1. Who we are

This Privacy Policy explains how the BeautyF mobile application (Android package com.community.beautyScan, also available on iOS) collects, uses, stores, shares and deletes your personal data.

The data controller is LotSL d.o.o., Mlaka 33B, 1218 Komenda, Slovenia (“BeautyF”, “we”, “us”). LotSL d.o.o. is the developer of the App on Google Play and the App Store.

Privacy and support email: supply@lotgroup.eu

Website: cosmetics.rts-sys.com

This Policy applies to the App and to the related website. It complements the User Agreement. If the two documents differ on how personal data is handled, this Policy prevails.

By using the App you confirm that you have read this Policy. Where we rely on your consent, we ask for it separately inside the App.

2. Data we collect

We collect only the data needed to run the App’s features: product scanning, photo recognition and your personal cosmetics catalogue.

We do not collect contacts, SMS, call logs, health data, biometric identifiers or financial account details. Photos are used to recognise cosmetic products, not to identify people or analyse faces.

3. How we use your data and why

We process personal data under the EU General Data Protection Regulation (GDPR). Each purpose has a legal basis.

We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not sell your personal data.

Links to shops. The App may show links to online shops and marketplaces, some of which are affiliate links. When you follow a link, you leave the App and the shop’s own privacy policy applies. We do not pass your account data to these shops.

4. Device permissions

The App asks for permissions only when you use the feature that needs them. You can refuse or revoke any permission in your device settings; the rest of the App keeps working.

5. Who we share data with

We do not sell or rent your personal data and do not share it with third parties for their own advertising. We pass data only to service providers that process it on our behalf, under contracts that bind them to our instructions and to GDPR:

We may also disclose data when the law requires it, to protect our rights or users’ safety, or to a successor in a merger or sale of the business, with notice to you.

International transfers. Our servers are located in the European Union. If a provider processes data outside the EEA, we rely on an EU adequacy decision or the European Commission’s Standard Contractual Clauses.

6. How long we keep data

Backups are overwritten on a rolling cycle of no more than 30 days after deletion.

7. Deleting your account and data

You can delete your account and all associated data at any time:

In the App: Profile → Settings → Delete account.

Without the App: send an email to supply@lotgroup.eu  from the email linked to your account, with the subject “Delete my BeautyF account”.

We confirm deletion within 30 days. Deleted: account data, catalogue, saved photos, location history, device tokens. Kept only where the law requires it: purchase records, in a restricted archive. You may also ask us to delete specific data (for example, photos only) without deleting the account.

8. How we protect data

All data is encrypted in transit (HTTPS/TLS).

Passwords are stored only as salted hashes.

Access to servers is limited to authorised staff and protected by authentication and logging.

Service providers are bound by data processing agreements.

No method of transmission or storage is 100% secure. If a breach affects your data, we will notify you and the supervisory authority as required by GDPR.

9. Your rights

Under GDPR and similar laws you have the right to:

access your data and get a copy of it;

correct inaccurate data;

delete your data (“right to be forgotten”);

restrict or object to processing, including processing based on legitimate interest;

receive your data in a portable format;

withdraw consent at any time (for location, notifications, marketing) without affecting earlier processing.

To use any right, email supply@lotgroup.eu.

We answer within one month. We may ask you to confirm your identity.

You can also complain to a data protection authority. Our lead authority is the Information Commissioner of the Republic of Slovenia (www.ip-rs.si), Dunajska cesta 22, 1000 Ljubljana. You may also contact the authority in your own country.