Shipments will be suspended from August 3 through August 23 (inclusive) due to the summer break. Orders placed during this period will be shipped starting August 24.

Privacy policy

PRIVACY POLICY DATA COLLECTED AND PROCESSED

Disclosure pursuant to and in accordance with Art. 13-14, EU Reg 2016/679

(European Data Protection Regulation)

 

Dear Sir/Madam and Dear Company

We would like to inform you that EU Reg. 2016/679 ("European Data Protection Regulation") provides for the protection of persons and other subjects and respect for the processing of personal data.

Pursuant to Articles 13 and 14, therefore, we provide you with the following information:

 

  1. Purpose, legal basis of the processing for which the data are intended

The processing of the personal data you provide is solely for the purpose of performing contractual obligations and fulfilling your specific requests, as well as fulfilling regulatory obligations.

For the purposes of the indicated processing, the data controller will not learn of data defined as "sensitive" in accordance with EU Regulation 2016/679, such as those disclosing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership in parties, trade unions, associations or organizations of a religious, philosophical, political or trade union nature, health status and sex life.


  1. Source from which personal data came

Personal data come from:

  1. Registration form for promotional and marketing and possibly commercial purposes;
  2. Tax data required for invoice issuance.

 

  1. Method of treatment

In connection with the stated purposes, your data are subject to computer and paper processing. Processing operations are implemented in such a way as to ensure the logical, physical security and confidentiality of your personal data.

Data processing is carried out by the following subjects and in the following manner:

  1. (a) By the data controller and/or data processors;
  2. (b) By means of the operations or set of operations indicated such as: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and distribution of data;
  3. (c) With the use of procedures, including computerized procedures, in the manner and to the extent necessary to pursue the aforementioned purposes.

 

  1. Legitimate interests pursued by the data controller or third parties

The company Beauty San SPA processes personal data for the purpose of carrying out its activities.

This Information Notice is prepared, in accordance with EU Regulation 2016/679, to define and describe the security policies adopted by the company regarding the processing of personal data and the organizational criteria followed for their implementation and to provide appropriate information about them also to third parties.

The information provided below is assessed as useful support in providing information suitable for evaluating the security policy pursued by the company.

 

  1. Nature of personal data

They constitute the object of processing your personal data, name, surname, email, telephone, necessary for identification, inherent to the performance of the service you requested.

During service delivery, it may be necessary to acquire and process your personal data for administrative purposes.

The data processed will be of a purely ordinary nature; it is aimed at maintaining the business relationship. You are asked to express the relevant consent in writing.

 

  1. Scope of data communication and dissemination

Your data may be communicated to:

  • All persons to whom the right of access to such data is recognized by virtue of regulatory measures;
  • To our collaborators, employees, within the scope of their respective duties;
  • to all those natural and/or legal, public and/or private persons when the communication is necessary or functional for the performance of our activity and in the manner and for the purposes outlined above.

 

  1. Transfer of personal data to a third country

The processing of your personal data does not involve the transfer of data to countries outside the EU or to international organizations.

 

  1. Data Profiling and Dissemination

Your personal data are not subject to dissemination or any fully automated decision-making process, including profiling.

 

  1. Mode and duration of storage of personal data

Documents pertaining to the activity in question are kept at the Company for as long as necessary to fulfill legal obligations.

 

  1. Identification details of the owner, manager, and privacy officer

The data controller (DPI) is Gualtiero Valdo, with registered office in Florence (FI) Viale G. Milton 27, operating offices in Prato (PO) Via Rimini 37, and in Milan (MI) Via Ponte Vetero 22, telephone 0574/43891, email info@beautysanspa.com PEC beautysan@pec.leonet.it.        

The company's employees in the performance of their duties are also appointed as data processors.

A Data Privacy Officer (DPO) was duly appointed, which is found in the figure of Dr. Antonio Fuccillo(fuccillo_antonio@libero.it).

 

  1. Rights of the data subject

11.1 Art. 15 (right of access), 16 (right of rectification) of EU Reg. 2016/679

The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to the personal data and the following information:

  1. (a) the purposes of processing;
  2. (b) the categories of personal data in question;
  3. (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly if recipients in third countries or international organizations;
  4. (d) the intended retention period of personal data or, if this is not possible, the criteria used to determine this period;
  5. (e) the existence of the data subject's right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing;
  6. (f) the right to file a complaint with a supervisory authority;
  7. (h) the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic used, as well as the significance and expected consequences of such processing for the data subject.

 

11.2 Right under Article 17 of EU Reg. 2016/679 - right to erasure ("right to be forgotten")

 The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him or her without undue delay, and the data controller shall be obliged to erase the personal data without undue delay if one of the following grounds exists:

  1. (a) personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  2. (b) the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) and if there is no other legal basis for the processing;
  3. (c) the data subject objects to processing under Article 21(1) and there is no overriding legitimate reason for processing, or objects to processing under Article 21(2);
  4. (d) personal data have been processed unlawfully;
  5. (e) personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the data controller is subject;
  6. (f) the personal data has been collected in relation to the provision of information society services referred to in Article 8(1) of EU Reg. 2016/679


11.3 Right under art. 18 Right to limitation of processing

The data subject has the right to obtain from the data controller the restriction of processing when one of the following cases occurs:

  1. (a) the data subject disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
  2. (b) the processing is unlawful and the data subject objects to the deletion of personal data and instead requests that their use be restricted;
  3. (c) although the data controller no longer needs them for the purposes of processing, the personal data are necessary for the data subject to establish, exercise or defend a right in court;
  4. (d) the data subject has objected to the processing pursuant to Article 21(1), EU Reg 2016/679 pending verification as to whether the data controller's legitimate grounds prevail over those of the data subject.

 

11.4 Right under Article 20 Right to data portability

 The data subject has the right to receive in a structured, commonly used and machine-readable format personal data concerning him or her that has been provided to a data controller and has the right to transmit such data to another data controller without hindrance from the data controller.

 

  1. Withdrawal of consent to treatment

Le è riconosciuta la facoltà di revocare il consenso al trattamento dei Suoi dati personali, inviando una raccomandata A/R al seguente indirizzo: Via Rimini, 37 – 59100 Prato (PO) ovvero via PEC all’indirizzo beautysan@pec.leonet.it corredato da fotocopia del suo documento di identità, con il seguente testo: <<revoca del consenso al trattamento di tutti i miei dati personali>>. Al termine di questa operazione i Suoi dati personali saranno rimossi dagli archivi entro 60 giorni, fatto salvo per i dati la cui conservazione è obbligatoria ai sensi della normativa vigente in materia civile, fiscale e amministrativa.

If you wish to have more information about the processing of your personal data, or to exercise your rights under 10 above, you may send a registered letter with return receipt to the following address: Via Rimini, 37 - 59100 Prato (PO) via PEC to beautysan@pec.leonet.it. Before we can provide you, or change any information, we may need to verify your identity and answer some questions. A response will be provided within 10 days.