# Privacy & Cookie Policy of Beauty Luxury

---

This document describes how this Application collects and processes the Personal Data of its Users and which Tracking Tools — including Cookies — it uses to do so. It can be printed using the print command found in the settings of any browser.

## 1) Data Controller

**Beauty Luxury S.r.l.**
Via Flaminia, 300
47924 Rimini (RN)
Italy

Email address of the Data Controller: **info@beauty-luxury.com**

## 2) Types of Data Collected

Among the Personal Data collected by this Application, either independently or through third parties, are: Usage Data; Cookies; email; first name; phone number; country; last name; VAT number; business name; address; province; postal code; various types of Data; city; tax code; website; gender; date of birth; profession; fax number; state; business sector; User ID; number of employees; geographical location; username; number of Users; session statistics; payment information; billing address; purchase history; device information; unique advertising device identifiers (such as Google Advertiser ID or IDFA).

Complete details on each type of Personal Data collected are provided in the dedicated sections of this policy or through specific informative texts displayed before the collection of the Data itself.

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during the use of this Application.

Unless otherwise specified, all Data requested by this Application is mandatory. If the User refuses to communicate them, it may be impossible for this Application to provide the Service. In cases where this Application indicates some Data as optional, Users are free to refrain from communicating such Data, without that having any consequence on the availability of the Service or its operation.

Users who have doubts about which Data are mandatory are encouraged to contact the Data Controller.

The possible use of Cookies — or other Tracking Tools — by this Application or the holders of third-party services used by this Application aims to provide the Service requested by the User, in addition to the further purposes described in this document, and in particular those set out in the section “Cookies and Other Tracking Tools”.

The User assumes responsibility for the Personal Data of third parties obtained, published or shared through this Application.

## 3) Methods and Location of Processing Collected Data

**Processing Methods.** The Data Controller adopts appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data.

Processing is carried out using computer and/or telematic tools, with organizational methods and logics strictly linked to the purposes indicated. In addition to the Data Controller, in some cases, the Data may be accessed by other parties involved in the organization of this Application (administrative, commercial, marketing staff, legal, system administrators) or external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies) appointed, if necessary, as Data Processors by the Data Controller. The updated list of Processors can always be requested from the Data Controller.

**Location.** Data are processed at the operational offices of the Data Controller and in any other place where the parties involved in the processing are located. For more information, contact the Data Controller.

The User's Personal Data may be transferred to a country other than the one in which the User is located. For further information on the location of processing, the User can refer to the section related to the details of the processing of Personal Data.

**Retention Period.** Unless otherwise indicated in this document, Personal Data are processed and stored for the time required by the purpose for which they were collected and may be retained for a longer period due to legal obligations or based on the consent of the Users.

## 4) Purpose of Processing Collected Data

User Data are collected to allow the Data Controller to provide the Service, fulfill legal obligations, respond to requests or execute actions, protect its rights and interests (or those of Users or third parties), detect potential fraudulent activities, as well as for the following purposes: Statistics, Remarketing and behavioral targeting, Advertising, Spam protection, Displaying content from external platforms, Contacting the User, Payment management, Data transfer outside the EU, Traffic optimization and distribution, Location-based interactions, Tag management, Contact management and sending messages, and Heat mapping and session recording.

For detailed information on the purposes of processing and the Personal Data processed for each purpose, the User can refer to the section “**Details on the Processing of Personal Data**”. Where these services rely on Cookies or other Tracking Tools, the duration of those Tracking Tools is indicated within each service, and the way they are grouped by consent category is described in the section “**Cookies and Other Tracking Tools**”.

## 5) Details on the Processing of Personal Data

Personal Data are collected for the following purposes and using the following services. Where a service relies on Cookies or similar Tracking Tools, the duration of those Tracking Tools is stated within the corresponding entry.

**5.1) Contacting the User**

**Mailing list or newsletter (This Application).** By registering for the mailing list or newsletter, the User's email address is automatically added to a contact list to which emails containing information, including commercial and promotional content relating to this Application, may be sent. The User’s email address may also be added to this list as a result of registering for this Application or after making a purchase. **Personal Data processed:** email; country; first name; phone number.

**Contact form (This Application).** By filling in the contact form with their Data, the User consents to their use to respond to requests for information, quotes, or any other nature indicated by the header of the form. **Personal Data processed:** postal code; city; tax code; last name; date of birth; email; User ID; address; country; first name; number of employees; fax number; phone number; VAT number; profession; province; business name; gender; business sector; website; state; various types of Data.

**Contact via phone (this Application).** Users who have provided their phone number may be contacted for commercial or promotional purposes related to this Application, as well as to fulfill support requests. **Personal Data processed:** phone number.

**5.2) Contact management and sending messages**

This type of service allows managing a database of email contacts, phone contacts, or contacts of any other type, used to communicate with the User. These services may also allow the collection of data related to the date and time of viewing messages by the User, as well as the User's interaction with them, such as information on clicks on the links present in the messages.

**MailUp (MailUp).** MailUp is an address management and email messaging service provided by MailUp S.p.A. **Personal Data processed:** last name; Cookies; date of birth; Usage Data; email; address; country; first name; phone number; profession; business name; gender; username; various types of Data. **Location of processing:** Italy – [Privacy Policy](https://www.mailup.it/informativa-privacy/).

**Amazon Simple Email Service (Amazon).** Amazon Simple Email Service is an address management and email messaging service provided by Amazon.com Inc. **Personal Data processed:** email. **Location of processing:** United States – [Privacy Policy](https://aws.amazon.com/compliance/data-privacy-faq/).

**5.3) Payment management**

Payment management services allow this Application to process payments by credit card, bank transfer, or other tools. The data used for the payment is acquired directly from the payment service provider without being in any way processed by this Application. Some of these services may also allow the scheduled sending of messages to the User, such as emails containing invoices or notifications regarding the payment.

**PayPal (Paypal).** PayPal is a payment service provided by PayPal Inc., which allows the User to make payments online. **Personal Data processed:** various types of Data as specified by the privacy policy of the service. **Location of processing:** Luxembourg – [Privacy Policy](https://www.paypal.com/en/legalhub/paypal/privacy-full).

**Stripe (Stripe Technology Europe Ltd).** Stripe is a payment service provided by Stripe Technology Europe Ltd. **Personal Data processed:** last name; purchase history; Usage Data; email; billing address; payment information; first name; Tracking Tools; various types of Data as specified by the privacy policy of the service. **Location of processing:** European Union – [Privacy Policy](https://stripe.com/en/privacy). **Duration of Tracking Tools:** 1: undefined; __Host-LinkSession: 2 years; __stripe_mid: 1 year; __stripe_sid: 30 minutes; _mf: undefined; dashboard.banner-dismissals: session duration; link.auth_session_client_secret: session duration; m: 2 years; pay_sid: 1 year.

**5.4) Tag management**

This type of service is functional to the centralized management of tags or scripts used on this Application. The use of such services involves the flow of User Data through them and, if applicable, their retention.

**Google Tag Manager.** Google Tag Manager is a tag management service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data. **Personal Data processed:** Cookies; Usage Data. **Location of processing:** United States – Ireland – [Privacy Policy](https://policies.google.com/privacy).

**5.5) Heat mapping and session recording**

Heat mapping services are used to identify areas of this Application with which Users interact most frequently, in order to detect which of them attract the most interest. These services allow monitoring and analyzing traffic data and are used to track User behavior. Some of these services may record sessions and make them available for later viewing.

**Hotjar Heat Maps & Recordings (Hotjar Ltd.).** Hotjar is a heat mapping and session recording service provided by Hotjar Ltd. Hotjar respects generic “Do Not Track” headers. This means that the browser can inform the script not to collect any User data. This is a setting available in all major browsers. More [information about opting out](https://www.hotjar.com/legal/compliance/opt-out) from Hotjar is available here. **Personal Data processed:** Usage Data; Tracking Tool; various types of Data as specified by the privacy policy of the service. **Location of processing:** Malta – [Privacy Policy](https://www.hotjar.com/legal/policies/privacy) – [Opt Out](https://www.hotjar.com/legal/compliance/opt-out). **Duration of Tracking Tools:** _hjAbsoluteSessionInProgress: 30 minutes; _hjCachedUserAttributes: session duration; _hjClosedSurveyInvites: 1 year; _hjDonePolls: 1 year; _hjFirstSeen: session duration; _hjIncludedInSessionSample: 30 minutes; _hjLocalStorageTest: session duration; _hjMinimizedPolls: 1 year; _hjSession*: 30 minutes; _hjSessionRejected: session duration; _hjSessionResumed: session duration; _hjSessionTooLarge: 1 hour; _hjSessionUser*: 1 year; _hjSessionUser_*: 2 years; _hjShownFeedbackMessage: 1 year; _hjTLDTest: session duration; _hjUserAttributesHash: session duration; _hjViewportId: session duration; _hjid: 1 year.

**5.6) Location-based interactions**

**Non-continuous geolocation (this Application).** This Application may collect, use, and share Data related to the User's geographical location, in order to provide location-based services. Most browsers and devices provide tools by default to deny geographical tracking. If the User has expressly authorized such possibility, this Application may receive information about their actual geographical location. The User's geographical location is obtained non-continuously, upon specific request of the User or when the User does not indicate in the appropriate field the place where they are located and allows the application to automatically detect the location. **Personal Data processed:** geographical location.

**5.7) Traffic optimization and distribution**

This type of service allows this Application to distribute its content through servers located locally and optimize its performance. The Personal Data processed depend on the characteristics and methods of implementation of these services, which by their nature filter communications between this Application and the User's browser. Due to the distributed nature of this system, it is difficult to determine the locations to which the contents are transferred, which may contain User Personal Data.

**Cloudflare (Cloudflare Inc.).** Cloudflare is a traffic optimization and distribution service provided by Cloudflare Inc. The integration methods of Cloudflare require this to filter all traffic from this Application, namely communications between this Application and the User's browser, thus allowing the collection of statistical data on it. **Personal Data processed:** Cookies; various types of Data as specified by the privacy policy of the service. **Location of processing:** United States – [Privacy Policy](https://www.cloudflare.com/privacypolicy/). **Duration of Tracking Tools:** _cfuvid: undefined; cf_clearance: 30 minutes.

**5.8) Spam protection**

This type of service analyzes the traffic of this Application, potentially containing Personal Data of Users, in order to filter out traffic, messages, and content recognized as SPAM.

**Google reCAPTCHA.** Google reCAPTCHA is a spam protection service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data. The use of the reCAPTCHA system is subject to the [privacy policy](https://www.google.com/intl/en/policies/privacy/) and the [terms of use](https://www.google.com/intl/en/policies/terms/) of Google. For an understanding of how Google uses the data, please consult the [Google Partner Policy](https://www.google.com/intl/en/policies/privacy/partners/). **Personal Data processed:** Cookies; Usage Data. **Location of processing:** United States – [Privacy Policy](https://business.safety.google/privacy/) – Ireland – [Privacy Policy](https://business.safety.google/privacy/). **Duration of Tracking Tools:** _GRECAPTCHA: session duration; rc::a: undefined; rc::b: session duration; rc::c: session duration; rc::f: undefined.

**5.9) Advertising**

Some of the services listed below may use Tracking Tools to identify the User, or use behavioral retargeting techniques, that is, displaying personalized advertisements based on the User’s interests and behavior, or measuring the performance of advertisements. For more information, we suggest checking the privacy policies of the respective services. Generally, services of this type offer the option to disable such tracking. In addition to any opt-out function provided by any of the services listed in this document, the User can read more about how to disable interest-based advertising in the section “Cookies and Other Tracking Tools”.

**Meta Ads Conversion Tracking (Meta Pixel) (Facebook, Inc.).** Meta Ads conversion tracking (Meta Pixel) is a statistics service provided by Meta Platforms, Inc. or Meta Platforms Ireland Limited, depending on how the Data Controller manages the processing of Data, that connects data from the Meta advertising network with actions performed within this Application. The Meta pixel monitors conversions that can be attributed to Facebook, Instagram, and Audience Network ads. **Personal Data processed:** Usage Data; Tracking Tools. **Location of processing:** USA – [Privacy Policy](https://www.facebook.com/about/privacy/). **Duration of Tracking Tools:** _fbc: 3 months; _fbp: 3 months; fr: 3 months; lastExternalReferrer: session duration; lastExternalReferrerTime: session duration.

**Google Ads Conversion Tracking.** Google Ads conversion tracking is a statistics service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data, that connects data from the Google Ads advertising network with actions performed within this Application. **Personal Data processed:** Usage Data; Tracking Tools. **Location of processing:** United States – [Privacy Policy](https://policies.google.com/privacy); Ireland – [Privacy Policy](https://policies.google.com/privacy). **Duration of Tracking Tools:** IDE: 2 years; test_cookie: 15 minutes.

**TikTok Conversion Tracking (TikTok Inc.).** TikTok conversion tracking is a statistics service provided by TikTok Inc. that connects data from the TikTok advertising network with actions performed within this Application. The TikTok pixel tracks conversions that can be attributed to TikTok ads and allows targeting groups of Users based on their previous use of this Application. **Personal Data processed:** Usage Data; unique advertising device identifiers (such as Google Advertiser ID or IDFA identifier, for example); device information; Tracking Tools. **Location of processing:** United States – [Privacy Policy](https://www.tiktok.com/legal/privacy-policy?lang=en). **Duration of Tracking Tools:** _tt_enable_cookie: 2 years; _ttp: 2 years; tt_appInfo: undefined; tt_pixel_session_index: undefined; tt_sessionId: undefined.

**Direct Email Marketing (DEM) (this Application).** This Application uses User Data to send commercial proposals related to services and products provided by third parties or unrelated to the product or service provided by this Application. **Personal Data processed:** last name; email; first name.

**5.10) Remarketing and Behavioral Targeting**

This type of service allows this Application and its partners to communicate, optimize, and serve advertisements based on the past use of this Application by the User. This activity is facilitated by tracking Usage Data and using Tracking Tools to collect information that is then transferred to partners managing the remarketing and behavioral targeting activities. Some services offer a remarketing option based on email address lists. In addition to the opt-out functionalities offered by the following services, the User can opt out by visiting the [Network Advertising Initiative opt-out page](http://optout.networkadvertising.org/). Users can also choose not to participate in specific advertising features through the corresponding device configuration options, such as mobile device advertising settings or general advertising configuration.

**Facebook Remarketing (Facebook, Inc.).** Facebook Remarketing is a remarketing and behavioral targeting service provided by Facebook, Inc. that links the activity of this Application with the Facebook advertising network. **Personal Data processed:** Cookies; Usage Data. **Location of processing:** USA – [Privacy Policy](https://www.facebook.com/about/privacy/) – [Opt Out](https://www.aboutads.info/choices/). **Duration of Tracking Tools:** _fbp: 3 months; lastExternalReferrer: session duration.

**Remarketing with Google Analytics.** Remarketing with Google Analytics is a remarketing and behavioral targeting service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data, that connects the tracking activity performed by Google Analytics and its Cookies with the Google Ads advertising network and the DoubleClick Cookie. **Personal Data processed:** Cookies; Usage Data. **Location of processing:** United States – [Privacy Policy](https://policies.google.com/privacy) – [Opt Out](https://adssettings.google.com/authenticated?hl=en); Ireland – [Privacy Policy](https://policies.google.com/privacy). **Duration of Tracking Tools:** test_cookie: 15 minutes; IDE: 2 years; _gcl_*: 3 months.

**Facebook Custom Audience (Facebook, Inc.).** Facebook Custom Audience is a remarketing and behavioral targeting service provided by Facebook, Inc. that links the activity of this Application with the Facebook advertising network. **Personal Data processed:** Cookies; email. **Location of processing:** United States – [Privacy Policy](https://www.facebook.com/about/privacy/) – [Opt Out](https://www.aboutads.info/choices/). **Duration of Tracking Tools:** _fbp: 3 months; lastExternalReferrer: session duration; lastExternalReferrerTime: session duration.

**5.11) Statistics**

The services contained in this section allow the Data Controller to monitor and analyze traffic data and serve to track User behavior.

**Facebook Analytics for Apps (Facebook, Inc.).** Facebook Analytics for Apps is a statistics service provided by Facebook, Inc. **Personal Data processed:** Usage Data; various types of Data as specified by the privacy policy of the service. **Location of processing:** USA – [Privacy Policy](https://www.facebook.com/about/privacy/).

**Google Analytics 4.** Google Analytics is a statistics service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data (“Google”). Google uses the Personal Data collected to track and examine the use of this Application, compile reports and share them with other services developed by Google. Google may use the Personal Data to contextualize and personalize advertisements on its advertising network. In Google Analytics 4, IP addresses are used at the time of collection and then deleted before the data is recorded in any data center or server. To learn more, you can refer to the [official Google documentation](https://support.google.com/analytics/answer/12017362?hl=en&ref_topic=2919631). For an understanding of how Google uses the data, please consult the [Google Partner Policy](https://www.google.com/intl/en/policies/privacy/partners/). **Personal Data processed:** Usage Data; number of Users; session statistics; Tracking Tools. **Location of processing:** United States – [Privacy Policy](https://business.safety.google/privacy/) – [Opt Out](https://tools.google.com/dlpage/gaoptout?hl=en); Ireland – [Privacy Policy](https://business.safety.google/privacy/) – [Opt Out](https://tools.google.com/dlpage/gaoptout?hl=en). **Duration of Tracking Tools:** _ga: 2 years; _ga_*: 2 years.

**5.12) Displaying content from external platforms**

This type of service allows viewing content hosted on external platforms directly from the pages of this Application and interacting with them. In the event that a service of this kind is installed, it is possible that, even if Users do not use the service, it collects traffic data regarding the pages where it is installed.

**Fonts.com Web Fonts (Monotype Imaging Holdings Inc.).** Fonts.com Web Fonts is a service for displaying font styles managed by Monotype Imaging Holdings Inc. that allows this Application to integrate such content into its pages. **Personal Data processed:** Usage Data; various types of Data as specified by the privacy policy of the service. **Location of processing:** USA – [Privacy Policy](http://www.monotype.com/legal/privacy-policy).

**Google Fonts.** Google Fonts is a service for displaying font styles managed by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data, allowing this Application to integrate such content into its pages. **Personal Data processed:** Usage Data; various types of Data as specified by the privacy policy of the service. **Location of processing:** United States – [Privacy Policy](https://policies.google.com/privacy); Ireland – [Privacy Policy](https://policies.google.com/privacy).

## 6) Cookies and Other Tracking Tools

This Application uses Tracking Tools to achieve the purposes described above. Such technologies enable the Data Controller to collect and store information (for example, through the use of Cookies) or to utilize resources (for example, executing a script) on the User's device. For simplicity, these technologies are collectively referred to as “Tracking Tools”, and the term Cookie is used only to indicate the particular type of Tracking Tool stored within the User's browser.

This Application uses Tracking Tools that are managed directly by the Data Controller (“first-party Tracking Tools”) and Tracking Tools that enable services provided by third parties (“third-party Tracking Tools”). Unless otherwise specified, such third parties have access to their respective Tracking Tools. The duration and expiration of Cookies and similar Tracking Tools may vary depending on what is set by the Data Controller or by each third-party provider; some expire at the end of the browsing session. The specific durations are indicated within each service in the section “Details on the Processing of Personal Data” above.

**6.1) How this Application groups Tracking Tools**

**Necessary.** Cookies commonly referred to as “technical”, or similar Tracking Tools, used to perform activities strictly necessary to ensure the functioning or delivery of the Service. This category includes the first-party localStorage and sessionStorage described below, as well as Google reCAPTCHA (Spam protection), Cloudflare (Traffic optimization and distribution), Google Tag Manager (Tag management) and Stripe (Payment management).

**Measurement.** Tracking Tools used to measure traffic and analyze User behavior in order to improve the Service. This category includes Hotjar Heat Maps & Recordings (Heat mapping and session recording) and Google Analytics 4 (Statistics).

**Marketing.** Tracking Tools used to provide personalized ads or marketing content and to measure their performance. This category includes Facebook Remarketing, Remarketing with Google Analytics, Facebook Custom Audience, Meta Ads Conversion Tracking (Meta Pixel), Google Ads Conversion Tracking, TikTok Conversion Tracking and MailUp. The full description, Data processed, location and Tracking Tool duration for each of these services are provided in the section “Details on the Processing of Personal Data”.

**6.2) First-party Tracking Tools managed directly by the Data Controller**

**localStorage (this Application).** localStorage allows this Application to store and access data directly from the User's browser without an expiration date. **Personal Data processed:** Tracking Tool.

**sessionStorage (this Application).** sessionStorage allows this Application to store and access data directly from the User's browser. Data in sessionStorage is automatically deleted when the session ends (in other words, when the browser tab is closed). **Personal Data processed:** Tracking Tool.

**6.3) How to manage preferences and provide or withdraw consent**

Where the use of Trackers is based on consent, the User can provide or withdraw such consent by setting or updating their preferences through the relevant privacy choices panel available on this Application. Regarding third-party Tracking Tools, Users can manage their preferences by visiting the corresponding opt-out link (if available), using the tools described in the third party's privacy policy, or contacting the third party directly.

**How to Control or Delete Cookies and Similar Technologies Through Your Device Settings.** Users can use their browser settings to: 1) see which Cookies or other similar technologies have been set on the device; 2) block Cookies or similar technologies; 3) delete Cookies or similar technologies from the browser. However, browser settings do not allow for granular control of consent by category.

Users can, for example, find information on how to manage Cookies in some of the most popular browsers at the following addresses: [Google Chrome](https://support.google.com/chrome/answer/95647?hl=en&p=cpn_cookies); [Mozilla Firefox](https://support.mozilla.org/en-US/kb/Enable-and-disable-cookies-website-preferences); [Apple Safari](https://support.apple.com/en-us/HT201265); [Microsoft Internet Explorer](http://windows.microsoft.com/en-us/windows-vista/block-or-allow-cookies); [Microsoft Edge](https://support.microsoft.com/en-us/help/4027947/windows-10-how-to-delete-cookies); [Brave](https://support.brave.com/hc/en-us/articles/360022806212-How-do-I-use-Shields-while-browsing); [Opera](https://help.opera.com/en/latest/web-preferences/#cookies). Users can also manage some Tracking Tools for mobile applications by disabling them through the device's settings, such as mobile advertising settings or general tracking settings.

**How to Disable Interest-Based Advertising.** Notwithstanding the above, Users are informed of the possibility of utilizing the information available on [YourOnlineChoices](http://www.youronlinechoices.eu/) (EU and UK), [Network Advertising Initiative](https://thenai.org/about-online-advertising/) (USA) and [Digital Advertising Alliance](https://www.aboutads.info/consumers/) (USA), [DAAC](https://youradchoices.ca/understanding-online-advertising/) (Canada), [DDAI](http://www.ddai.info/optout) (Japan), or other similar services. These services allow for the management of tracking preferences for most advertising tools. The Digital Advertising Alliance also provides an application called [AppChoices](https://youradchoices.com/appchoices) that helps Users control behavioral advertising on mobile applications.

**Consequences of Refusing the Use of Tracking Tools.** Users are free to decide whether or not to allow the use of Tracking Tools. However, please note that Tracking Tools enable this Application to provide Users with a better experience and advanced functionalities (in line with the purposes outlined in this document). Therefore, if the User decides to block the use of Tracking Tools, the Data Controller may not be able to provide those functionalities.

## 7) Further Information on the Processing of Personal Data

**Sale of goods and services online.** The Personal Data collected are used for the provision of services to the User or for the sale of products, including payment and potential delivery. The Personal Data collected for completing the payment may relate to the credit card, the current account used for the transfer, or other payment tools. The payment Data collected by this Application depend on the payment system used.

**Push notifications.** This Application may send push notifications to the User.

## 8) Further Information for Users

**Legal basis for processing.** The Data Controller processes Personal Data relating to the User if one of the following conditions applies:

8.1) The User has given consent for one or more specific purposes.

8.2) The processing is necessary for the performance of a contract with the User and/or for the execution of pre-contractual measures;

8.3) The processing is necessary to comply with a legal obligation to which the Data Controller is subject;

8.4) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;

8.5) The processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

It is always possible to request the Data Controller to clarify the concrete legal basis of each processing and in particular to specify whether the processing is based on law, required by a contract, or necessary to conclude a contract.

**Further information on the retention period.** Unless otherwise indicated in this document, Personal Data are processed and stored for the time required by the purpose for which they were collected and may be retained for a longer period due to legal obligations or based on the consent of the Users. Therefore:

8.6) Personal Data collected for purposes related to the execution of a contract between the Data Controller and the User will be retained until the completion of such contract.

8.7) Personal Data collected for purposes related to the legitimate interest of the Data Controller will be retained until the satisfaction of such interest. The User can obtain further information regarding the legitimate interest pursued by the Data Controller in the relevant sections of this document or by contacting the Data Controller.

When the processing is based on the consent of the User, the Data Controller may retain Personal Data for a longer period until such consent is revoked. Furthermore, the Data Controller may be obligated to retain Personal Data for a longer period in order to comply with a legal obligation or by order of an authority. At the end of the retention period, Personal Data will be deleted. Consequently, upon expiry of that term, the rights of access, deletion, rectification, and the right to data portability can no longer be exercised.

**User Rights under the General Data Protection Regulation (GDPR).** Users may exercise certain rights with regard to the Data processed by the Data Controller. In particular, within the limits prescribed by law, the User has the right to:

8.8) revoke consent at any time. The User can revoke consent for the processing of their Personal Data previously expressed.

8.9) object to the processing of their Data. The User may object to the processing of their Data when it occurs on a legal basis other than consent.

8.10) access their Data. The User has the right to obtain information on the Data processed by the Data Controller, on certain aspects of the processing and to receive a copy of the Data processed.

8.11) verify and request rectification. The User can verify the accuracy of their Data and request its update or correction.

8.12) obtain the restriction of processing. The User may request the restriction of the processing of their Data. In this case, the Data Controller will not process the Data for any other purpose than their retention.

8.13) obtain deletion or removal of their Personal Data. The User may request the deletion of their Data by the Data Controller.

8.14) receive their Data or have them transferred to another controller. The User has the right to receive their Data in a structured, commonly used, and machine-readable format and, where technically feasible, to obtain its transfer without hindrance to another controller.

8.15) lodge a complaint. The User can lodge a complaint with the competent data protection authority or take legal action.

Users have the right to obtain information regarding the legal basis for the transfer of Data abroad, including to any international organization governed by international law or established by two or more countries, such as the UN, as well as regarding the security measures adopted by the Data Controller to protect their Data.

**Details on the right to object.** When Personal Data are processed in the public interest, in the exercise of official authority vested in the Data Controller or to further the legitimate interest of the Data Controller, Users have the right to object to the processing for reasons related to their particular situation. It is brought to the Users' attention that, where their Data are processed for direct marketing purposes, they may object to processing at any time, free of charge, and without providing any justification. If Users object to the processing for direct marketing purposes, Personal Data will no longer be processed for such purposes. To find out if the Data Controller processes Data for direct marketing purposes, Users can refer to the relevant sections of this document.

**How to exercise rights.** Any requests to exercise the rights of the User can be addressed to the Data Controller through the contact details provided in this document. The request is free of charge and the Data Controller will respond as quickly as possible, in any case within one month, providing the User with all information required by law. Any rectifications, cancellations, or processing restrictions will be communicated by the Data Controller to each of the recipients, if any, to whom the Personal Data have been transmitted, unless this proves impossible or involves a disproportionate effort. The Data Controller informs the User of such recipients if they so request.

**Transfer of personal data outside the European Union.** Transfer to third countries based on standard contractual clauses. When this is the legal basis, the transfer of Personal Data from the EU to third countries occurs based on standard contractual clauses for the protection of Personal Data adopted by the European Commission. In such cases, the Data recipients have agreed to process the Personal Data in accordance with the levels of protection provided by the legislation. Users may request further information by contacting the Data Controller using the contact details provided in this document.

## 9) Further Information on the Processing

**Defense in legal proceedings.** The User's Personal Data may be used by the Data Controller in legal proceedings or in the preparatory stages of its possible establishment to defend against abuses in the use of this Application or connected Services by the User. The User declares to be aware that the Data Controller may be obligated to disclose the Data by order of public authorities.

**Specific disclosures.** At the request of the User, in addition to the information contained in this policy, this Application may provide the User with additional and contextual disclosures regarding specific Services, or the collection and processing of Personal Data.

**System logs and maintenance.** For operational and maintenance needs, this Application and any third-party services used by it may collect system logs, which are files that record interactions and may also contain Personal Data, such as the User's IP address.

**Information not contained in this policy.** Further information regarding the processing of Personal Data may be requested at any time from the Data Controller using the contact details provided.

**Changes to this policy.** The Data Controller reserves the right to make changes to this Privacy & Cookie Policy at any time notifying Users on this page and, if possible, on this Application as well as, when technically and legally feasible, by sending a notification to Users through one of the contact details in its possession. It is therefore advisable to consult this page often, referring to the date of last modification indicated at the bottom. If the changes involve processing whose legal basis is consent, the Data Controller will collect again the consent of the User if necessary.

## 10) Definitions and Legal References

**Personal Data (or Data).** Personal data is any information that, directly or indirectly, including any other information, makes an identified or identifiable natural person identifiable.

**Usage Data.** Information collected automatically through this Application (including through third-party applications integrated into this Application), including: IP addresses or domain names of the computers used by the User connecting to this Application, addresses in URI (Uniform Resource Identifier) notation, the time of the request, the method used to forward the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response from the server (successful, error, etc.), the country of origin, the characteristics of the browser and operating system used by the visitor, the various temporal connotations of the visit (for example, time spent on each page) and the details relating to the path followed within the Application, particularly with reference to the sequence of pages consulted, parameters related to the operating system and User's computer environment.

**User.** The individual using this Application who, unless otherwise specified, coincides with the Data Subject.

**Data Subject.** The natural person to whom the Personal Data refers.

**Data Processor (or Processor).** The natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller, as outlined in this policy.

**Data Controller (or Controller).** The natural or legal person, public authority, service, or other body that, individually or together with others, determines the purposes and means of the processing of personal data and the tools adopted, including the security measures related to the operation and use of this Application. The Data Controller, unless otherwise specified, is the owner of this Application.

**This Application.** The hardware or software tool by which the Personal Data of Users are collected and processed.

**Service.** The Service provided by this Application as defined in the relevant terms (if any) on this site/application.

**European Union (or EU).** Unless otherwise specified, any reference to the European Union contained in this document is to be extended to all current member states of the European Union and the European Economic Area.

**Cookies.** Cookies are Tracking Tools consisting of small amounts of data stored within the User's browser.

**Tracking Tool.** A Tracking Tool refers to any technology – e.g., Cookies, unique identifiers, web beacons, embedded scripts, e-tags, and fingerprinting – that enables the tracking of Users by collecting or saving information on the User’s device.

**Legal References.** Unless otherwise specified, this privacy notice concerns only this Application.

## Contact
- Phone: +39 0541 648566
- WhatsApp: https://wa.me/393311720492
- Email: info@beauty-luxury.com
- Facebook: https://www.facebook.com/beautyluxuryspa
- Instagram: https://www.instagram.com/beautyluxuryspa/
- TikTok: https://www.tiktok.com/@beautyluxuryspa
- LinkedIn: https://it.linkedin.com/company/beauty-luxury
- YouTube: https://www.youtube.com/beautyluxuryitalia
- Pinterest: https://it.pinterest.com/beautyluxuryspa/