Privacy and Cookie Policy

This page explains which personal data we collect when you visit www.beauty-luxury.com, ask us for a quote, buy a product or apply to work with us: why we collect it, on what legal basis, who we entrust it to, how long we keep it and how you can exercise your rights. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR»), Italian Legislative Decree 196/2003 (the «Italian Privacy Code») and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on 10 June 2021, and its Guidelines on the use of tracking pixels in email communications of 17 April 2026.

Who processes your data

The data controller is Beauty Luxury S.r.l., Via Flaminia 300, 47924 Rimini (RN), Italy. VAT number IT04239810403.

For any privacy question, or to exercise your rights, write to info@beauty-luxury.com with «Privacy» in the subject line. You can also write to us by post at our registered office.

In short

• Without your consent we only use the technical cookies the site needs to work and the tools that protect it from bots and fraud. No analytics, session recording, advertising or chat tool is activated until you choose.
• You can refuse right from the first screen of the banner, with the «Reject and close» button (the X): you keep browsing with technical cookies only, and we do not ask for your consent again on every page.
• You can change your choices at any time with the «Manage cookie preferences» button at the top of this page and the «Cookie preferences» link at the bottom of every page of the site.
• The data you give us for a quote is used to answer you. We use it to send you newsletters and offers only if you tick the dedicated box, which is never mandatory.
• We do not sell your data to anyone.

What data we process and why

Browsing and site security

When you visit the site, our servers and the Cloudflare delivery network, which protects the site and speeds it up, record technical data: IP address, date and time of the request, page requested, browser and device type, outcome of the request.

• Purpose: running the site, protecting it from attacks and abuse, detecting malfunctions.
• Legal basis: our legitimate interest in the security and proper functioning of the service (Art. 6(1)(f) GDPR).
• Retention: technical logs are kept only as long as strictly necessary for security, unless they are needed to investigate an offence.

Protection against bots and fraudulent clicks. We use ClickCease (CHEQ AI Technologies Ltd) to detect automated traffic and fraudulent clicks on our ads. The script only becomes active when you reach the site from a Google ad: in that case it analyses your IP address, browser and device characteristics and your behaviour during the visit, and blocks addresses identified as bots. It does not store cookies or any other data in your browser. If you arrive in any other way, your browser still downloads the script from ClickCease's servers, which therefore receive your IP address and the technical data of the request (browser, referring page), as happens with any resource downloaded from an external server. In that case the script does not send any data about your behaviour during the visit.

• Legal basis: our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) and Recital 47 GDPR). This data is not used to profile you or to show you advertising.
• Objection: you can object by writing to us (Art. 21 GDPR). We will assess your request against the need to protect the site.

Requests for information, quotes and call-backs

You can contact us through the quote form, the «Call me back» form, the forms on our promotional pages, the contact form, the chat, WhatsApp, phone or email. Depending on the channel, we collect your name, email, phone number, province and town and the text of your message, plus any data you choose to give us during the conversation (for example the model you are interested in or the space where you want to install it).

• Purpose: answering your request, preparing a quote, calling you back, arranging a showroom visit.
• Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• Provision of data: the mandatory fields of the form are needed to answer you. Without them we cannot follow up on your request. To send a form we ask you to confirm that you have read this policy. This is not consent: your data are used only to answer you.
• Retention: 24 months from the last contact if the request does not turn into an order. If it does, the retention periods in «Purchases, customer account, delivery and support» apply. If you have subscribed to the newsletter, your contact details are kept until you unsubscribe (see «Newsletter and promotional communications»).

Requests are recorded in our sales management system (CRM), accessed only by the authorised staff who handle sales and support.

Purchases, customer account, delivery and support

If you create an account or make a purchase, we process your personal and contact details, shipping and billing addresses, your tax code or VAT number when needed for the invoice, your order history and your support communications.

• Purpose: handling the order, payment, delivery, installation, warranty and after-sales support; managing your account.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR).
• Retention: for the whole duration of the relationship and the warranty. Invoices and accounting records are kept for 10 years, as required by Article 2220 of the Italian Civil Code. Account data is kept until you ask us to close the account. If the account remains unused for 36 months (no logins and no orders), we notify you by email and, if you do not reply, we close it. Only the data we are required by law to keep, such as invoices, is retained.

Payments. Card details never pass through or are stored on our systems: they are collected directly by Stripe and PayPal, which process them as independent controllers under their own privacy policies. We only receive the payment outcome and the data needed to reconcile it.

Delivery. The recipient's name, address and phone number are passed to the courier or carrier in charge of delivery and, where applicable, to the technicians who carry out installation and assembly.

Newsletter and promotional communications

If you tick the box «I agree to receive offers and news by email and to the individual measurement of opens and clicks», we will use your email and name to send you product news, promotions and event invitations.

• Legal basis: your consent (Art. 6(1)(a) GDPR, Arts. 122 and 130 of the Italian Privacy Code). It is optional: if you do not give it, your request is handled in exactly the same way.
• Measurement of opens and clicks: we measure opens and clicks on the emails we send you only if you have given your consent. In that case we can know whether you open an email and which links you click, to understand which content and products interest you.
• Customers: if you have already bought from us, we may email you offers for products similar to those you purchased even without specific consent (Art. 130(4) of the Italian Privacy Code).
• Withdrawal: you can withdraw your consent at any time, including for the measurement of opens and clicks only while still receiving our emails, through the link at the bottom of every newsletter or by writing to info@beauty-luxury.com. Withdrawal does not affect past processing.
• Retention: until you withdraw your consent or object. If you have had no contact with us for 24 months (orders, requests, replies to our emails), we ask you to confirm your subscription. Without confirmation, we remove you from the list.

Emails are sent through the MailUp (Italy) and Twilio SendGrid (Twilio Inc.) platforms, which act as our data processors.

Service emails

The messages we send you to handle your request, your order and its delivery contain no tools to measure whether you open them. When you view on our website a document we sent you, we keep a record of it to follow up on your case.

• Legal basis: performance of the contract or of pre-contractual measures, and our legitimate interest in following up on your case (Art. 6(1)(b) and 6(1)(f) GDPR). You can object by writing to us.

Job applications («Careers»)

If you apply, we process the data in the form and in your CV: name, surname, contact details, education, experience and skills.

• Purpose: assessing your application, contacting you and arranging interviews, including for other positions that match your profile.
• Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). An unsolicited CV does not require consent (Art. 111-bis of the Italian Privacy Code).
• Retention: 12 months from receipt, then deletion. If you are hired, the data becomes part of the management of the employment relationship.

Please do not include in your CV data that is not relevant, in particular health data, political or religious opinions and other «special categories» of data (Art. 9 GDPR), unless required by law.

Usage statistics (only with your consent)

If you consent to the Measurement category, we collect information on how you use the site, to understand which pages work and where visitors run into difficulties:

• Google Analytics 4 (Google Ireland Limited): pages visited, visit duration, traffic source, device type, events such as adding to cart or submitting a form.
• Internal statistics: we record the same browsing events on our own servers, linked to the pseudonymous identifier of your consent. Approximate country and town are derived from your IP address through the ip-api.com geolocation service.

• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).
• Retention: internal statistics for 24 months, then in aggregated and anonymous form only. For Google Analytics, see «How long we keep your data».

Session recording (only with your consent)

If you consent to the Session recording category, we record clicks, scrolling, pointer movements and choices in closed-choice fields, and we can reconstruct and visually replay your browsing session, like a screen recording, to identify usability problems and improve the site. The tool is our own: recordings are sent directly to our site, without going through any third-party service, and are viewed only by authorised Beauty Luxury staff.

• What we do not record: the content of text fields (name, email, phone number, messages), passwords, payment data and the use of accessibility preferences.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). It is a separate category: you can accept Measurement and refuse session recording.
• Retention: 90 days. Recording stops as soon as you withdraw your consent.

Advertising and campaign measurement (only with your consent)

If you consent to the Marketing category, we use tools that let us measure the results of our advertising campaigns and show you relevant ads on other websites and social networks:

• Google Ads (Google Ireland Limited): conversion tracking and remarketing. With the «enhanced conversions» feature, the email and phone number you enter in a form are turned into a value obtained through SHA-256 hashing before being sent to Google, which uses it only to attribute the conversion to the ad. Even in this form they remain personal data.
• Meta Pixel and Meta Conversions API (Meta Platforms Ireland Limited): they measure the actions taken on the site after an ad on Facebook or Instagram and build remarketing audiences. Some events are sent directly from our servers to Meta, together with your IP address, browser type and your email, phone number and location turned into values obtained through SHA-256 hashing, which still remain personal data.

• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).
• Joint controllership with Meta: for the collection through the Pixel and the transmission of data to Meta, Beauty Luxury and Meta Platforms Ireland are joint controllers (Art. 26 GDPR). Any further processing is carried out under Meta's responsibility, according to its privacy policy.
• You can also limit personalised advertising from your Google and Meta account settings, or through Your Online Choices.

Support chat (only with your consent)

The chat at the bottom of the site is provided by Tidio (Tidio LLC) and belongs to the Marketing category: it is activated only if you consent to that category. If you have not consented yet and open the chat, we first ask whether you want to accept marketing cookies, which also activate the advertising tools described above. If you refuse, the chat is not loaded. You can always contact us by phone, WhatsApp, email or through the forms on the site. When you write to us in the chat, Tidio processes on our behalf your messages, the name and email you give us, the page you are writing from and technical data about your device.

• Legal basis: consent to the Marketing category for loading the tool (Art. 122 of the Italian Privacy Code). For answering your questions: pre-contractual measures or performance of the contract (Art. 6(1)(b) GDPR).
• Retention: 24 months from the last conversation.

Reviews

The reviews shown on the site are those published by customers on our Google profile. We show them as they appear on Google: the author's public name, rating, text and date.

• Legal basis: our legitimate interest in showing customers' opinions (Art. 6(1)(f) GDPR). The reviews were made public by their authors.
• Controller: for publication on Google, the controller is Google itself, under its own privacy policy. If you delete or edit your review on Google, the change also reaches our site. You can also ask us to remove it from the site.

Location to find the nearest installation

In the «Where to try our products» section you can ask us to find the installations nearest to you, that is, products already installed that you can see in person. Your device's location is read only if you allow it in your browser, and used only to calculate distances. You can always type a town instead of sharing your location.

• Legal basis: your request and the consent you give through your browser (Art. 6(1)(a) and 6(1)(b) GDPR).

Defence of rights and legal obligations

We may process the data needed to establish, exercise or defend our rights in court and to respond to requests from authorities. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) or a legal obligation (Art. 6(1)(c) GDPR), and the data is kept for the applicable limitation periods.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Cookies and other tracking tools

Cookies are small files that the site stores in your browser. Similar technologies, such as localStorage, pixels and scripts, work in a similar way. Besides the essential ones, we group them into three optional categories (Measurement, Session recording and Marketing), which you also find in the preferences panel.

Essential: always active

They make the site work, protect it and remember your consent choices. They do not require consent (Art. 122(1) of the Italian Privacy Code).

Measurement: only with consent

Internal statistics (see «Usage statistics») use the consent identifier already described among the essential cookies and do not create additional cookies.

Session recording: only with consent

It activates the recording of clicks, scrolling and pointer movements described in «Session recording». It does not create cookies of its own: it uses the consent identifier already described among the essential cookies, and your choice is kept in the _bl_gdpr_recording cookie.

Marketing: only with consent

In addition to the advertising tools in the table, this category activates the Tidio support chat (see «Support chat»). The chat script stores in your browser, through localStorage, the visitor identifier and the state of the conversation, so you do not lose it when changing page. This data remains until you clear your browsing data.

Other third-party content

• Google Fonts: the site's typefaces are downloaded from Google's servers, which receive your IP address in order to deliver them. No cookies are set.
• YouTube videos: videos are embedded in «privacy-enhanced mode» (youtube-nocookie.com). YouTube does not store advertising information until you play the video.
• Maps: the maps in the «Where to try our products» section are served from our own servers and do not send data to third parties.

How to give, refuse or withdraw consent

• On your first visit we show you a banner. «Accept» activates all categories. The «Reject and close» button (the X, visible on the very first screen of the banner) refuses all optional categories and lets you continue with essential cookies only. «Learn more and customize» opens the panel where you choose category by category.
• We will not show you the banner again until 12 months have passed since your choice, unless the tools we use change significantly.
• You can change your mind at any time: . From that moment we stop activating the tools of the categories you refused, including sending from our servers: events to Meta (Conversions API) and to Google are sent only with Marketing consent. If you refuse all optional categories, we also delete the _ga, _gid, _fbp and _fbc cookies set on our domain. Cookies stored on third-party domains (for example Google's IDE or Meta's fr) and those the site cannot reach, such as _ga_*, cannot be deleted by us: you can remove them from your browser settings.
• You can also block or delete cookies from your browser settings (Chrome, Firefox, Safari, Edge). If you block essential cookies, however, the cart and account login will not work.

Every choice is recorded on our servers together with the date, the page where you made it, your browser, your partially anonymised IP address and the approximate country derived from it. We need this to prove that we respected your decision (Art. 7(1) GDPR).

For the newsletter, we record the date and the page where you ticked the box.

Who we share data with

Data is processed by authorised and trained Beauty Luxury staff (administration, sales, support, marketing) and by external suppliers acting as data processors (Art. 28 GDPR), bound by contract:

• hosting, infrastructure and site security: Cloudflare, CHEQ (ClickCease);
• email and newsletter delivery: MailUp, Twilio SendGrid;
• support chat: Tidio;
• statistics and advertising: Google, Meta. For some processing these suppliers act as independent or joint controllers, as explained in «Advertising and campaign measurement»;
• IP address geolocation: ip-api.com;
• tax and legal advisers, installers and technicians in charge of assembly and support.

The following act instead as independent controllers: payment providers (Stripe, PayPal), couriers and carriers, banks, authorities and any party to whom disclosure is required by law.

The up-to-date list of processors is available on request at info@beauty-luxury.com.

Transfers outside the European Union

Some suppliers (Google, Meta, Twilio SendGrid, Tidio, Cloudflare) are based in, or have servers in, the United States. In these cases the transfer relies on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023, for suppliers certified under it, or on the standard contractual clauses approved by the Commission (Art. 46 GDPR). CHEQ is based in Israel, a country recognised as adequate by the European Commission. You can ask us for a copy of the safeguards in place.

How long we keep your data

When these periods expire, the data is deleted or irreversibly anonymised.

Your rights

At any time, free of charge, you can ask us for:

• access: to know whether we process your data and receive a copy (Art. 15 GDPR);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure, in the cases provided for (Art. 17);
• restriction of processing (Art. 18);
• portability: to receive the data you gave us in a structured, machine-readable format, or have it transmitted to another controller (Art. 20);
• objection to processing based on our legitimate interest, on grounds relating to your particular situation, and in any case, without giving reasons, to direct marketing (Art. 21);
• withdrawal of consent at any time, without affecting processing carried out before the withdrawal (Art. 7(3)).

To exercise them, write to info@beauty-luxury.com. If you have an account, you can also send your request from the dedicated section of your customer area. We reply within one month, extendable by two further months only for particularly complex requests, in which case we will let you know. We may ask you to confirm your identity, so that we do not hand your data to the wrong person.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome) or with the authority of the country where you live or work, or take legal action.

Minors

The site is aimed at an adult audience and we do not knowingly collect data from children under 14. If you become aware that a minor has given us data, write to us and we will delete it.

Changes to this policy

We update this page when the processing or the tools we use change. The date at the bottom of the page shows the latest revision. If a change concerns processing based on consent, we will ask for your consent again through the banner.

Last updated: 22 October 2026