement.
In Bulgaria, the supervisory authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria.
Website and current complaint instructions: https://cpdp.bg/en/lodging-complaints-and-alerts/.
13. Changes and contact
We may update this policy to reflect changes in our services, processing activities or legal requirements. The latest version and its update date will be available on this page. Where required, we will provide additional information or request consent before introducing a new consent-based purpose.
For questions about this policy or your personal data, contact Active Protect Cosmetics OOD at info@herbarise.com, telephone +359 877 821 961, or our registered address: 6 Sv. Sedmochislenitsi Street, Apartment 2, 1421 Sofia, Bulgaria.