Privacy Policy: In-Store Collection of Customer Data

PRIVACY NOTICE FOR THE COLLECTION OF CUSTOMER DATA AT PHYSICAL STORES

Valid for our stores in the European Union and the United States

Data Controller

Beauty San S.p.A. – Viale Giovanni Milton 27, 50129 Florence (Italy)

Email for privacy inquiries: info@costumenationalscents.com

This privacy notice describes how we collect, use, store, and share your personal data when you fill out a customer registration form at our physical stores. Depending on the country where the store is located, different laws may apply. We have therefore divided this privacy notice into two sections: the EU Section (GDPR) and the U.S. Section (with specific reference to the CCPA/CPRA and the laws of other states).

EU SECTION – INFORMATION PURSUANT TO REGULATION (EU) 2016/679 (GDPR)

1. What Personal Data Do We Collect?

When you fill out the customer registration form in the store, we collect the following categories of personal data:

• Identification and contact information: first name, last name, date of birth, phone number, email address, country of residence.
• Any transaction data (if a purchase is associated with the card): product purchased, date, amount (sales receipt).

We do not collect special categories of personal data (pursuant to Article 9 of the GDPR), such as data related to health, religious beliefs, or sexual orientation.

2. Purpose of the processing, legal bases, and nature of the provision of personal data

2.1 Mandatory Purposes (without which we cannot provide you with the service)

Purpose	Legal Basis	Consequences of Refusal
Manage in-store purchases (recording sales, issuing receipts, handling returns and complaints)	Performance of the Contract (Art. 6, para. 1, subpar. b)	Unable to complete the purchase
To comply with tax, accounting, and other legal obligations (e.g., anti-money laundering, document retention)	Legal requirement (Art. 6, para. 1, subpar. c)	Unable to manage the business relationship
To handle requests for assistance, or to assert or defend a right in court	Legitimate interest (Art. 6, para. 1, subpar. f) – interest in protecting our rights	You can object, but we may not be able to accommodate your request

2.2 Purposes Based on Your Consent (Optional, Checked Separately)

You are free to choose whether to give your consent for one or both of the following purposes. Failure to give your consent does not prevent you from purchasing our products. You may revoke your consent at any time.

Direct Marketing

We will send you promotional communications, newsletters, special offers, updates on Costume National Scents fragrances, and invitations to events via email, text message, phone calls with a representative, and regular mail.

Legal basis: consent (Art. 6, para. 1, subpara. a).

Profiling

We will analyze your past purchases, your stated preferences (e.g., fragrances you’ve enjoyed, requests for information), and your interaction with our promotional communications (e.g., whether you open emails or click on links) to create a customer profile. This profile allows us to send you personalized offers and suggest products we believe may interest you, helping you avoid generic communications.

Legal basis: consent (Art. 6, para. 1, subpara. a).

How does profiling actually work?

We do not use automated decision-making processes that produce legal effects for you (e.g., raising prices or denying you a service based on your profile). Profiling is used exclusively to select the promotional content to show you. For example: if you have purchased woody-scented fragrances multiple times, you will receive offers for similar products, while you will not receive communications about floral fragrances. You may opt out at any time.

Use of the Date of Birth

Your date of birth will be used exclusively for marketing and profiling purposes (e.g., to send you a birthday offer or gift) or to compile anonymous aggregate statistics. If you do not consent to marketing and profiling, your date of birth will not be used for promotional purposes and will be deleted or anonymized within 30 days of collection.

3. Recipients of Personal Data

Your personal data may be disclosed to:

Data Processors (entities that process data on our behalf and in accordance with our instructions):

• Email and SMS marketing platforms (e.g., Klaviyo, Mailchimp, Brevo, Twilio)
• CRM service providers (e.g., Salesforce, HubSpot)
• Cloud Storage and IT Services Company
• Shipping and logistics companies (for returns processing)
• Tax Advisors, Attorneys, and Certified Public Accountants
• Providers of analytics and statistics services (in aggregate form)

Independent individuals (self-employed individuals) when required by law:

• Tax authorities, customs authorities, law enforcement agencies, judicial authorities
• Payment institutions for managing refunds

We do not sell your personal data to third parties for their own marketing purposes. We do not engage in “data brokerage.”

4. Transfer of Data Outside the European Economic Area (EEA)

Some of our suppliers (such as email marketing platforms and cloud-based CRMs) may have servers located in the United States or in other countries not considered by the EU Commission to have an adequate level of protection. In such cases, the transfer of your data complies with the GDPR through the use of Standard Contractual Clauses (SCCs) approved by the EU Commission, supplemented by additional measures where necessary (e.g., end-to-end encryption).

Any exceptions for contracts (Art. 49 of the GDPR) are not used as the primary basis.

You can request a copy of the safeguards in place by emailing info@costumenationalscents.com.

5. Data Retention Period

Purpose	Shelf Life
Contractual and Tax Compliance (purchase information, receipt)	10 years from the last purchase (as required by Italian tax law, Article 2220 of the Civil Code)
Direct marketing (with consent)	Until consent is revoked. Unless consent is revoked, we delete the data 24 months after the last active interaction (e.g., opening one of our emails, clicking a link, making a purchase, or requesting information).
Profiling (with consent)	Same marketing period (up to 24 months after the last interaction)
Contact Information Without Consent (Collected Solely for Contractual Purposes)	Deleted or anonymized within 30 days of the fulfillment of the contractual purposes (e.g., after the product has been delivered, provided there are no pending returns)

Once the retention periods have expired, the data is securely deleted or irreversibly anonymized.

6. Your Rights (Articles 15–22 of the GDPR)

You may exercise the following rights free of charge at any time by sending a written request to info@costumenationalscents.com. We will respond within 30 days (which may be extended by an additional 60 days in complex cases, subject to prior notice).

Law	Contents
Right of Access	To confirm whether we process your data and to receive a copy of it in a format that is easy to understand
Right of Rectification	Have your incorrect information corrected or your incomplete information filled in
Right to Erasure (Right to Be Forgotten)	Request the deletion of your data when it is no longer necessary for the purposes for which it was collected or when you withdraw your consent (and there are no other legal obligations to retain it)
Right to Restriction	Request that the data be retained but not actively used, for example, while awaiting verification of its accuracy
Right to Data Portability	To receive the data you have provided to us in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) and to transmit it to another data controller, if technically feasible
Right to Object	You may object at any time to processing based on legitimate interests (e.g., fraud prevention). In particular, you have the right to object to processing for direct marketing purposes (including related profiling) without having to provide a reason. Upon your objection, we will immediately cease all promotional communications.
Right to Withdraw Consent	You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
Right Not to Be Subject to Automated Decisions	We do not make decisions based solely on automated processing that have legal effects on you (e.g., automatic rejection of an order). The profiling we perform does not fall under this category.

How to File a Complaint

If you believe that the processing of your data violates the GDPR, you have the right to file a complaint with the supervisory authority in your country of residence or with the Italian supervisory authority: Garante per la protezione dei dati personali – Piazza Venezia 11, 00187 Rome – www.gpdp.it/.

U.S. SECTION – INFORMATION FOR RESIDENTS OF CALIFORNIA, VIRGINIA, COLORADO, CONNECTICUT, UTAH, AND OTHER STATES WITH PRIVACY LAWS

This section supplements the main privacy notice for customers who fill out a customer information form at our stores located in the United States. Specifically, the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and the Utah Consumer Privacy Act (UCPA) apply.

1. Categories of personal data we collect

Over the past 12 months, we have collected the following categories of personal data from consumers:

• Identifiers: first name, last name, date of birth, email address, phone number, country.
• Commercial information: purchased products, purchase history (if associated with the profile).
• Activity on the web or other platforms (limited to interactions with our promotional emails, if you have given your consent): opening emails, clicking on links.

We do not collect sensitive personal information as defined by the CCPA (e.g., Social Security number, login credentials, precise location data, race, religion, health, sexual orientation).

2. Purpose of Data Collection and Use

We use your personal data for the following purposes:

• To fulfill the purchase agreement (process the transaction, issue a receipt, handle returns and provide customer service).
• To comply with legal obligations (tax, anti-money laundering, and responding to requests from authorities).
• For direct marketing —only with your explicit consent (opt-in). We will send you promotional communications via email, text message, and phone.
• For cross-contextual profiling / behavioral advertising – only with your explicit consent (opt-in). We analyze your purchases and interactions to send you personalized messages.
• Sale and Sharing of Data Under the CCPA

We do not “sell” your personal data in the traditional sense of the term (i.e., we do not exchange it for money). However, sharing your data with marketing platforms (e.g., Klaviyo, Mailchimp) for the purpose of targeted advertising on unrelated websites or apps may be considered “sharing for cross-context behavioral advertising” under the CCPA. Such sharing occurs only if you have consented to marketing and/or profiling. Without your consent, we do not share your data for this purpose.

3. Your rights under U.S. law

If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, you have the following rights, which you may exercise only with respect to stores located in the United States:

Law	Description
Right to Know (To Be Informed)	To learn about the categories and specific personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we have shared it.
Right to Cancel	Request the deletion of your personal data, subject to exceptions (e.g., legal requirements for tax record retention).
Right to Correction (Rectification)	Correct inaccurate personal information (CCPA and most state laws; Utah provides only for access and deletion).
Right to Opt Out	Opt out of the “sale” or “sharing” of your data for cross-contextual advertising. Since we only share your data with your consent, you can revoke your consent at any time (by clicking “unsubscribe” in emails, replying “STOP” to text messages, or sending a request to info@costumenationalscents.com). This is equivalent to opting out. We do not use third-party cookies on the website for retail profiling, but for data collected in-store, opting out is done by revoking your consent.
Right to Restrict the Use of Sensitive Data	Not applicable because we do not collect sensitive data.
Right to Non-Discrimination	We will not treat you differently (e.g., charge you higher prices or provide lower-quality service) for exercising your rights.

Note to residents of Virginia, Colorado, and Connecticut: You also have the right to appeal our decision if we deny your request. We will provide specific instructions in our response.

4. How to Exercise Your Rights

Request access, deletion, or correction: Send a verifiable email to info@costumenationalscents.com with the subject line “CCPA Request – [State]”. We will need to verify your identity by asking you for reasonable information (e.g., confirming the email address or phone number associated with your customer profile).

Opt-out (withdrawal of consent for advertising sharing): You can withdraw your consent at any time by:

• The “Unsubscribe” link at the bottom of each of our promotional emails;
• By replying “STOP” to a promotional text message;
• By sending an email to info@costumenationalscents.comconwith the subject line “OPT-OUT.”
• Authorized Agent: You may designate another person to submit requests on your behalf by providing us with a written power of attorney or proof of registration with the appropriate authorities (if required).

Response Times

We will respond within 45 days of receiving a verifiable request. In justified cases, we may extend this period by an additional 45 days, provided we notify you within the first 45 days.

5. Data Retention (U.S.)

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, as described in the EU Section (item 5). Specifically:

• Contractual/tax information: 10 years from the date of the last purchase.
• Marketing/profiling data (with consent): until consent is withdrawn or, if consent is not withdrawn, 24 months from the last active interaction.

6. Contact Information for Privacy Inquiries (U.S.)

If you have any questions regarding this privacy policy or wish to exercise your rights under U.S. law, please contact us at:

info@costumenationalscents.com

We do not have a dedicated toll-free number, but you can leave a voicemail message at our Italian office (at your own expense) and we will call you back. For organizational reasons, we recommend contacting us via email.

INFORMATION APPLICABLE TO ALL JURISDICTIONS

Changes to the Privacy Policy

This privacy policy may be updated periodically to reflect regulatory or operational changes. The most recent version is always available on our website and in-store upon request. In the event of substantial changes that affect your rights, we will notify you through the channels you use (e.g., email) if you have given your consent to receive marketing communications.

General Privacy Contact

If you have any questions, need clarification, or have a request regarding the processing of your personal data, you can write to us at any time at:

Beauty San S.p.A. – info@costumenationalscents.com

Last updated: September 2026