Privacy Policy

1. Data Controller

The controller responsible for your personal and business data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") is:

We operate the "Source Parfums" trade brand and serve business customers (retailers and distributors) across the European Union.

2. Data We Collect

Our platform is a business-to-business service. Catalogue browsing requires no account, but requesting a verified trade account requires you to submit the data below. We collect only what is needed to verify and manage a wholesale relationship:

• Contact details — first and last name, email address, phone number, and (where relevant) a separate financial contact email.
• Company identity — registered company name, company registration number, and business address (including country, region, and postcode).
• Tax data — VAT country code and VAT number, together with the uploaded VAT certificate document used to confirm your tax status.
• Banking details — bank account number / IBAN and bank name, used to set up and reconcile wholesale transactions.
• Account & correspondence — the credentials you create, any website you provide, and messages you exchange with us through your account.
• Technical data — strictly necessary session and security information required to keep you signed in and to protect the site (see our Cookie Policy).

Where the information you submit relates to a company or a named contact within it, that information may constitute personal data of the individuals concerned, and is handled accordingly.

3. Why We Process Your Data

• To review and verify your trade account application and confirm your business is eligible for wholesale access.
• To open pricing and catalogue functions once your account is approved by a member of our team.
• To manage the ongoing wholesale relationship, including quotations, order requests, invoicing, and payment reconciliation.
• To communicate with you about your account, requests, and orders.
• To meet our own legal, tax, and accounting obligations.
• To keep the platform secure and prevent fraudulent or abusive registrations.

4. Legal Basis

Depending on the activity, we rely on the following GDPR legal bases:

• Performance of a contract (Art. 6(1)(b)) — to take steps at your request before entering into, and to perform, a wholesale supply agreement.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, VAT, accounting, and record-keeping requirements.
• Legitimate interests (Art. 6(1)(f)) — to verify business customers, prevent fraud, secure the platform, and manage the commercial relationship, provided these interests are not overridden by your rights.

5. How We Share Data

We do not sell your data. We share it only where necessary: with service providers who process data on our behalf under contract (for example hosting, payment, and accounting providers), with tax and public authorities where the law requires it, and with our professional advisers. Any processor acting on our behalf is bound to process data only on our instructions and to keep it secure.

6. International Transfers

We are established in Poland and primarily process data within the European Economic Area. Where a service provider processes data outside the EEA, we take steps to ensure an appropriate level of protection, such as European Commission adequacy decisions or Standard Contractual Clauses.

7. Data Retention

We keep account and transaction data for as long as your trade account is active and thereafter for the period required to meet our legal, tax, and accounting obligations (in Poland, business and tax records are generally retained for several years). Applications that are not approved are kept only as long as needed to document the decision, and then deleted or anonymised.

8. Your Rights

Subject to the conditions in the GDPR, you have the right to:

• Access the personal data we hold about you and request a copy.
• Have inaccurate or incomplete data corrected.
• Request erasure of your data ("right to be forgotten") where applicable.
• Request that we restrict processing in certain circumstances.
• Receive your data in a portable, machine-readable format (data portability).
• Object to processing based on our legitimate interests.
• Withdraw any consent you have given, without affecting prior processing.

To exercise any of these rights, contact us at info@primesource.com. You also have the right to lodge a complaint with your local data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

9. Data Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure, including encrypted connections, access controls, and restricted handling of financial documents. No transmission over the internet can be guaranteed to be completely secure.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. Material changes affecting your rights will be communicated through your account or by email where appropriate.