Sasha Beauty Botanica

Privacy Policy

Operated by BoostX LTD · Last content sync from sasha.cy

1. Who We Are

This website (sasha.cy) is operated by:

BoostX LTD
Company Number (EIK): 205987117
Registered Address: Dobrich, Bulgaria, "Dobrotitsa" 25, entrance B, floor 2, apartment 4
Email: [email protected], [email protected]

BoostX LTD is the Data Controller under the GDPR.

2. Personal Data We Collect

We collect only the information necessary to process orders, deliver products, and improve our services.

2.1. Data collected during checkout

  • Full name
  • Phone number
  • Email address
  • Billing and shipping address
  • Order notes
  • IP address

2.2. Data collected when creating an account

  • Name
  • Email
  • Password (encrypted)
  • Order history

2.3. Payment information

Card payments are processed securely by myPOS. We do not store or have access to card numbers. myPOS may process: name, email, last 4 digits of the card, transaction status.

2.4. Delivery information

We share necessary delivery details (name, phone number, address) with ACS, Akis Express and DHL.

2.5. Analytics and marketing data

We use Google Analytics and Meta Pixel (Facebook Pixel), which may collect: IP address, device and browser information, pages visited, time spent on the site, and approximate location.

3. Cookies

Our website uses cookies for functionality, analytics, and marketing.

3.1. Essential cookies

Required for login sessions, shopping cart, checkout.

3.2. WooCommerce cookies

Used to track cart contents and maintain session data.

3.3. Analytics cookies

Google Analytics.

3.4. Marketing cookies

Meta Pixel.

You can disable cookies through your browser settings.

Note: sasha.cy does not currently run checkout or accounts. It currently loads web fonts from Google Fonts, uses Google Analytics and the Meta Pixel to understand site traffic and ad performance (see below), and the "Notify Me" form sends your email address to us directly from our own server — see below. The rest of this section describes the data practices that will apply once online sales open.

3.5. Notify-Me Form

The "Notify Me" signup form on sasha.cy is handled directly by our own server — no third-party form-relay service is used. When you submit your email address, our server emails it to our inbox at [email protected] so we can notify you when Immortelle Gold launches, and automatically sends you a confirmation email. Outgoing mail is delivered via Google's SMTP mail servers under our own account, so Google LLC acts as our email-delivery processor. We do not use your email for any other purpose, and you can ask us to delete it at any time by writing to [email protected].

4. Why We Process Your Data

  • Contract performance (orders, payments, delivery)
  • Legal obligations (accounting, tax)
  • Legitimate interest (fraud prevention, service improvement)
  • Consent (analytics, marketing)

5. Who We Share Your Data With

We share data only with trusted partners necessary for operating the store, and the "Notify Me" form:

  • Google LLC – outgoing mail delivery for the "Notify Me" form, and analytics
  • myPOS – card payment processing
  • ACS / Akis Express / Kronos – delivery
  • Meta Platforms Inc. – marketing
  • Hosting provider – technical infrastructure

We do not sell personal data.

6. Data Retention

  • Orders: 10 years (legal requirement)
  • Accounts: until the user requests deletion
  • Marketing data: until consent is withdrawn
  • Cookies: 1 day to 2 years (depending on type)

7. Your Rights Under GDPR

You have the right to: access your data, correct inaccurate data, request deletion ("right to be forgotten"), restrict processing, object to processing, data portability, withdraw consent, and file a complaint with a supervisory authority.

Cyprus Supervisory Authority

Office of the Commissioner for Personal Data Protection
dataprotection.gov.cy

Bulgaria Supervisory Authority

Commission for Personal Data Protection
cpdp.bg

8. Data Security

We use SSL encryption, secure hosting, encrypted passwords, access restrictions, and fraud protection systems.

9. Card Payments (myPOS)

All card payments are processed by myPOS, certified under PCI DSS, PSD2, and 3D Secure. We never store card details.

10. Delivery

To complete your order, we share delivery information with ACS, Akis Express and DHL. They use this data solely for delivery purposes.

11. Contact Us

For privacy-related questions or GDPR requests:
BoostX LTD
Email: [email protected] and [email protected]