Privacy policy

Beautybox.ee privacy policy

This version takes effect when it is published. The version shown before confirmation is stored with the booking.

1. Controller

The controller of personal data is Rentbox Eesti OÜ (registry code 17268244), Rapla maakond, Kohila vald, Aespa alevik, Nööbi tn 10, 79705, Estonia. Data-protection questions and rights requests: hello@beautybox.ee, +372 5365 0007.

Where a payment, identity, login or other service provider acts as a separate controller for its own purposes, the provider's privacy notice, made available when that option is selected, also applies to those operations.

2. Sources of data

We receive data directly from the customer when an account is created, a booking or payment is made, a phone number or identity is verified, a device is handed over or returned, and when the customer contacts support. We also receive limited status and event data from the payment, identity, social-login, messaging or smart-locker provider selected by the customer. The system creates technical, security, audit and risk events when the platform is used.

3. Categories of data

Depending on the features used, we may process:

• account and contact data: name, email, phone number, address, date of birth, personal identification code, language choice and account status;
• authentication and security data: password hash, hashes of one-time links and codes, session data, social-login provider identifier and verified email, MFA status and recovery events; we do not store provider access or refresh tokens;
• booking and contract data: device, location, rental period, price, deposit method, discount or gift card, statuses, consents and the versions of legal documents accepted, customer notes, handover, return, cancellation and dispute;
• payment data: amount, currency, status of payments, pre-authorisations, captures and refunds, provider references and operation times. Beautybox.ee does not see or store the full card number or security code;
• phone and identity-verification data: method, time, outcome, reviewer, provider session reference and the necessary decision summary. Where the relevant evidence flow is used, this may include images of the front and back of an identity document, a selfie and data read from the document;
• handover, smart-locker and return data: creation, use and revocation of access, locker or compartment events, condition of the set, comments and conditional photographs of damage, a missing item or a fault;
• communication data: customer-support messages and the delivery status, retries and, for a limited period, encrypted content of emails, SMS messages and webhooks;
• technical and audit data: IP address, browser or device user-agent, request time, security and rate-limit events, administrator action and the record affected;
• risk-assessment data: previous account risk level or block, account age, transaction amount, the customer's own recent booking statuses, and their payment, dispute, no-show, late-return and other security events;
• marketing data: newsletter address, consent status and evidence, and opt-out information;
• sensitive information supplied voluntarily: for example, a health reaction described in a support message. We do not request health data for an ordinary booking and ask customers not to provide more information than is needed to resolve the issue.

When a passkey is added, we store its credential identifier, public key and necessary usage and security data. Beautybox.ee does not receive the biometric template used for fingerprint or face verification on the device.

Google and Facebook login

Where the option is enabled and selected by the customer, we request basic profile, email and login identification from Google, and public basic profile and email from Facebook. We use the provider's user identifier, email and supplied name data to link the account. Beautybox.ee login does not request access to a mailbox, contacts or posts; our login flow does not save the profile picture to the account. An email supplied by a provider does not replace separate email verification in every case. Removing login permission at the provider does not itself delete the Beautybox.ee account or transaction records that must be retained by law.

4. Purposes and legal bases

We process data for the following purposes:

• to operate the account, booking, payment, deposit, handover, smart locker, return and customer support — to enter into or perform the contract, or to take pre-contractual steps requested by the customer;
• to verify age, phone number and identity and protect valuable property, accounts and payments — to perform the contract and for our legitimate interests in preventing fraud, unauthorised access and property damage and in evidencing claims;
• for accounting, taxation, responding to consumer complaints and complying with a lawful order from an authority — to comply with a legal obligation;
• for platform security, reliability, auditability, prevention of misuse and the establishment, exercise or defence of legal claims — for our legitimate interests, following a balancing assessment;
• to send a newsletter or other optional direct marketing — based on consent, which may be withdrawn at any time;
• to process health or other special-category information voluntarily supplied by the customer only where a condition under Article 9 GDPR applies, such as explicit consent or necessity for the establishment, exercise or defence of legal claims.

Core identity and contact details, rental times, required acknowledgements and the data needed for the applicable payment and verification are necessary to enter into the contract. If they are not provided, the booking may not be confirmed or the service may not be provided. Marketing data is optional.

5. Identity verification and remote verification

For an in-person handover, an employee may inspect an original identity document. In that case we normally store the method, time, outcome and employee who performed the check, not a copy of the document.

If the customer selects, or the booking requires, a remote check offered in the booking flow, the provider, for example Veriff, and the required supplementary information are shown before data is sent. The provider may process document images, a selfie, document data and technical fraud and authenticity signals for the check. Beautybox.ee receives at least a session reference, verification status and the necessary decision summary, and stores files in its own system only where Beautybox.ee's evidence-upload flow expressly requires this.

If a remote check includes biometric comparison of facial images to uniquely identify a person, we do not activate it without a valid condition under Article 9 GDPR and separate transparent information. Where explicit consent is relied on, the customer must be able to choose a supported manual check if they do not want biometric verification.

6. Risk score and human review

The platform calculates a deterministic booking risk score from account age, transaction value, the customer's own recent booking statuses and their previous operational risk and payment events. Name, address, personal identification code, date of birth, nationality, gender and browser or device fingerprints are not used in this score.

A higher result directs the booking to an additional identity check or human administrator review; the score alone does not cause an automatic final refusal. An account already lawfully blocked or with an outstanding obligation may nevertheless be unable to book. Payment and identity providers may carry out their own fraud and compliance assessments under their own privacy notices.

AI assistance for catalogue management

If an administrator uses AI-assisted drafting or a price suggestion, the product information and task entered by them are sent to OpenAI, together with a hashed technical administrator identifier for security. This tool does not assess customer booking risk or automatically change a product's price. We apply sensitive-data filters to input and output, and the administrator must review the suggestion; the administrator must not include customer data or secrets in a product-copy task. Processing the technical administrator identifier is based on our legitimate interest in operating the service securely and preventing misuse.

We use an API setting that disables persistent storage of the response, but this does not mean that the provider has no security or legally required retention. OpenAI's processing terms and applicable transfer safeguards must also be considered.

7. Recipients and service providers

Data is made available only to the extent needed for the recipient's task:

• the payment provider, such as Stripe, where card payments are enabled;
• the identity provider, such as Veriff, where remote verification is enabled, or authorised employees performing a manual check;
• server, database and private file-storage providers;
• email and SMS providers, such as the configured SMTP service, Resend, SendGrid, Messente or Twilio;
• the smart-locker or access provider where a booking uses a smart locker;
• Google or Facebook only where the customer selects that login method;
• OpenAI where an administrator uses the catalogue assistance described above;
• an error and reliability monitoring provider, such as Sentry, where enabled; monitoring events are minimised and sanitised;
• an accountant, legal adviser, auditor, insurer or claims handler to the extent necessary;
• an authority, court or other authorised recipient where disclosure is required by law or needed to defend a legal claim.

Depending on the operation, a provider acts as our processor or as a separate controller. We do not sell personal data.

Booking, payment, security and withdrawal service emails are delivered through the configured email service; these do not subscribe the customer to a newsletter. Optional marketing requires separate consent. Where Sentry monitoring is enabled, the application removes user data, request content, cookies, headers and free text from events and sends limited diagnostics. The application does not use session replay for this monitoring. The provider may process technical connection data to serve the connection.

8. Transfers outside the EEA

An international provider selected by the customer or used by us may process data outside the European Economic Area. Before such a transfer, we rely on an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses and supplementary measures where needed. Information about the current provider and transfer safeguard is available from hello@beautybox.ee.

9. Retention periods

We apply periods appropriate to the data and purpose:

• files containing an identity document or selfie uploaded into the Beautybox.ee system are generally deleted 30 days after evidence submission once the check has been finally approved, declined or expired. Evidence under manual review may be retained until a decision; the verification status and reference may be retained longer as contract evidence;
• ordinary return photographs are generally deleted 180 days after the relevant inspection was last updated; evidence in an active damage review or dispute is retained for up to 730 days;
• encrypted message content for a sent, skipped or terminally failed notification is generally removed 30 days after its last update. Pending or retryable content is kept until the operation finishes; delivery and deduplication metadata may be retained longer;
• the IP address and user-agent in audit logs and smart-locker events are generally anonymised after 90 days, while the action type, time, actor, object and redacted business metadata remain according to audit and claims needs;
• the IP address and user-agent of a consent record are generally removed 1095 days after consent was given; evidence of the content, version and time of consent may be retained longer to substantiate a contract or legal claim;
• accounting source documents and contracts or business records needed to understand a transaction are retained for seven years from the end of the relevant financial year. This does not mean that every booking record is automatically deleted after seven years;
• account, booking, payment, consent, risk and dispute data is kept for as long as necessary to perform the contract, meet accounting requirements, prevent fraud and manage possible legal claims, and is then deleted or anonymised unless another legal basis requires retention;
• marketing consent is kept until withdrawn; minimal evidence of consent and opt-out may be kept longer to honour the opt-out and demonstrate compliance;
• expired one-time authentication and verification codes are removed after a short technical period reserved for security and incident investigation.

An external provider may have its own retention duty arising from law or its role. Information relevant to active litigation, fraud investigation or a legal hold may be kept longer than the normal period.

10. Cookies and local storage

We use cookies and similar technologies that are strictly necessary for the platform, such as maintaining a login or booking session, security and language choice. A selected payment, identity or social-login provider may use necessary technologies in its own view under its notice. Non-essential analytics or marketing cookies are not used without consent.

11. Customer rights

Subject to the applicable conditions, the customer has the right to:

• obtain information and a copy of their personal data;
• have inaccurate or incomplete data corrected;
• request erasure or restriction of processing;
• object, on grounds relating to their particular situation, to processing based on legitimate interests;
• object to direct marketing at any time;
• receive data they provided in a structured, commonly used and machine-readable format and, where possible, have it transmitted;
• withdraw consent without affecting the lawfulness of earlier processing;
• obtain information about automated assessment and request human intervention where applicable law provides for it;
• lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or apply to a court.

Send a request to hello@beautybox.ee. Before responding, we may request proportionate additional information to verify identity. We respond without undue delay and generally within one month; for a complex or numerous request, the period may be extended by up to two months as permitted by law, and we will notify the customer within the first month. The right to erasure is not absolute: for example, we do not have to erase data that must be retained under a legal obligation or for a legal claim.

An account deletion request can be submitted in account security settings or by email. Receiving a request does not mean that all data is deleted at that instant. An unfinished booking, payment or dispute may first need to be resolved; records necessary under law or for a legal claim are retained to a limited extent. Erasure at an external provider is a separate operation, and its failure is not treated as successful erasure. The customer is informed about the handling of the request within the legally required time.

Acknowledging the privacy notice is not general consent to every processing operation. Each purpose relies on the legal basis described above.

12. Security and breaches

We use technical and organisational measures appropriate to the nature of the data, including role-based access, encrypted connections, hashing of passwords and one-time credentials, private evidence storage, audit logging and limited retention. No system is entirely risk-free. We notify the Estonian Data Protection Inspectorate and affected people of a personal-data breach where and within the time required by applicable law.

13. Changes

A new version of this privacy policy applies from publication. The version shown before confirmation remains stored with the booking as evidence. If we intend to use data for a new incompatible purpose, we provide the required supplementary information before further processing and obtain new consent where necessary.