Privacy policy

This document (the "Privacy and Cookies Policy", hereinafter: the "Policy") sets out the rules for processing personal data and for using cookies and similar technologies in connection with the use of the online service available at www.molecooles.com (the "Service").

The Policy applies to persons using the Service, in particular to:

1. a.

   persons browsing the Service,

2. b.

   persons placing orders in the online store operated in the Service (the "Store"),

3. c.

   persons holding an Account in the Service,

4. d.

   persons using the MQLS loyalty program (the "MQLS Program"), including the panel presenting information about MQLS and related functionalities,

5. e.

   persons using the skin analysis / face scan function ("AI face scan") available in the Service (if it is made available).

The Policy is informational in nature and is made available free of charge in the Service in a manner that allows it to be saved, reproduced and recorded. This version of the Policy applies from 1 January 2026 and replaces earlier versions.

Capitalised terms have the meaning given to them in this Policy and, where a term is not defined in the Policy, the meaning given to it in the Terms and Conditions of the Service or the MQLS Terms, available in the Service.

The Policy has been prepared in particular on the basis of:

1. a.

   Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR"),

2. b.

   provisions on privacy in electronic communications (so-called ePrivacy), including in particular Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector and the national provisions issued to implement it, with regard to the use of cookies and similar technologies,

3. c.

   Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 on artificial intelligence (the "AI Act"), with regard to the transparency obligations concerning functions that use AI systems,

4. d.

   other mandatory provisions of law applicable to the operation of the Service, including the provision of services by electronic means and distance selling, to the extent that they apply to the given operations or functionalities of the Service.

The controller of personal data processed in the Service is Molecooles OÜ, Harju maakond, Lasnamäe linnaosa, Narva mnt 13-27, 10151 Tallinn, Estonia, registry code 16871783, VAT number: EE102694369 (the "Seller" or the "Controller").

Contact with the Controller: e-mail hello@molecooles.com (this address also serves as the electronic point of contact within the meaning of digital services regulations) or in writing to the registered office address. Communication may be conducted in Polish or English.

The Controller has not appointed a data protection officer (DPO). In all matters concerning personal data, you may contact us at the address indicated in section 2.

For some services, third parties act as separate, independent controllers, in particular the payment operator (Stripe) with regard to payment processing and the MQLS Program Provider with regard to wallet functions, token operations and the KYC process. The rules for the processing of data by these entities are set out in their own privacy policies.

Depending on how you use the Service, we may process the following categories of data:

1. a.

   Account / profile data (Account in the Service):

2. i.

   first name and surname (or business name), e-mail address, password (in encrypted/hashed form), phone number (if required), delivery addresses, history of activity in the Service, Account settings. ii. analysis results saved in the Account and materials submitted by the user as part of this function (in accordance with its description in the Service).

3. b.

   Data related to orders in the Store:

4. i.

   information necessary to place and fulfil an order: products ordered, order date and number, price, currency, discounts, delivery costs, delivery method, fulfilment status, invoice data (if provided), history of returns and complaints.

5. c.

   Data related to payments:

6. i.

   we do not process full payment card data; payments are handled through the Payment Operator. ii. we may process transaction identifiers, information on the payment status (e.g. "paid / rejected"), the date and amount of the payment, the payment method in general terms and the data necessary for settlements and for handling any refunds.

7. d.

   Communication data:

8. i.

   the content of correspondence and requests sent to us (e.g. by e-mail), contact details provided in the correspondence, dates of contact, information provided in the course of handling the request.

9. e.

   Technical and operational data of the Service:

10. i.

    in particular: IP address, device and browser identifiers, operating system, approximate location derived from the IP address, dates and times of visits, event logs, information on activity in the Service (e.g. visits to subpages, actions in the Cart), error and performance data.

11. f.

    Cookies and online identifiers: identifiers stored in cookies or similar technologies (e.g. browser storage), which may be used for purposes necessary for the operation of the Service and, depending on your settings, for analytical and marketing purposes. Details can be found in the section on cookies.

12. g.

    Data processed as part of the AI Face Scan function: face image, analysis results and related technical data, described in detail in §6.

Where do we get the data from?

1. a.

   From you, when you provide it in the Service, e.g. when you create an Account, place an order, contact us or use the AI face scan function.

2. b.

   From the Service (automatically generated data): when you use the Service, some data is generated automatically (e.g. logs, technical data, cookie identifiers, order history).

3. c.

   From our partners / service providers, to the extent necessary for the operation of the Service and the provision of services:

4. i.

   the Payment Operator provides us with information on the payment status and transaction identifiers necessary to settle the order; ii. the MQLS Program Provider may process data related to the functionalities of the MQLS Program, including wallet functionalities and (where applicable) KYC, in accordance with its terms and rules; we receive from the Program Provider the information necessary to present and settle the MQLS Program in the Service.

Providing data is voluntary, but in some cases necessary in order to use a particular function, e.g. without a delivery address we will not fulfil the order, and without consent to the processing of the face image we will not perform the scan. Not providing data has no other negative consequences apart from not being able to use the given function (Art. 13(2)(e) GDPR).

We receive most of the data directly from you when you create an Account, place an Order, use the Skin Scanner, subscribe to the Newsletter or contact us.

We obtain some data from third parties: from the MQLS Program Provider, information on operations on MQLS points and on the status of the required verifications, without data from the KYC process; from the payment operator, the payment status, the authorisation result and partial data of the payment instrument, without the full card number; from logistics operators, the shipment status and information on delivery; from providers of analytical tools, data on the use of the Service, to the extent described in the chapter on cookies.

Providing data is voluntary, but necessary to conclude and perform the agreement: without the order and delivery data we cannot fulfil the Order, and without an e-mail address you will not be able to create an Account.

In section 3 below we present a summary of the purposes of data processing ("purpose → data → legal basis → recipients → retention period").

The scope of data and recipients may differ depending on which functions of the Service you use.

Summary of processing purposes (purpose, categories of data, legal basis, main recipients or categories of recipients, retention period):

1. a.

   Creating and maintaining an Account in the Service. Data (for example): account/profile data, contact details, history of activity in the Account, Account settings. Legal basis: Art. 6(1)(b) (agreement for maintaining the Account). Main recipients: providers of hosting and maintenance of the Service, providers of communication tools (e-mail), IT support. Retention period: for as long as you hold the Account; thereafter until the expiry of the periods necessary to defend claims or to fulfil legal obligations.

2. b.

   Handling orders in the Store (conclusion and performance of the sales agreement). Data: identification and contact details, delivery address, order details, order history, invoice data (if provided). Legal basis: Art. 6(1)(b). Main recipients: courier companies / logistics operators, providers of store/CRM systems, hosting, customer support. Retention period: for the time the order is being fulfilled; thereafter in accordance with the provisions on settlements and until claims become time-barred.

3. c.

   Payment handling (Stripe). Data: transaction identifiers, payment status, amount, date, billing information (without full card data). Legal basis: Art. 6(1)(b) (performance of the agreement) and, with regard to settlements, Art. 6(1)(c). Main recipients: Stripe (payment operator), accounting/ERP providers, banks (with regard to settlements). Retention period: in accordance with the provisions on accounting and taxes and until claims become time-barred.

4. d.

   Handling the MQLS Program (awarding, settlements, MQLS panel, affiliation). Data: Account ID, order data necessary for awarding, MQLS balance/events in the panel, affiliation data (e.g. link identifier), settlement data. Legal basis: Art. 6(1)(b) (operation of the MQLS Program) and Art. 6(1)(f) (prevention of abuse, accountability). Main recipients: providers of maintenance of the Service, analytics providers (if applicable), the Program Provider (Enzo) (with regard to MQLS/wallet functions), IT support. Retention period: for the duration of participation in the MQLS Program; thereafter until claims become time-barred, until settlements are completed and for the periods required by law.

5. e.

   Handling returns, withdrawals, complaints and disputes. Data: identification and contact details, order data, correspondence, documents and evidence (e.g. reports, confirmations). Legal basis: Art. 6(1)(c) (legal obligations) and Art. 6(1)(f) (establishment/defence of claims). Main recipients: entities handling returns/logistics, accounting, legal advisers, public authorities (where there is an obligation). Retention period: for the period required by law and until the expiry of the limitation periods for claims.

6. f.

   Contact and handling of enquiries. Data: contact details, content of the enquiry/correspondence. Legal basis: Art. 6(1)(f) (handling enquiries and communication) or Art. 6(1)(b) (where it concerns steps taken before concluding an agreement). Main recipients: e-mail/communication providers, helpdesk systems (if used). Retention period: for the time necessary to handle the matter; thereafter until the expiry of the limitation period for claims (if the matter may give rise to claims).

7. g.

   Analytics and improvement of the Service. Data: technical data, cookie identifiers, information on activity in the Service (aggregated or pseudonymised, depending on the tools). Legal basis: Art. 6(1)(f) (interest) or Art. 6(1)(a) (consent), depending on the tools/cookies. Main recipients: providers of analytical and IT tools (if used). Retention period: depending on the type of data and tools; until the cookies are deleted / consent is withdrawn or in accordance with the settings of the tool.

8. h.

   AI Face Scan: skin analysis and recommendations. Data: face image, analysis results, technical session data. Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (explicit consent). Main recipients: AI technology provider, hosting, IT support. Retention period: user with an Account: until the results or the Account are deleted; without an Account: [30] days from the scan.

9. i.

   Improving and training AI models. Data: face image and analysis results (pseudonymised or anonymised where possible). Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (separate, voluntary explicit consent). Main recipients: AI technology provider. Retention period: until consent is withdrawn; anonymised data indefinitely (it does not constitute personal data).

10. j.

    Marketing (e.g. newsletter, SMS messages, phone calls, including those conducted by an AI voice assistant, remarketing activities). Data: contact details (e.g. e-mail, phone number in the case of SMS messages and phone calls), cookie/online identifiers, information on activity (depending on the activities). Legal basis: as a rule Art. 6(1)(a) (consent) or Art. 6(1)(f) (interest), depending on the marketing model; in addition, national provisions on marketing communication may apply. Main recipients: providers of mailing/marketing tools (if used), advertising platforms (if used). Retention period: until consent is withdrawn / an objection is raised or until the marketing activities end.

11. k.

    Online workshops (webinars). Data: e-mail address, phone number, first name (if provided) and answers to the survey after signing up. Purpose: sending the link to the workshop, e-mail and SMS reminders and materials after the workshop. Legal basis: Art. 6(1)(a) GDPR (consent given when signing up).

12. l.

    Security of the Service and prevention of abuse (anti-fraud). Data: technical data (IP, logs), account data, transaction data to the extent necessary to detect abuse. Legal basis: Art. 6(1)(f) (security, prevention of abuse) and, where applicable, Art. 6(1)(c) (legal obligations). Main recipients: IT security providers, hosting, anti-fraud tool providers (if used), legal advisers, authorities (where there is an obligation). Retention period: for the period necessary to ensure security and accountability and until claims become time-barred.

13. m.

    Audiences on advertising platforms (Meta, Google). Data: e-mail address and, if you have provided them, phone number, first name, surname and city, transferred only in a form encrypted with the SHA-256 hash function; online identifiers (e.g. _fbp, _fbc, ad click identifier) and information on events in the Service (e.g. completing a scan, placing an order), also transferred directly from our server (Meta Conversions API). Purpose: creating custom audiences (Custom Audiences) and lookalike audiences (Lookalike Audiences), matching ads and measuring their effectiveness. Legal basis: Art. 6(1)(a) (consent to marketing cookies or marketing consent) or Art. 6(1)(f) (legitimate interest: marketing of our own products to persons who have used the Service), with the right to object at any time. Main recipients: Meta Platforms Ireland Limited, Google Ireland Limited; with regard to their own data matching operations, these platforms act as independent controllers in accordance with their privacy policies. Retention period: until consent is withdrawn or an objection is raised; we then update or delete the audience.

The MQLS loyalty program (the "MQLS Program") is available in the Service. Below we explain what data is processed in connection with the MQLS Program and what role is played by the third parties involved in its operation.

In connection with the MQLS Program we may process in particular:

1. a.

   Account identifiers in the Service (e.g. Account ID, e-mail address as login), in order to assign awards to the correct user;

2. b.

   awards of benefits in MQLS, in particular: order identifier, date, order value (e.g. net/gross, depending on the rules of the Program), information on discounts, information on a return/chargeback (to the extent necessary for settlements);

3. c.

   Data concerning MQLS awards and settlements, e.g. the number of MQLS awarded under Cashback or Affiliation, the balance presented in the panel, the history of events in the MQLS Program to the extent presented in the Service;

4. d.

   Data concerning Affiliation, in particular the Affiliate Link identifier, information on the assignment of a purchase to a referral, data necessary to award the MQLS bonus.

Separation of roles between the Seller and the Program Provider:

1. a.

   The Seller is responsible for the operation of the Service and for the organisation of the MQLS Program in the Service, in particular for: (i) setting the rules of the MQLS Program (e.g. awarding Cashback, Affiliation and the rules for using MQLS in the Service), (ii) presenting information about the MQLS Program in the Service (e.g. panel/balance/events), (iii) handling enquiries and complaints concerning the operation of the MQLS Program in the Service to the extent that they concern the Seller.

2. b.

   Functionalities related to handling the MQLS wallet, carrying out token operations and any KYC verification are provided by the external Program Provider, on the basis of its own terms and rules.

3. c.

   In particular, the Seller: (i) does not provide CASP/custody services, (ii) does not control private keys and does not perform wallet operations on the user's side, (iii) does not carry out a KYC process in connection with wallet operations, and if KYC is required, it is carried out by the Program Provider.

In connection with the use of the MQLS Program, data may be transferred to the Program Provider to the extent necessary to ensure the operation of the functionalities of the Program, in particular in order to: (a) launch and maintain the MQLS wallet function, (b) carry out MQLS operations (e.g. awards, transfers, withdrawals/deposits if such functions are available), (c) handle KYC / access restrictions (if KYC is required for a given function), (d) ensure security and prevent abuse.

The scope of data transferred to the Program Provider may include in particular: Account identifiers, identifiers of orders and events in the MQLS Program, information necessary for awards and settlements and, if you use functions requiring KYC, the data required by the Program Provider as part of its verification process.

Blockchain technology and user rights: some data related to the MQLS Program (e.g. wallet addresses, records of operations) may be recorded in a public, decentralised blockchain register. These records are permanent and, as a rule, cannot be changed or deleted either by the Seller or by the Program Provider. To this extent, the exercise of certain rights (in particular the right to erasure or rectification of data) may be technologically limited. We limit the data entered in the register to the necessary minimum; the wallet address is pseudonymous and is not directly linked to your identity in the public register.

Information on any transfers of data outside the EEA, including to the USA, can be found in §8.

The token layer of the MQLS Program, i.e. the MQLS Wallet, private keys, the tool for purchasing MQLS points and the technical infrastructure, is built and operated by the Program Provider: Enzo Ventures LLC, 6628 Sky Pointe Dr. Ste 129-1215, Las Vegas, NV 89131, United States, registration number 2023-001203529.

With regard to the purchase of MQLS points and identity verification (KYC), the Program Provider is a separate controller of personal data and not a processor acting on our behalf. It determines the purposes and means of processing this data itself and is responsible in this respect for the exercise of the rights of data subjects.

We do not process data collected in the KYC process, in particular the image of the identity document or data from liveness verification. We also do not process payment data related to the purchase of MQLS points, because the payment is made in the tool of the Program Provider and to the Program Provider.

The scope of data transferred to the Program Provider is limited to the Account identifier and the information necessary to assign awards in the MQLS Program.

A skin analysis function based on a face image ("AI Face Scan") is available in the Service. Its use is entirely voluntary. Using or not using the function does not affect the ability to browse the Service or to make purchases in the Store.

The AI Face Scan function is intended only for adults. By starting a scan, the user confirms that they are at least 18 years old.

As part of AI Face Scan we process the following categories of personal data:

1. a.

   face image (a photo or image material taken using the camera of the user's device);

2. b.

   analysis results generated on the basis of the submitted image (e.g. information on skin characteristics and condition, assessment result, matched product recommendations or care protocols);

3. c.

   technical data related to performing the scan and displaying the result (e.g. session identifier, date and time, device/browser information);

4. d.

   for logged-in users, the link between the image and results and the Account.

The face image is stored together with the analysis results (for the periods indicated in sections 11 and 12) so that you can return to the result and compare the results of subsequent scans over time.

AI Face Scan is not used to identify or verify identity. We do not create, on the basis of the face image, biometric templates enabling the unique identification of a natural person and we do not use the image for facial recognition.

The analysis results may relate to skin characteristics that may be interpreted as information concerning health. For this reason, in order to ensure a higher level of protection, we treat the data processed as part of AI Face Scan as special categories of data within the meaning of Art. 9 GDPR.

AI Face Scan is not a medical service, is not used to make a diagnosis and does not replace a consultation with a doctor (in particular a dermatologist). The results are generated automatically by an artificial intelligence system, are for information and illustrative purposes only and, like any automated analysis, may contain inaccuracies or errors. If you have any doubts about the condition of your skin or your health, consult a doctor.

The legal basis for processing data as part of AI Face Scan is the user's consent (Art. 6(1)(a) GDPR) and, with regard to special categories of data, explicit consent (Art. 9(2)(a) GDPR). Consent is given before the scan is started, explicitly and separately from other consents and declarations. Not giving consent only prevents the use of the AI Face Scan function and does not affect the other functions of the Service.

The image analysis is fully automated and includes elements of profiling (matching recommendations to skin characteristics). However, we do not make decisions concerning the user that would produce legal effects or similarly significantly affect them (Art. 22 GDPR); the scan result serves only to present non-binding information and recommendations. You may at any time ask us to explain how the function works (hello@molecooles.com).

Improving and training AI models: if you give separate, voluntary and explicit consent, the face image and analysis results may be used by the Seller or the technology provider to improve and train the models used in the AI Face Scan function. Where possible, the data used for this purpose is pseudonymised or anonymised beforehand. This consent is independent of the consent to perform the scan; not giving it does not restrict access to the function. Withdrawing consent stops further use of your data for this purpose; it does not affect the lawfulness of processing carried out earlier or models trained on previously anonymised data (which no longer constitute personal data).

Users with an Account: the image and results are saved in the Account and are available only to you. You may delete them yourself in the Account at any time or request their deletion by writing to hello@molecooles.com. If you do not delete them earlier, the data is stored until the Account is deleted and then deleted or anonymised.

Users without an Account: if the scan was performed without creating an Account, the image and results are stored for [30] days from the scan and then automatically deleted or anonymised. You may request their earlier deletion by writing to hello@molecooles.com. In order to find the data, we may ask you for additional information allowing the scan to be identified (e.g. the e-mail address provided during the scan, the approximate date and time of the scan, the device). If we are unable to reliably identify the data concerning you, we will inform you of this; in such a case it may not be possible to fulfil the request (Art. 11 GDPR).

AI Face Scan results and saved materials are not published in the Service or made available to other users.

Withdrawal of consent: you may withdraw any of the consents given at any time in the Account settings or by writing to hello@molecooles.com, as easily as you gave it. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Withdrawing consent to the processing of the image and results entails the deletion of this data, unless there is another legal basis for retaining it (e.g. the establishment or defence of claims), in which case only to the extent necessary.

The AI Face Scan functionality may be provided using external technology providers (e.g. AI tools or hosting). In such a case the Seller: (a) selects providers in a manner that ensures an appropriate level of data protection, (b) transfers data only to the extent necessary for the function to operate (data minimisation principle), (c) ensures an appropriate legal basis for making the data available (e.g. a data processing agreement under Art. 28 GDPR); matters relating to transfers outside the EEA are described in §8. Information about the providers is indicated in the Service or made available on request.

AI transparency: we inform you that the AI Face Scan function uses an artificial intelligence system and that the result is generated automatically. Appropriate labels are provided in the interface of the function in accordance with the transparency requirements, including Article 50 of Regulation (EU) 2024/1689 (AI Act).

We process the face photo submitted as part of AI Face Scan and the analysis results on the basis of your explicit consent (Art. 9(2)(a) GDPR), which is separate from the acceptance of the terms and conditions and from the marketing consent. You may withdraw your consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal.

We store photos in encrypted form in order to allow subsequent Scans to be compared over time, for as long as you hold the Account and, after it is deleted, for the time necessary to defend claims. You may request earlier deletion of the photos without affecting your ability to use the store.

We do not use photos or Scan results to identify persons, for profiling producing legal effects or for making decisions based solely on automated processing within the meaning of Art. 22 GDPR.

In connection with operating the Service and providing services, your data may be made available to recipients only to the extent necessary to achieve the purposes referred to in this Policy.

Main categories of recipients:

1. a.

   The payment operator: for the handling of payments, refunds and settlements, data may be transferred to the payment operator Stripe (or entities from its corporate group) to the extent necessary to handle transactions and ensure the security of payments.

2. b.

   The MQLS Program Provider, with regard to the functionalities of the MQLS Program, including those related to the MQLS wallet, operations and any KYC, to the extent necessary to provide these functionalities.

3. c.

   The AI Face Scan technology provider, to the extent necessary to perform the image analysis and generate the results and, with separate consent, also to improve the models (§6(10)).

4. d.

   Providers of IT services and maintenance of the Service, in particular: hosting and server infrastructure, CDN providers, IT security, monitoring and backup services, cookie consent management tools (CMP).

5. e.

   Communication and customer service providers: providers of e-mail and SMS services (if used) and of helpdesk/CRM systems (if used).

6. f.

   Providers of analytical and marketing tools, to the extent depending on your cookie settings and the consents given.

7. g.

   Entities handling the fulfilment of orders: carriers, logistics operators (couriers), entities supporting warehousing and the handling of returns.

8. h.

   Accounting and entities supporting settlements: entities providing accounting or tax services or supporting settlements and audits.

9. i.

   Legal advisers and auditors, where necessary (e.g. a dispute, debt collection, the pursuit or defence of claims).

10. j.

    Public authorities and other authorised entities, only to the extent required by law (e.g. courts, law enforcement authorities, tax authorities).

In many cases the above recipients act as processors processing data on our behalf (e.g. hosting, e-mail, helpdesk). In such situations we ensure the safeguards required by law, in particular we conclude data processing agreements (Art. 28 GDPR).

In connection with the use of the Service and the services of our providers, your personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States (USA).

A transfer of data outside the EEA may take place in particular when: (a) you use functionalities of the MQLS Program provided by the Program Provider, i.e. Enzo Ventures LLC, 6628 Sky Pointe Dr. Ste 129-1215, Las Vegas, NV 89131, United States (registration number 2023-001203529), which require data to be processed on infrastructure located outside the EEA; (b) we use IT service providers (e.g. hosting, cloud infrastructure, CDN, monitoring and security systems) that have servers outside the EEA or use subcontractors from outside the EEA; (c) we use analytical or marketing tools or AI technologies whose providers have their registered office outside the EEA or process data on servers outside the EEA.

In the case of a transfer of data outside the EEA, we ensure the legal basis required by the GDPR. Depending on the provider and the direction of the transfer, this may include in particular: (a) a decision of the European Commission finding an adequate level of protection, including, with regard to certified entities in the USA, the decision concerning the EU-U.S. data protection framework (EU-U.S. Data Privacy Framework); (b) standard contractual clauses (SCC) adopted by the European Commission, together with supplementary measures where necessary; (c) other mechanisms provided for in the GDPR, if they are required and appropriate in the given case.

Detailed information on the transfer mechanism used for a given provider may result from its documentation or from the agreements concluded with the Seller.

You may obtain a copy of the safeguards applied to the transfer of data outside the EEA (e.g. a copy of the standard contractual clauses, to the extent permitted) or additional information concerning the transfer by contacting us at: hello@molecooles.com.

We store personal data for no longer than is necessary to achieve the purposes for which the data is processed, taking into account legal obligations and the limitation periods for claims.

We store data related to the Account in the Service for as long as you hold the Account and, after it is deleted, for the period necessary for: (a) settlements (if transactions took place), (b) handling any complaints and disputes, (c) establishing, pursuing or defending claims (until the expiry of the limitation periods), (d) fulfilling legal obligations (e.g. archiving certain documents).

We store data related to the fulfilment of orders, as well as accounting and tax documents (e.g. invoices), for the period required by the provisions on accounting and taxes and for the period necessary to defend claims.

We store data related to complaints, returns, withdrawals from agreements and disputes for the time necessary to handle the matter and then until the expiry of the limitation periods for claims.

We store technical data, system logs and information related to the security of the Service for a limited time, adequate to the purposes of security and accountability.

We store data processed as part of the AI Face Scan function (in particular the face image and analysis results): (a) for users with an Account, until they are deleted by the user or until the Account is deleted; (b) for users without an Account, for [30] days from the scan, after which they are automatically deleted or anonymised; (c) data used, with separate consent, to improve AI models: until consent is withdrawn (anonymised data does not constitute personal data and may be used indefinitely).

After the Account is closed/deleted, this data is deleted or anonymised, unless there is an exceptional case in which it must be retained (e.g. for the purpose of resolving a dispute, if the data is necessary and proportionate).

Where data is processed on the basis of consent (e.g. marketing or certain cookies), we store the data until consent is withdrawn, unless it ceases to be needed earlier.

In the Service we use automated processing, including elements of profiling, in particular: (a) as part of the AI Face Scan function, automated analysis of the face image and selection of recommendations (details in §6); (b) as part of marketing activities, tailoring content and communication (if you have given the relevant consents); (c) as part of security and anti-fraud mechanisms.

We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). If security mechanisms lead to an automatic restriction of access to the Account or to transactions, you may contact us to have the matter reviewed with human involvement.

You have the right to object to profiling based on legitimate interest, including profiling for direct marketing purposes (Art. 21 GDPR).

In connection with the processing of your personal data, you have the rights arising from the GDPR. You may exercise them by contacting us at: hello@molecooles.com.

Depending on the legal basis and the circumstances of the processing, you have: (a) the right of access to the data (Art. 15 GDPR), including obtaining a copy of it; (b) the right to rectification of the data (Art. 16 GDPR); (c) the right to erasure of the data (Art. 17 GDPR); (d) the right to restriction of processing (Art. 18 GDPR); (e) the right to data portability (Art. 20 GDPR), where the processing is based on consent or an agreement and is carried out by automated means; (f) the right to object (Art. 21 GDPR), where we process data on the basis of legitimate interest, including the right to object to direct marketing.

If we process data on the basis of your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal. This applies in particular to: (a) consents related to the AI Face Scan function (including the separate consent to improve AI models), (b) consents concerning analytical/marketing cookies, (c) consent to marketing (e.g. newsletter). Withdrawing consent is as easy as giving it.

Handling requests: we respond without undue delay and no later than within one month of receiving the request; in complex cases or where there is a large number of requests, this period may be extended by a further two months, of which we will inform you. We may ask for additional information necessary to confirm the identity of the requester. Exercising rights is free of charge; in the case of manifestly unfounded or excessive requests (e.g. constantly repeated ones), we may charge a reasonable fee or refuse to act (Art. 12(5) GDPR).

If we are unable to identify the data subject (e.g. a scan performed without an Account and without providing an e-mail address), it may not be possible to exercise certain rights (Art. 11 GDPR); in such a case we will inform you of this and, where possible, indicate what additional information will allow identification.

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with a supervisory authority. Due to the Seller's registered office in Estonia, the lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Regardless of the above, you may lodge a complaint with the local supervisory authority in the place of your habitual residence, your place of work or the place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (PUODO): ul. Stanisława Moniuszki 1A, 00-014 Warszawa, e-mail: kancelaria@uodo.gov.pl.

The Service and the Store are intended for persons who are at least 16 years old. The AI Face Scan function and the MQLS Program are intended only for adults.

We do not direct the Service to children and do not knowingly collect their personal data. If we become aware that we are processing the data of a person below the indicated age without the consent required by law, we will promptly take steps to delete this data.

We make efforts to protect personal data processed in the Service against unauthorised access, loss, destruction, alteration or disclosure. We apply organisational and technical measures appropriate to the risk and to the nature of the processing.

In particular, we apply (to the extent appropriate to the systems and processes of the Service): (a) control of access to systems and data, with access granted only to authorised persons, to the extent necessary to perform their duties; (b) limitation of authorisations as well as logging and verification of access; (c) encryption of data transmission (e.g. HTTPS/TLS connections); (d) safeguards for the IT infrastructure and environment, including monitoring the operation of the Service and responding to incidents; (e) selection of service providers taking into account security requirements and, if required, the conclusion of appropriate data protection agreements.

The security of the Account also depends on you: (a) use a strong password and do not share it with third parties; (b) do not store your password in a way that allows easy access by unauthorised persons; (c) use trusted devices and up-to-date software; (d) if you suspect unauthorised access to your Account, change your password immediately and contact us.

We may take measures aimed at protecting the Account and the Service (e.g. temporarily restricting access or verifying selected actions) if this is justified by security or by a suspicion of abuse.

In the Service we use cookies and similar technologies (e.g. local storage, online identifiers) ("Cookies") to ensure the proper operation of the Service, to increase its functionality and, depending on your settings, to carry out analytics and marketing activities.

Cookies are small text files saved on your device while you use the Service. They make it possible, among other things, to: (a) maintain the session and ensure the proper operation of basic functions (e.g. logging in, the Cart), (b) remember selected settings, (c) analyse how the Service is used, (d) tailor content and advertisements.

Cookies may be set by Molecooles ("first-party" cookies) or by third parties ("third-party" cookies) if we use the services of tool providers (e.g. analytical tools, marketing tools, video tools, maps, chats). The scope and types of cookies depend on the tools actually used.

The following categories of Cookies may be used in the Service: (a) essential (necessary): needed for the proper operation of the Service and its basic functions; they do not require consent; (b) functional: they make it possible to remember settings and preferences; they may require consent, depending on their nature; (c) analytical (statistical): used on the basis of consent; (d) marketing: used on the basis of consent.

During the first visit to the Service we display a consent management tool (CMP banner) which makes it possible to: (a) accept selected categories of cookies, (b) reject optional cookies, (c) change the settings at any time. Rejecting optional cookies is as easy as accepting them.

You may change your settings at any time (including withdrawing consent) using the mechanism available in the Service (e.g. the "Cookie settings" link/icon).

You may also manage cookies through your browser settings (e.g. by blocking or deleting cookies). Disabling essential cookies may affect the operation of the Service.

The retention periods of Cookies depend on their type: session cookies are deleted when the browser is closed, and persistent cookies when their validity period expires (as a rule no longer than [24] months) or when you delete them. The current list of cookies and tools used, together with their validity periods, is available in the cookie settings in the Service.

Some browsers offer a "Do Not Track" (DNT) setting. Currently, different services may interpret DNT differently, so the Service may not respond automatically to this signal. You can always manage your consents in the cookie settings described above.

We may update this Policy, in particular when: (a) the law or the guidelines of supervisory authorities change, (b) the way the Service operates or the scope of the services provided changes (e.g. the MQLS Program, AI Face Scan functions), (c) the tools or providers used change, (d) this is necessary for reasons of security or to improve the transparency of information.

We may inform you about selected changes via the Service (e.g. a notice) or by e-mail, if we have your address and such a channel is appropriate to the type of change.

The updated version of the Policy applies from the date indicated in it. In the case of changes that significantly affect the way data is processed (e.g. new purposes or new categories of recipients), we may apply additional information measures or, if required, ask you to give your consent again.

This Policy is informational in nature and describes the rules for processing personal data in the Service and the rules for using cookies and similar technologies.

In matters not regulated by this Policy, the relevant provisions of law apply, in particular the GDPR and national provisions on the protection of personal data and on electronic communications (with regard to cookies).

If any provision of this Policy proves to be invalid or ineffective, this does not affect the validity of the remaining provisions. An invalid provision is replaced by the solution closest to its economic and legal purpose, while complying with the requirements of law.

The current version of the Policy is always available in the Service.