Privacy Policy

1. Information We Collect

Information you give us

• Order information: name, billing and shipping address, email address, phone number, and the products you purchase.
• Account information: if you create an account, your login email, password (stored encrypted), and order history.
• Messages: anything you send us by email or through a contact form.

All payments are processed and secured by PayPal. Your PayPal login and payment card details are entered directly with PayPal; we do not see or store your full card number.

Information collected automatically

• Device and usage data: IP address, browser type, device type, pages viewed, referring page, and the time of your visit.
• Approximate location: we derive your country from your IP address, using a geolocation database stored on our own server (MaxMind GeoLite2), so that we can show you the cookie notice that applies where you live. Your IP address is not sent to MaxMind, and we do not determine your precise location.
• Cookies and similar technologies: small files that keep your cart and session working, remember your preferences, and measure the performance of our advertising (see Section 5).

2. How We Use Your Information

• To process, ship, and deliver your orders, and to send order and shipping confirmations.
• To answer your questions and provide customer support, including returns and refunds.
• To operate, secure, and improve the Site and prevent fraud.
• To understand how visitors use the Site through aggregated analytics.
• To measure and improve our advertising, including showing HEBÉA ads to people who have visited the Site.
• To comply with legal, tax, and accounting obligations.

We will only send you marketing emails if you have opted in, and you can unsubscribe at any time using the link in every email.

3. Legal Bases (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases: performance of a contract (fulfilling your order), legal obligation (tax and accounting records), legitimate interests (securing and improving the Site, preventing fraud), and consent (non-essential cookies, advertising pixels, and marketing emails). You may withdraw your consent at any time.

4. How We Share Your Information

We do not sell your personal information for money. We share it only with service providers who help us run our store, and only to the extent they need it:

• Fulfillment partner: our products are manufactured and shipped from the United States by our fulfillment partner, which receives your name, shipping address, and order details in order to deliver your order.
• Payment processor: PayPal processes your payment and may use your data for fraud prevention, under PayPal’s Privacy Statement.
• Shipping carriers: to deliver your package and provide tracking.
• Analytics provider: Google receives data about how you use the Site through Google Analytics (see Section 5).
• Hosting and technology providers: who host the Site and our email.
• Advertising partners: Meta Platforms (Facebook and Instagram) receives data about your visits through the Meta Pixel in your browser and, for the same events, from our server through Meta’s Conversions API (see Section 5).
• Legal reasons: when required by law, or to protect our rights, our customers, or the public.
• Business transfers: if HEBÉA is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Cookies, Analytics and Advertising

We use the following categories of cookies:

• Essential cookies keep your shopping cart, checkout, and account working. The Site cannot function without them.
• Preference cookies: hebea_consent remembers your cookie choice (180 days), hebea_cc remembers your country for the cookie notice (7 days), and hebea_tracking_ok is a technical copy of your choice used by our page cache. Cookies whose names start with sbjs_ remember how you arrived at the Site (for example from an ad or a search) so that we can see which campaigns lead to orders; this information stays with us.
• Analytics cookies: we use Google Analytics to understand how visitors find and use the Site, such as which pages are viewed and for how long. Google Analytics collects device and usage data, including your IP address, which is not stored in full. Google processes this data under Google’s Privacy Policy. You can opt out with the Google Analytics Opt-out Browser Add-on.
• Advertising cookies: we use the Meta Pixel, which records actions such as page views, items added to the cart and purchases on the Site. We send the same events to Meta from our server as well (Conversions API), so that they are counted reliably and without duplicates. This lets us measure our ads and show HEBÉA ads to you on Facebook and Instagram. Meta may combine this data with information it already holds about you, under Meta’s Privacy Policy.

Outside the EEA, the UK and Switzerland, analytics and advertising cookies are set when you visit the Site; you can opt out at any time through the banner, the “Do Not Sell or Share” link or a Global Privacy Control signal. In the EEA, the UK and Switzerland they are set only after you click Accept. When you opt out or decline, we also stop the server-side events described above.

You can manage cookies through your browser settings and our cookie banner (the Cookie Settings link in the footer), adjust your ad preferences in your Meta Accounts Center, or opt out of interest-based advertising at aboutads.info. Blocking essential cookies may prevent checkout from working.

6. Your Privacy Rights

United States residents

Depending on the state where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others), you may have the right to:

• know what personal information we collect and how we use and share it;
• access and receive a copy of your personal information;
• correct inaccurate personal information;
• delete your personal information;
• opt out of “targeted advertising” and the “sale” or “sharing” of personal information.

Our use of the Meta Pixel and Conversions API may be considered “sharing” for cross-context behavioral advertising or “targeted advertising” under some state laws. To opt out, use the Do Not Sell or Share My Personal Information link in the footer or email us. We also honor Global Privacy Control (GPC) signals sent by your browser as an opt-out request.

We will not discriminate against you for exercising your rights. You may use an authorized agent to submit a request on your behalf, and you may appeal any decision we make on your request by replying to our response.

EEA, UK and Switzerland residents

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

How to make a request

Email info@hebea.beauty with the subject line “Privacy Request”. We may need to verify your identity before responding, and we will respond within the time required by applicable law (generally within 30 to 45 days).

7. International Transfers

Our store is operated from the European Union, and our fulfillment and some of our service providers are located in the United States. Your information may therefore be transferred to and processed in countries other than your own. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

8. Data Retention

We keep order and transaction records for as long as tax and accounting laws require (generally up to 10 years). We keep account data while your account is active, and marketing data until you unsubscribe. Other data is deleted or anonymized when it is no longer needed for the purposes described in this policy.

9. Security

We protect your information with encrypted (HTTPS) connections, secure payment processing, and restricted access to our systems. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where required by law.

10. Children’s Privacy

The Site is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new “Last updated” date. If the changes are significant, we will provide a more prominent notice.

12. Contact Us

GreenBack Group Ltd., EU
Email: info@hebea.beauty