Privacy Policy
Last updated: 2 October 2026
This Privacy Policy explains how Nereïde collects, uses, stores, shares, and protects your personal data when you visit www.nereidebeachwear.com, place an order, submit information for personalized color analysis, contact us, or subscribe to our marketing communications.
1. Who We Are
The controller responsible for your personal data is:
Bibianna Szczepanczyk, trading as Nereïde, a sole proprietorship registered in Poland.
Email: contact@nereidebeachwear.com
In this Privacy Policy, “Nereïde,” “we,” “us,” and “our” refer to the data controller identified above.
You can contact us at any time at contact@nereidebeachwear.com regarding this Privacy Policy, the processing of your personal data, or the exercise of your data-protection rights.
2. Personal Data We Collect
The personal data we collect depends on how you interact with us.
Information you provide directly
This may include:
your name;
email address and telephone number;
billing and shipping addresses;
order number and purchase information;
size, color preferences, product selections, and personalization requests;
messages, questions, feedback, and customer-service correspondence;
photographs submitted for personalized color analysis;
information you voluntarily provide about your natural coloring, appearance, or preferences;
newsletter subscription information;
information provided through forms on our website;
any other information you choose to provide to us.
Please do not include medical information, health information, or other sensitive personal information in your color-profile notes unless it is strictly necessary.
Order and payment information
When you make a purchase, we collect the information necessary to process and manage your order.
Payments are processed by third-party payment providers available through our ecommerce platform. We do not normally receive or store your complete payment-card details. Payment information is processed directly by the relevant payment provider in accordance with its own privacy policy.
Information collected automatically
When you visit our website, certain technical information may be collected automatically, including:
IP address;
browser and device type;
operating system;
pages viewed and actions taken on the website;
referring website or source;
approximate location derived from your IP address;
date and time of visits;
cookie identifiers and similar technical information.
Some of this information is necessary for the website to function securely and correctly.
Analytics, advertising, personalization, and other optional technologies are used only where permitted by applicable law and, where required, after you have provided consent.
3. How and Why We Use Your Personal Data
We process personal data only where we have an appropriate legal basis under applicable data-protection law.
To process and fulfil your order
We may use your contact, order, delivery, and personalization information to:
confirm and manage your purchase;
create or personalize your products;
arrange production, fulfilment, and delivery;
provide order and shipping updates;
handle returns, complaints, refunds, or replacements;
communicate with you regarding your order.
The legal basis for this processing is the performance of our contract with you or taking steps at your request before entering into a contract.
To provide personalized color analysis
Where you purchase or request a personalized product or color service, we may use the photographs, preferences, order information, and notes you provide to:
evaluate visible characteristics relevant to color analysis;
identify shades intended to complement your natural coloring;
recommend product colors;
select or confirm the color of a personalized product;
communicate with you if additional information or photographs are required;
maintain a limited record of the recommendation associated with your order.
Providing sufficiently clear photographs may be necessary for us to perform a personalized color analysis. If the required information is not provided, we may be unable to complete the analysis or produce the personalized item.
The legal basis for this processing is generally the performance of our contract with you or taking steps at your request before entering into a contract.
To provide customer service
We may use your contact information, order details, and correspondence to answer questions, resolve problems, and provide support before and after a purchase.
Depending on the circumstances, this processing is based on the performance of our contract with you or our legitimate interest in operating our business and providing effective customer service.
To comply with legal obligations
We may process and retain certain personal data where required for purposes including:
accounting and taxation;
invoicing;
consumer-protection obligations;
record keeping;
responding to lawful requests from public authorities;
compliance with applicable laws and regulations.
The legal basis for this processing is compliance with our legal obligations.
To protect our business and legal rights
Where necessary, we may process personal data to:
prevent or investigate fraud, misuse, or security incidents;
establish, exercise, or defend legal claims;
enforce our terms and policies;
protect our website, customers, systems, and business operations.
This processing is based on our legitimate interests, provided that those interests are not overridden by your rights and freedoms.
To send marketing communications
Where you have subscribed or otherwise provided valid permission, we may send you:
newsletters;
new collection announcements;
product updates;
offers;
other promotional communications.
Where consent is the applicable legal basis, you may withdraw that consent at any time.
You can unsubscribe at any time by using the unsubscribe link included in our marketing emails or by contacting us at contact@nereidebeachwear.com.
Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
4. Photographs and Color-Profile Information
Photographs submitted for personalized color analysis are used for the purpose of providing the color-analysis or personalization service connected with your request or order.
We may assess visible characteristics such as:
skin tone;
eye color;
hair color;
contrast;
depth;
chromatic intensity;
overall natural coloring.
This assessment is used only to provide color recommendations and personalize our products or services.
Your photographs will not be used for:
facial recognition;
identity verification;
creating biometric identification templates;
identifying you through biometric technology;
public advertising;
social-media content;
testimonials;
portfolio materials;
selling or licensing your photographs to third parties.
We will use your photographs for advertising, social media, testimonials, portfolio materials, or other promotional purposes only if you have provided separate and specific permission for that use.
Please upload photographs only of yourself.
If you submit a photograph containing another identifiable person, you confirm that you are authorized to provide the photograph and that the person has been appropriately informed about the processing of their personal data.
5. AI-Assisted Tools
We may use AI-assisted or software-based tools to support parts of the personalized color-analysis process.
Where such tools are used:
only information reasonably necessary for the relevant analysis is provided;
photographs or other information submitted to the tool may constitute personal data;
we seek to use service providers offering appropriate privacy, security, and data-processing safeguards;
the tool is used as an aid to the analysis rather than as the sole decision-maker;
the final recommendation is subject to human assessment or review;
we do not use such tools to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you;
where personal data is transferred internationally, an appropriate transfer mechanism is used where required by law.
We do not use photographs submitted for color analysis to train our own facial-recognition system or to create biometric identification profiles.
6. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Some cookies are necessary for functions such as:
website security;
shopping-cart functionality;
checkout;
account or session functionality;
language and preference settings;
other essential website features.
Strictly necessary technologies may be used without consent where permitted by law.
Optional technologies, which may include analytics, advertising, or personalization cookies, are used only in accordance with applicable law and, where consent is required, after you have made the relevant selection through our cookie banner.
You can accept, reject, or manage optional cookies through the cookie-preference controls available on our website.
You may change your preferences at any time.
For more detailed information about the cookies and similar technologies we use, please see our Cookie Policy.
7. How We Share Personal Data
We do not sell your personal data.
We may share personal data with trusted service providers where necessary to operate our website, process orders, provide our services, communicate with customers, and comply with legal obligations.
These recipients may include:
Squarespace, which provides our website and ecommerce platform;
production and fulfilment partners that manufacture, package, and ship our products;
payment-processing providers;
shipping companies and couriers;
email and newsletter service providers;
form, file-upload, and cloud-storage providers;
IT, website-security, and technical-support providers;
analytics and advertising providers, where the required consent has been obtained;
AI-assisted or software-based tools used to support color analysis;
accountants, tax advisers, lawyers, insurers, and other professional advisers;
public authorities, regulators, or courts where disclosure is required or permitted by law.
Service providers receive only the personal data reasonably necessary for the relevant service.
For example, a production or delivery partner may receive your name, delivery address, contact information, and product details where this is necessary to manufacture or deliver your order.
Some providers may act as processors on our behalf, while others may process certain information as independent controllers under their own privacy policies.
8. International Data Transfers
Some of our service providers, their servers, teams, or subcontractors may be located outside Poland or outside the European Economic Area.
This may include processing in the United States or other countries.
Where personal data is transferred outside the European Economic Area and a legal transfer mechanism is required, we rely on appropriate safeguards as applicable, which may include:
an adequacy decision adopted by the European Commission;
the EU-US Data Privacy Framework, where applicable;
European Commission Standard Contractual Clauses;
another transfer mechanism or safeguard permitted under applicable data-protection law.
You may contact us at contact@nereidebeachwear.com if you would like more information about the safeguards applicable to a particular transfer.
9. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including for compliance with legal, accounting, taxation, consumer-protection, and dispute-resolution requirements.
Our usual retention approach is as follows:
Order and invoice records
Order, accounting, invoice, and transaction information may be retained for the period required under applicable tax, accounting, and commercial laws.
Customer correspondence
Customer-service correspondence may be retained for as long as necessary to resolve the relevant matter and, where appropriate, until related legal claims become time-barred.
Color recommendations
A limited record of a personalized color recommendation may be retained for up to 2 years after completion of the relevant order, so that we can provide customer support and maintain consistency in relation to related requests.
Uploaded photographs
Photographs submitted specifically for personalized color analysis are normally deleted within 90 days after the personalized order is shipped or the analysis is completed.
They may be retained for longer where reasonably necessary to resolve an active complaint, dispute, chargeback, or legal claim, or where a different retention period has been separately agreed with you.
Where legally possible, you may request earlier deletion by contacting us.
Marketing information
Newsletter and marketing-subscription information is generally retained until you unsubscribe, withdraw your consent, or we otherwise determine that it is no longer necessary.
We may retain limited information necessary to record an unsubscribe request so that we can respect your preference in the future.
Cookie-consent records
Records of cookie and privacy preferences may be retained for the period reasonably necessary to document your choices and demonstrate compliance with applicable law.
Legal claims
Information relevant to a legal claim may be retained until the applicable limitation period has expired or the dispute has been finally resolved.
We may retain certain information for longer where required by law.
10. Your Data-Protection Rights
Subject to the conditions and limitations provided by applicable law, you may have the right to:
request access to your personal data;
receive a copy of personal data we hold about you;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data;
request restriction of processing;
object to processing based on legitimate interests;
object at any time to the use of your personal data for direct marketing;
receive certain personal data in a structured, commonly used, machine-readable format;
request transmission of certain personal data to another controller where legally applicable;
withdraw your consent at any time where processing is based on consent;
lodge a complaint with a competent data-protection supervisory authority.
These rights are subject to applicable legal conditions and exceptions.
For example, we may be required to retain certain invoice, accounting, or order records even after you request deletion because we have a legal obligation to keep them.
How to exercise your rights
To exercise any of these rights, contact us at:
Please explain your request clearly.
Where reasonably necessary, we may ask you for additional information to confirm your identity before acting on a request. Any information collected for identity verification will be used only for that purpose.
We will respond within the period required by applicable data-protection law.
11. Right to Lodge a Complaint
If you believe that your personal data has been processed in violation of applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority.
As the controller is established in Poland, the relevant Polish supervisory authority is the:
President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych / UODO)
You may also have the right to contact the data-protection authority in the EU or EEA country where you live, work, or where the alleged infringement took place.
We encourage you to contact us at contact@nereidebeachwear.com if you have a privacy concern so that we can try to address it.
12. Security
We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful:
destruction;
loss;
alteration;
unauthorized disclosure;
unauthorized access.
Depending on the circumstances, these measures may include:
access controls;
secure user accounts;
password protection;
encryption provided by our service platforms;
access limitations;
secure ecommerce infrastructure;
reputable production, payment, fulfilment, and technology providers.
However, no website, email transmission, or online-storage system can be guaranteed to be completely secure.
Please use the designated form or secure method when submitting photographs for personalized color analysis and avoid sending personal photographs through public social-media comments or other public channels.
13. Automated Decision-Making
We do not use your personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.
Software or AI-assisted tools used in connection with personalized color analysis serve as support tools.
The final color recommendation or personalized product selection is subject to human assessment or review.
14. Children’s Privacy
Our website and personalized color-analysis services are not directed at children under the age of 18.
We do not knowingly request color-profile photographs directly from children.
A parent or legal guardian should contact us before submitting photographs or other personal data relating to a minor for a personalized service.
If we become aware that personal data relating to a child has been submitted without appropriate authorization, we will take reasonable steps to delete it where required.
15. Third-Party Websites and Services
Our website may contain links to websites, social-media platforms, or other services operated by third parties.
Those third parties may process personal data under their own privacy policies.
We are not responsible for the privacy practices of third-party websites or services that we do not control.
We recommend reviewing the privacy information provided by a third party before submitting personal data to it.
16. Social Media
If you interact with Nereïde through social-media platforms, such as by following our account, commenting, sending a direct message, tagging us, or otherwise interacting with our content, the relevant social-media provider may also process your personal data in accordance with its own privacy policy.
We may process information you choose to provide through those platforms for purposes such as:
responding to messages or comments;
providing customer support;
managing enquiries;
communicating about collaborations or orders;
interacting with our community.
Where we wish to use photographs, videos, testimonials, or other content created by you for our own promotional purposes, we will obtain permission where required.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time where our services, technology, service providers, business practices, or legal obligations change.
The current version will be published on this page together with the date of the latest update.
Where a change materially affects how we process your personal data, we will provide additional notice where required by applicable law.
We encourage you to review this Privacy Policy periodically.
18. Contact Us
For questions about this Privacy Policy, our use of your personal data or photographs, or the exercise of your data-protection rights, please contact:
Nereïde
Data controller: Bibianna Szczepanczyk, trading as Nereïde
Email: contact@nereidebeachwear.com