(each hereinafter referred to as the “Website”) and/or your interaction with the web services accessible via the Website (hereinafter “you” or “the data subject”) may involve the processing of personal data, i.e. data relating to identified or identifiable individuals (the “data”).

Below, we provide information regarding the processing of data relating to users who browse and interact with the web services accessible electronically via the Website.

2. DATA CONTROLLER – JOINT CONTROLLERS – DPO

The data controller is PASSIONE BEAUTY S.P.A., with its registered office, operational headquarters and administrative offices at Viale Crispi 89, 36100 Vicenza (Italy), VAT number and tax code IT10710530964 (hereinafter “PASSIONE BEAUTY” or the “Data Controller” or “we”).

The following companies within the PASSIONE BEAUTY Group are also joint data controllers, each acting jointly with PASSIONE BEAUTY S.P.A., for the purposes set out in points 1 (second paragraph) and 2 of the ‘PURPOSES’ section below, and limited to customers and suppliers in their respective countries of establishment:

PASSIONE (UK) LTD | Centurion House, London Road, Staines-upon-Thames, TW18 4AX, (United Kingdom), VAT GB396277054, Company No. 13720347, email:info_uk@passionebeauty.com, tel. +44 1952984229.

(hereinafter “Subsidiaries” or “other companies of the PASSIONE BEAUTY Group”)

NB: For processing activities carried out for the purposes set out in the first paragraph of point 1 and points 3 to 11 of the ‘PURPOSES’ section below, the Subsidiaries are data processors pursuant to Article 28 of the GDPR.

The Data Controller and each Subsidiary have appointed Mr Luca De Muri, a lawyer, as Data Protection Officer (DPO), domiciled at the Data Controller’s address and contactable on mobile number (0039) 349-4159526.

3. DATA

The data processed are: i) browsing data; ii) data provided voluntarily by users; iii) data collected from third parties, as follows.

Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain information whose transmission is implicit in the use of Internet communication protocols.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the Website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.

This information is not collected to be directly associated with identified data subjects, but by its very nature could, in theory, through processing and association with data held by third parties (in particular, the internet service providers we use), make it possible to identify users. PASSIONE BEAUTY does not, as a rule, have access to data held by third parties and therefore cannot carry out such identification.

Data provided voluntarily by the user

This refers to:

information sent voluntarily by users to the addresses indicated on the Website (e.g. email address, subject line of the email, name or company name, first name and surname, etc.);
personal data provided by users in order to use services available on the Website or to take part in initiatives promoted via the Website;
personal data provided by users who request news and/or information material (e.g. newsletters);
personal data provided by users who submit job applications to PASSIONE BEAUTY (‘CVs’, etc.); and

NB: ‘GUEST’ users may purchase products and services from PASSIONE BEAUTY even without prior registration, i.e. without opening an account.

Ordinary users may also register freely by completing the relevant form available online or via our PASSIONE BEAUTY app (hereinafter the “App”), which allows them to create their own account.

Furthermore, through this registration process, the user is automatically enrolled in the PASSIONE BEAUTY Loyalty Programme.

Users may, at any time, opt out of the PASSIONE BEAUTY Loyalty Programme whilst keeping their account open. Users may also delete their account at any time, reverting to “GUEST” status.

Data collected from third parties

We may collect identifying, contact, tax, creditworthiness and financial data, as well as data relating to the economic and financial situation of the data subject (whether a lead, prospect or customer) or to internal contacts of the customer or supplier (e.g. directors, special proxies, agents, employees) via , public registers, lists, deeds and documents, and/or public and/or private databases (Company Register, commercial information agencies).

We may also collect data on the user’s online behaviour from DEM service providers (see the PROFILING section).

4. PURPOSES OF THE PROCESSING

The processing of personal data is intended to:

manage access to the Website and the services it contains, in particular:

to process the user’s support and contact requests, e.g. relating to the sending of information material, clarifications and/or offers at the user’s request, and/or
provide the product or service requested by the user (including the data subject’s registration for seminars, webinars and other PASSIONE BEAUTY information events) and manage all administrative and operational activities necessary for the performance of the relevant contract,

to comply with the obligations laid down by law, regulations and/or EU legislation connected with or arising from the aforementioned contractual relationship,
to enable the technical functionality of the Website and to carry out the activities necessary or useful for the technical maintenance of the Website and for the continuous improvement of the service provided by the Website (for example, optimising the user experience by speeding up and simplifying page navigation, improving the readability of texts, and ensuring the operational continuity of the services provided via the Website),
to establish liability in the event of criminal offences or other unlawful acts committed against the Website and/or third parties via the Website (attempts to introduce malware, spamming, unauthorised access to computer systems, etc.),
to defend the Data Controller’s rights in the event of criminal offences against the Website and/or unlawful acts committed via the Website,
(limited to browsing data) to obtain statistical information in aggregated and anonymous form on users’ use of the Website,
soft-spam: that is, sending commercial and promotional communications and direct offers for the sale of products and/or services, as well as conducting market research, via communication channels, including automated ones (post, email, telephone, text messages, instant messaging – such as WhatsApp –, push notifications), social media messages, in-app messages), provided this is limited to products or services similar to those for which you have previously made a purchase or had commercial contact with us,

that is, when the data subject is already one of our customers or a prospect (the latter being defined as someone who has previously had commercial contact with us, which did not result in a purchase of our products, e.g. a request for commercial information, a request for a quotation, a request for information about a product, the voluntary handing over of a business card, or the receipt of a quotation from us that did not result in a sale),

basic analysis/classification (see below, under the PROFILING section): this consists of processing data relating to the data subject, including by aggregating it with data relating to other data subjects collected by PASSIONE BEAUTY, for the sole purpose of supporting general organisational and commercial processes.

This activity is carried out using a limited set of information, selected in such a way as not to have a particularly intrusive impact on the data subject’s privacy. In particular, the processing is aimed exclusively at dividing customers or users into broad, homogeneous and non-individualised categories, useful for general statistical, organisational or commercial analyses.

This includes operations that do not aim to reconstruct the data subject’s individual profile in detail and that are not capable of determining specific or personalised assessments concerning, for example, tastes, preferences, consumption habits, purchase history, spending power or other behavioural aspects of the individual.

It follows that this form of analysis does not produce substantial individual effects nor does it lead to commercial decisions or initiatives based on a personalised assessment of the data subject, but is limited to providing general guidance for PASSIONE BEAUTY’s commercial, marketing or organisational choices.

By way of example, the basic data analysed may consist of: first name and surname, company name, email address, landline/mobile number, own website, status as lead/prospect/customer/guest user/registered user/member of our Loyalty Programme, consumer/professional, contact language, gender, geographical area of origin (country, region, province), product or economic category to which belongs, corporate role, general professional areas and/or product categories of general interest declared);

Given these characteristics, this activity must be distinguished from more intrusive or complex forms of profiling, which involve the processing of data aimed at evaluating or predicting personal aspects relating to a specific data subject, and therefore does not constitute a form of ‘advanced profiling’, as further explained in the dedicated section below,

customer loyalty, that is, the planning and implementation of the Loyalty Programme, in accordance with the relevant terms and conditions; in particular:

(a) recording the data of users who voluntarily choose to register and thereby join the Programme; (b) creating a personal account linked to the Programme; (c) managing the obligations towards the user arising from the Programme;

(d) managing the member’s participation levels within the Programme; (e) service communications – sent via email, text message, WhatsApp messages or push notifications within the App – to grant the member the benefits associated with the Programme

(and, by way of example, depending on the Programme levels: personalised gifts, exclusive discounts and similar benefits, special purchasing terms, participation in prize draws and promotions, vouchers and/or promotional codes to be used via the website and/or the App, earning and redeeming points, registration on the website/App, access to exclusive sales, pre-sales and pre-sales events, product and service previews, invitations to exclusive and private events, priority delivery on orders, participation in free courses, posting personal reviews and FAQs on the PASSIONE BEAUTY website, social media channels and App, dedicated WhatsApp support, and use of other dedicated ancillary services),

f) changes to the terms and conditions or the rules governing the accrual of benefits associated with the Programme,

g) compliance with obligations laid down by laws, regulations or other EU legislation, or by instructions issued by public authorities, for the prevention of fraud and misuse of the Loyalty Programme

h) the management of any disputes and the protection of the Data Controller’s rights.

The aforementioned service communications form part of the Programme and will be sent solely for the purpose of making the aforementioned benefits available; they do not, therefore, constitute direct marketing communications. Such communications will, in fact, be sent only to those who have given separate consent via the dedicated forms (see section 7 below).

Furthermore, subject exclusively to the data subject’s separate and specific consent, the data collected is also processed for the purposes of:

direct marketing (other than the ‘soft-spam’ referred to in point 7 above), that is, the sending of commercial and promotional communications and direct offers for the sale of products and/or services, as well as the conduct of market research, via communication channels, including automated ones (post, email, telephone, text messages, instant messaging (such as WhatsApp), social media/push notifications), where this relates to products or services not similar to those for which you have previously made a purchase or had a specific commercial contact, or is directed at individuals who are not already customers;

direct marketing also includes the monitoring of outcomes and interactions relating to the communications sent, such as, by way of example, the delivery or non-delivery of the message, the opening of the email, the clicking of links, the reading or downloading of any attachments, unsubscribing, any classification as a bounce, and the user’s response to the communication.

advanced profiling, consisting of the analysis – including predictive analysis – of data relating to natural persons, including sole traders and representatives of partnerships (whereas the analysis of data relating to entities other than natural persons, and in particular that concerning legal entities such as public limited companies (Spa) and limited liability companies (Srl), is irrelevant for data protection purposes);

this analysis will be carried out using automated or partially automated tools, followed by human intervention, with the aim of creating clusters relating to leads, prospects and customers, as well as creating promotions for individuals falling within a specific cluster;

Profiling helps us to better understand our current and potential customers, to analyse the effectiveness of our marketing strategies in order to develop and update products and services, and to guide our commercial processes through content and offering methods that are in line with the characteristics, tastes, interests and/or preferences of our specific current and potential target audiences (thereby reducing the risk of investing resources in products and services that do not meet the expectations and needs of the data subjects, or of using channels they find less appealing, whilst improving their shopping experience;

to this end, advanced profiling analyses and links together additional and more personal aspects than those covered by basic analysis or classification, aggregating and analysing data on a named basis from multiple collection channels, for example:

first name and surname, company name, email address, landline/mobile number, and company website

language, gender, country and/or geographical area of origin, profession, product category or economic sector,

age, geographical area,

purchase history (dates, frequency, items and amounts of purchases of our products and services over the last 36 months),

the user’s responses to our promotional emails, as well as to service emails relating to our Loyalty Programme; reviews and FAQs published by the data subject as part of their participation in the Programme;

online behaviour inferred from the analysis of cookies or other technical tracking tools (e.g. pixels, tags and similar) regarding the data subject’s browsing on the PASSIONE BEAUTY website or app and their interaction with the services available there, including the e-commerce service (e.g. product categories viewed, forms filled in, completion or abandonment of the e-commerce shopping basket, and shopping basket preferences from the last 12 months),

data collected via other communication channels (e.g. from social networks with which you interact, whether or not you access them via the Website or the App: IP address, date and time of last access, browser type, device type, source communication channel, social media pages viewed, interactions with posts published by the administrator or other social media users; similar data obtained from the App, including the user’s responses to SMS messages and/or in-app instant messaging).

We also indirectly use profiling data held independently by third-party remarketing service providers to advertise services and products on social media by having these providers send communications directly to potential customers who have a profile similar to that of the data subject (lookalikes) and who may therefore be most interested in what is on offer. PASSIONE BEAUTY has no knowledge of such data.

5. NEWSLETTERS, EVENTS AND WEBINARS

Should you subscribe to our newsletter, your data will be processed for the purpose of sending the newsletter itself and, exclusively subject to your specific, separate and freely given consent, for the purposes of direct marketing (e.g. to send you promotional communications and sales offers, including those other than the newsletter, via email, instant messaging, push notifications, text messages or telephone), profiling and/or customer loyalty (see the sections ‘PURPOSES’ and ‘LEGAL BASIS FOR PROCESSING’ for further details).

Should you register for one of our webinars or events, the personal data you provide will be processed to manage your participation and the related legal obligations, and, exclusively subject to your specific, separate and freely given consent, for direct marketing purposes (e.g. to send you promotional communications and sales offers, including those other than the newsletter), profiling and/or customer loyalty purposes (see the sections on ‘PURPOSES’ and ‘LEGAL BASIS FOR PROCESSING’).

6. LEGAL BASIS FOR PROCESSING

The legal basis for processing is, respectively:

in relation to the purposes set out in point 1), the need to perform a contract to which you or a person associated with you is a party, or to carry out pre-contractual measures taken at your request,
in relation to the purposes set out in point 2), the need to comply with a legal obligation laid down by law, regulations and/or EU legislation to which we are subject),
in relation to the purposes set out in point 3), our legitimate interest in ensuring the proper and continuous functioning of the Website, and in improving its usability for the user,
in relation to the purposes set out in points 4–5), by our legitimate interest in protecting our rights against criminal offences and/or unlawful acts committed against or via the Website, or, as the case may be, the need to comply with any requests from public authorities,
in relation to the purposes set out in point 6), our legitimate interest in analysing, from both a quantitative and qualitative perspective, user traffic on the Website,
in relation to the purpose set out in point 7) (soft-spam): our legitimate interest in maintaining an ongoing commercial relationship with the data subject who is already a customer, keeping them informed about new activities, products, services, events/webinars and loyalty programmes; for these purposes, therefore, the data subject’s consent is not required,
in relation to the purpose set out in point 8) (basic profiling): our legitimate interest in maintaining, over time, a basic profile of the data subject that enables us to partially reduce the wastage of our promotional messages and offers by focusing them on targets, channels and content that are likely to be more appealing and therefore more effective; for these purposes, therefore, the data subject’s consent is not required,
in relation to the purpose set out in point 9) (direct marketing other than soft-spam): based on the prior, separate and specific consent of the data subject, which may be freely withdrawn, with the effect of rendering such processing impossible,
in relation to the purpose set out in point 10) (advanced profiling): on the basis of the data subject’s prior, separate and specific consent, which may be freely withheld, in which case such processing will no longer be possible,
in relation to the purpose set out in point 11) (customer loyalty): the need to carry out pre-contractual measures (i.e. to assess the data subject’s application to join our Loyalty Programme) and to perform the contract concluded between PASSIONE BEAUTY and the data subject as a result of their enrolment in the Loyalty Programme, as well as the need to comply with the legal obligations to which PASSIONE BEAUTY is subject in relation thereto.

For clarification, it should be noted that, therefore, joining the Loyalty Programme does not constitute ‘consent’ for the purposes of the GDPR, as consent is required exclusively in relation to the purposes set out in points 9 and 10 above.

7. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION. CONSEQUENCES OF A REFUSAL TO PROVIDE DATA

The provision of your personal data, whether ordinary or special categories, is optional; that is to say, you are free to refuse to provide it. Any initial refusal to provide the requested data may result in the following consequences:

For priority data (i.e. data to be processed for the performance of a contract or to fulfil obligations under national laws or EU regulations): inability to establish the contractual relationship; after recruitment: inability to continue managing the contractual relationship or to fulfil the related legal or regulatory obligations; this type of data is identified in our online forms by means of specific labels/tags;
For data relating to a specific request you have made to us: it will be impossible to assess and handle the subject of the request (e.g. if you refuse to provide a description of the content of a requested service, it will be impossible to provide that service; etc.).
For non-priority data (e.g. processed for direct marketing purposes other than soft-spam, or for advanced profiling), during or after recruitment: the Data Controller will be unable to use the data for the purposes specified in each case.
Enrolment in the Loyalty Programme involves the collection of personal details (first name, surname, date of birth), an email address and a mobile phone number; these details are necessary for the activation or renewal of membership and for any transactions relating to the Programme. In the event of names being the same, you will also be asked to provide your town/address so that we can identify the correct member. This information is therefore mandatory if you wish to join the Programme of your own free will.

Failure to provide data marked as ‘mandatory’ on our registration form to the Loyalty Programme or a subsequent request to unsubscribe from it will not entail any consequences, other than the inability of PASSIONE BEAUTY to process the data to guarantee you the benefits associated with it; the data subject may still choose to use our services outside the Programme (in particular, the purchase of products and services) even without joining the Loyalty Programme.

Members of the Programme may receive push notifications via their device, browser or the App they are using. The sending of such notifications depends on the permissions enabled by the user on their device or within the App. Members may at any time disable the receipt of notifications by adjusting the settings on their device (e.g. an Android or iOS smartphone), the browser used for browsing, or the App in use.

Consent to the processing of data for direct marketing and/or advanced profiling purposes may be freely withheld by the data subject; in which case we will not process the data for the specific purpose to which the separate request for consent relates, whilst you may freely continue to use our products and services and, without prejudice to the generality of the foregoing, in the event of enrolment in the Loyalty Programme, the specific benefits associated with it, as well as the right to exercise all rights provided for by law (see Chapter 14).

Consent may be withdrawn at any time by notifying the Data Controller, without any specific formalities; however, in the event of objection to the continued sending of promotional emails (direct marketing), it is preferable to: i) click on the relevant link provided in the emails received, ii) contact PASSIONE BEAUTY’s customer service, or iii) send an email to privacy@passionebeauty.com .

NB: Should a member choose to withdraw their consent to direct marketing, they will still continue to receive communications relating to the Loyalty Programme. To delete the account linked to the Programme and to stop receiving related communications, members must contact PASSIONE BEAUTY’s customer service via the ‘Contact Us’ section of the website or the App. A request to stop receiving service emails as part of the Loyalty Programme will result in early withdrawal from the Programme; however, it does not entail the cancellation of promotional emails (i.e. commercial newsletters, not service emails), which will therefore continue to be sent. To request that these be stopped, follow the procedure set out in paragraph 8 of this section.

In the event of withdrawal of consent, the lawfulness of the processing carried out prior to receipt of the notice of withdrawal of consent shall remain unaffected.

8. LOGIC AND ORGANISATIONAL METHODS OF DATA PROCESSING

The logic and organisational arrangements for data processing will be strictly related to the individual purposes set out above. Data processing will take place electronically, via telecommunications and/or on paper.

During processing, the data are subject to protective measures designed to safeguard them against the risk of unauthorised access, alteration, loss or destruction (including accidental loss), or unauthorised or non-compliant processing.

The data is processed by staff from the main functional departments of PASSIONE BEAUTY S.P.A., who have been authorised in writing in advance and duly instructed within the limits of their respective duties: administration, human resources, IT maintenance, sales and marketing, logistics and warehousing, etc. Authorised personnel are bound by a duty of confidentiality regarding the data processed.

The processing may include the following operations: collection (by telephone, electronic means, in writing or verbally), recording, organisation, storage and processing on paper, magnetic, automated or electronic media; processing of data collected from third parties; modification, selection, extraction, comparison, use and interconnection, including with data from other entities, based on qualitative, quantitative and temporal criteria, whether recurring or defined on a case-by-case basis; temporary processing aimed at rapid aggregation or transformation of the data; discretionary (never fully automated) decision-making; profiling and reporting, disclosure, erasure and destruction of the Data, or combinations of two or more of the aforementioned operations.

9. DISCLOSURE

In accordance with current regulations and for the purposes set out above, the data is disclosed, as appropriate, to:

commercial information agencies,
other companies within the PASSIONE BEAUTY group (which process the data exclusively as data processors, on behalf of and in accordance with the instructions of PASSIONE BEAUTY SPA),
credit institutions,
insurance companies,
solicitors and law firms,
chartered accountants, accounting experts, auditors and audit firms, statutory auditors,
the supervisory body pursuant to Legislative Decree 231/2001,
DPOs – Data Protection Officers,
freight forwarders, carriers and couriers,
training service providers,
hosting service providers,
providers of maintenance services for IT systems and/or electronic archives linked to the Website (e.g. CRM),
public authorities and administrations to which data must be disclosed in compliance with legal obligations or those arising from regulations or other EU legislation,

and, in the case of direct marketing, profiling and/or customer loyalty purposes, to:

advertising agencies,
digital marketing and marketing analytics service providers,
consultants and professionals,
communications and/or public relations firms,
providers of design and printing services for advertising or promotional materials,
website providers,
providers of CRM and direct email marketing services,
suppliers of products and services offered through our Loyalty Programme or related to it,
third-party commercial partners with whom PASSIONE BEAUTY undertakes any co-marketing initiatives,
influencers,
agents.

These third-party recipients will process the data either as independent data controllers (determining the purposes and means of processing independently), or as data processors in accordance with Article 28 of the GDPR, i.e. on our behalf and in accordance with our written instructions designed to ensure compliance with data protection legislation, and under our regular supervision. A list naming the data processors appointed by PASSIONE BEAUTY is available on request.

The data will not be disclosed, with the exception of any posts, reviews or FAQs that you voluntarily publish on the blog hosted on the Website or on the social media pages and/or in the App of the companies belonging to the PASSIONE BEAUTY Group.

10. SOCIAL MEDIA FUNCTIONALITIES AND JOINT CONTROLLERSHIP

The Data Controller manages the following social media channels:

Channel name	Page	Social media channel privacy policy
LinkedIn	https://www.linkedin.com/company/pucosmetica-passionebeauty	On this page and also on this one, you can view LinkedIn's Privacy Policy.
YouTube	https://www.youtube.com/user/passionebeauty https://www.youtube.com/passioneunghie	On this page, you can view Google's Privacy Policy, of which YouTube forms part.
Facebook	https://www.facebook.com/PassioneBeauty.it	On this page, you can view Facebook's Data Policy.
Instagram	https://www.instagram.com/passionebeautyofficial	On this page, you can view Facebook's Data Policy, of which Instagram forms part.
Pinterest	https://it.pinterest.com/passionebeautyofficial/ https://in.pinterest.com/passionebeautyofficial/	On this page, you can view Pinterest's Privacy Policy.
TikTok	https://www.tiktok.com/@passionebeautyofficial?lang=en	On this page, you can view TikTok's Privacy Policy, specifically the section "Our global operations and data transfers".

The Website may use social media features, such as the Facebook ‘Like’ button, the Instagram ‘Like’ button and other sharing widgets (‘Social Media Features’), which may allow you to:

publish information about the user’s activities on the Website on external platforms and social networks, or
‘like’ content shared on such platforms by the Data Controller, or
highlight information that we have published on the Website or on the Data Controller’s official social media pages.

Social Network Features may be hosted by each individual social media platform or directly on the Website. In the former case, if you click on the Social Network Features embedded on the Website, the platform may receive information indicating that you have visited the Website.

If you are logged into your social media account, it is also possible that the social network may link your visit to the Website to your social media profile.

With regard solely to the collection on the Website of personal data relating to users, whether registered or not, and the automatic transmission of such data to social media platforms, PASSIONE BEAUTY SPA acts as a joint controller pursuant to Article 26 of the GDPR.

With regard to the Instagram pages https://www.instagram.com/passionebeauty/ and https://www.instagram.com/passionebeauty, the Data Controller is also a joint data controller of statistical data together with Meta Ireland Limited (“Facebook Ireland”).

For its own social media pages (e.g. https://www.facebook.com/passionebeauty), Facebook offers Page Insights, a feature that provides aggregated data to help understand how people interact with Facebook Pages.

With regard to the Facebook page, PASSIONE BEAUTY SPA is a joint data controller for statistical data, together with Meta Ireland Limited.

At this link, you can view the appendix on the data controller for Facebook Page Insights, which sets out the division of responsibilities between Facebook Ireland and the Data Controller in its capacity as administrator of the pages https://www.facebook.com/alpacofficial, https://www.facebook.com/Alpacfranceofficial and https://it.facebook.com/HeltyOfficial/.

You can view META’s Privacy Policy via this link.

The Website also allows you to log in using social authentication services (e.g. Facebook Connect, Google Sign-In). These services verify the user’s identity and provide the option to share certain personal data from these services with us (such as: your name and email address to pre-fill our login form, the date and time of access, the browser used to access the site and the device from which access took place – PC, tablet, smartphone, etc.).

PASSIONE BEAUTY SPA may also share certain personal data of the data subject (first name, surname, email address) with social media platforms (e.g. Facebook, Google), which use this data to identify and target the user and/or other people similar to the user who may be interested in our products and services, through commercial communications and sales offers. Further information on these remarketing or lookalike marketing policies can be found in our Cookie Policy.

The user’s interactions with Social Network Features are governed both by this privacy notice (limited to processing carried out under joint controllership as described above) and by the privacy notice published on each individual social media platform (for any aspect of personal data processing not covered by the aforementioned joint controllership arrangement).

For the TikTok, YouTube and Pinterest platforms (and others other than Facebook/Instagram), there is currently no formal joint-controller agreement between the Company and the aforementioned platforms, as they independently determine the purposes and means of processing the personal data collected through their own tools. In particular:

PASSIONE BEUTY acts as an independent data controller for data collected and processed through its own activities on the profile (e.g. content management, comment moderation, direct interaction with users).
Social media platforms (e.g. TikTok Technology Limited, Google LLC for YouTube, Pinterest Europe Ltd.) act as independent data controllers for processing carried out directly via their own systems (e.g. usage analysis, profiling, targeted advertising, account management).

11. DATA TRANSFERS OUTSIDE THE EEA

Our IT systems transfer data on a regular basis to cloud providers with headquarters or data centres outside the EEA (which includes the European Union, Liechtenstein and Norway) (so-called ‘recipients’ of personal data).

A list of these recipients, including links to their respective privacy policies, is provided below.

MICROSOFT CORPORATION, with its registered office at 1 Microsoft Way, Redmond, WA 98052, USA, provider of the social networking service LINKEDIN, as well as the services ONEDRIVE, Office 365 and Teams. For further information on data processing, please see Microsoft’s privacy policy at: https://privacy.microsoft.com/it-it/privacystatement.
GOOGLE LLC, with its registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043 – USA, as the provider of the following cloud services: Google Forms, Google Sheets, Gmail, ‘Meet’ video conferencing services, ‘Google Drive’ document editing and storage, social authentication services, and as a sub-processor for Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4 (Ireland), used by PASSIONE BEAUTY for electronic payment services related to the Website.

For further information on data processing, see:

Google’s Privacy Policy: https://policies.google.com/privacy/frameworks?hl=it.
Google’s privacy policies relating to the CMS platform used for the Website: https://policies.google.com/technologies/managing?hl=it.
Google’s Privacy Policy relating to the Google Payments service at the following link: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=it
ADOBE Inc, with its registered office at 345 Park Avenue, San Jose CA 95510-2704 – California – USA, provider of the ADOBE COMMERCE e-commerce services used by the Website. For further information on data processing, please see Adobe Inc.’s Privacy Policy: https://adobe.com/privacy/policy/.
- HUBSPOT INC., with registered offices at Two Canal Park, Cambridge, and 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, and in other countries where HUBSPOT operates through its subsidiaries (including the Irish subsidiary based at Hubspot House, 1 Sir John Rogerson’s Quay, Dublin 2, D02 CR67, Ireland) and its external data processors, in connection with the cloud services (CRM, DEM – Direct Email Marketing service, newsletter management service, PASSIONE BEAUTY blog management service, etc.) used by the Data Controller;

for further information on this transfer, please see HubSpot’s Privacy Policy: https://www.zendesk.it/company/agreements-and-terms/privacynotice/#georedirect, and HubSpot’s Data Processing Agreement: https://legal.hubspot.com/dpa.

META PLATFORMS, INC. (“Meta”), with its registered office in Menlo Park – San Francisco Bay, California – USA, which provides the social networking services Facebook, Instagram and YouTube, the instant messaging service WhatsApp, and the Facebook social authentication service. For further information on data processing, please see the META Privacy Policy: https://about.facebook.com/actions/protecting-privacy-and-security/
- TIKTOK INFORMATION TECHNOLOGIES UK LIMITED, with its registered office at Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom (“TikTok UK”), is a joint controller together with TIKTOK TECHNOLOGY LIMITED, with its registered office at 10 Earlsfort Terrace, Dublin, D02 T380 (Ireland) (“TikTok Ireland”) of the TIKTOK social media service. Please see TIKTOK’s Privacy Policy, and in particular the section entitled “Our global operations and data transfers” at the following link: https://www.tiktok.com/legal/page/eea/privacy-policy/it.
PINTEREST INC., with its registered office at Corporation Trust Center, 1209 Orange Street, Wilmington, Delaware, USA, provider of the social network service known as PINTEREST. For further information on data processing, please see PINTEREST’s Privacy Policy: https://policy.pinterest.com/it.
VISA INC., with its registered office at Visa Global Privacy Office, 900 Metro Center Blvd, Foster City, CA, 94404, USA. Personal data may be transferred to other countries, which may not have similar laws regarding privacy or data protection. For further information on data processing, please see VISA’s Privacy Policy: https://www.visaitalia.com/termini-di-utilizzo/informativa-sulla-privacy-globale-di-visa.html.
MASTERCARD EUROPE SA – Italian branch, with registered office at Piazza del Popolo, 18 – 00187 Rome (Italy), authorised by the Italian Data Protection Authority pursuant to Article 44(1)(a) of the GDPR to transfer, within the Mastercard Group, personal data to third parties forming part of the Mastercard Group with registered offices outside the EEA, , including the company MASTERCARD INCORPORATED with its registered office at 2000 Purchase Street, NY 10577, USA, in accordance with the procedures set out in the MASTERCARD Binding Corporate Rules (BCR) FOR CONTROLLERS and solely for the purposes stated therein. For further information on data processing, please see MASTERCARD’s Privacy Policy: https://www.mastercard.it/it-it/vision/essere-azienda-responsabile/privacy.html.
PAYPAL (EUROPE) S.A.R.L. ET CIE, S.C.A. – with its registered office at 22-24 Boulevard Royal, L-2449, Luxembourg (EU). PayPal’s operations are supported by a network of computers, cloud-based servers and other information technology infrastructure, including, amongst others, third-party service providers who may be located in countries outside the EEA. For transfers of users’ personal data within PayPal’s affiliated companies, PayPal relies on Binding Corporate Rules (BCRs), which have been approved by the relevant supervisory authorities. Other transfers may be based on standard contractual clauses . For further information on data processing, please see the PayPal Privacy Policy: https://www.paypal.com/it/webapps/mpp/ua/privacy-full.
APPLE PAYMENTS INC., with its registered office at One Apple Park Way, Cupertino, CA 95014, USA, for the management of Apple Pay electronic payment services. Personal data may be transferred to or accessed by entities worldwide, including Apple affiliates, for the purposes of processing. The Apple entity that controls your personal data may vary depending on your location. If you do not reside in the USA, your personal data may be processed by Apple Inc. and other Apple affiliates on behalf of the Apple entity that controls your personal data for the jurisdiction to which you belong. For further information on processing, please see Apple’s Privacy Policy at https://www.apple.com/legal/privacy/.
STRIPE TECHNOLOGY COMPANY, LIMITED (STC, GDPR headquarters) and STRIPE PAYMENTS EUROPE, LIMITED (SPEL), both with registered offices at One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, for the management of STRIPE electronic payment services. Stripe is a payment platform that enables websites and apps to accept credit/debit cards, digital wallets (such as Google Pay and Apple Pay) and other local payment methods. It handles payment processing, security, fraud prevention and reconciliation, providing dashboards, APIs and reporting tools for online merchants.

Stripe’s Privacy Policy can be found at https://stripe.com/privacy and describes the collection, use and sharing of personal data, specifying the roles of data controller and data processor and GDPR rights. Stripe’s Cookie Policy is available at https://stripe.com/legal/cookie-policy, which details the use of cookies for functionality, fraud prevention, analytics and advertising, with opt-out options.

GOOGLE PAYMENT LIMITED (GPL, a UK company regulated by the FCA, a subsidiary of GOOGLE INTERNATIONAL LLC), with its registered office at 5 New Street Square, London, EC4A 3TW, for the management of Google Pay services. Google Pay is a digital wallet from Google that allows users to pay online, in apps and in-store using cards saved to their Google account or to the wallet on Android devices. Users do not enter their card details on the merchant’s website: instead, they use Google authentication and a payment token, which improves the speed and security of the transaction.

For Google Pay, privacy is governed by the Google Payments Privacy Policy (https://wallet.google.com/files/privacy.html) and the settings at https://support.google.com/googlepay/answer/10223752, which explain the collection of personal and financial data for security and payment purposes, with no sale of transaction data. Google’s Cookie Policy (https://policies.google.com/technologies/cookies) also applies, including cookies for user preferences such as SOCS. The SOCS cookie stands for ‘SafeSearch On Cookie Status’ or similar, and is a Google-specific cookie classified as a preference cookie. It is used to store the user’s choices regarding the use of cookies and security settings, such as the SafeSearch filter for safe content. Google uses SOCS to remember the preferences expressed by the user, for example regarding the acceptance or rejection of certain cookies, thereby avoiding the need to display banners or prompts on every visit. It has a lifespan of 13 months from creation or last update

MARQETA INC., with its registered office at 180 Grand Avenue, 6th Floor, Oakland, California, 94612, USA (a sub-processor for the companies SCALAPAY IP S.p.A. (Italy), SCALAPAY SRL (Italy), SCALEWAY S.A.S. (with its registered office at 8 rue de la Ville l’Évêque, 75008 Paris, France), and HIPAY GROUP (with its registered office at 94 Rue de Villiers, 92300 Levallois-Perret, France), used by PASSIONE BEAUTY (on the Italian website only) to manage virtual card issuance and electronic payment services. For further information on data processing, please refer to the Privacy Policies of:
SCALAPAY: https://www.scalapay.com/privacy?country=IT
SCALEWAY S.A.S.: https://images-www.scaleway.com/wp-content/uploads/2020/09/16075241/EN-Privacy-Policy-2020.pdf and https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf
HIPAY GROUP: https://hipay.com/en/privacy-and-terms/
MARQETA: https://www.marqeta.com/services-privacy.
- AWS – AMAZON WEB SERVICES INC., with its registered office at 410 Terry Avenue North, Seattle, WA 98109-5210, USA, to which data is transferred in connection with the use of microservices (e.g. CDN, ROUTE53, S3, WAF, server hosting) provided by Amazon Web Services EMEA SARL, with its registered office at Avenue John F. Kennedy, 38, 1855, Luxembourg, as well as in connection with the hosting sub-services used by TRUSTED SHOPS SE, with its registered office at Colonius Carrè, Subbelrather Atrasse 15c, 50823 Cologne (Germany), as a provider of e-commerce website certification services, verified reviews and money-back guarantees to users of the e-commerce service on behalf of PASSIONE BEAUTY.

For further information on data processing, please see the AWS Privacy Policy: https://aws.amazon.com/it/privacy/.

- CLOUDFLARE INC., with its registered office at 101 Townsend Street, San Francisco, CA 94107, USA, a service provider for improving the security and performance of the Website. For further information on data processing, please see Cloudflare’s Privacy Policy: https://www.cloudflare.com/it-it/privacypolicy/ and https://www.cloudflare.com/it-it/trust-hub/privacy-and-data-protection/.
- INTUITION MACHINES, INC., with its registered office at 350 Alabama St, 10, San Francisco, CA 94110, USA, provider of the hCAPTCHA service, which ensures the protection of the Website by distinguishing human users from bots and protecting sites, forms and login areas from spam, malicious traffic and automated abuse. For further information on data processing, please see the hCAPTCHA Privacy Policy: https://www.hcaptcha.com/privacy
- SPROUT SOCIAL, INC., with its registered office at 131 S Dearborn St Ste 700, Chicago, USA, provider of the social media management service. For further information on data processing, please see MAKE’s Privacy Policy: https://sporoutsocial.com/it/privacy-policy/ .
- YOTPO, INC., with its registered office at 80 Madison Ave, New York, NY 10016, United States, and YOTPO LTD, with its registered office at Icon Tower, Menachem Begin 13, Ramat Gan, Israel. YOTPO is a global technology platform specialising in marketing and e-commerce solutions. It helps brands build lasting relationships with customers through review collection tools, loyalty programmes and email or SMS marketing.

The main features offered by YOTPO include:

Reviews and content (UGC): enables the collection of authentic customer reviews, photos and videos to boost buyer confidence.
Loyalty and rewards: provides the tools needed to create personalised reward programmes, encouraging users to make repeat purchases.

For further information on data processing, please refer to YOTPO’s Privacy Policy: https://www.yotpo.com/privacy-policy/

- TEXTYESS INC, with its registered office at 651 N Broad St Suite 201 Middletown, DE 19709, United States. TEXTYESS is an AI-powered conversational commerce platform that enables online shops to sell products and provide customer support via WhatsApp. For further information on data processing, please refer to TEXTYESS’s Privacy Policy: https://www.iubenda.com/privacy-policy/95132497.

The appropriate safeguards relating to data transfers outside the EU consist of:

in the case of a transfer to the USA: in accordance with Article 46 of the GDPR, the EU Commission’s Adequacy Decision of 13 July 2023 concerning the US legal framework for the protection of personal data, as amended by the bilateral agreement between the EU and the USA, the ‘Trans-Atlantic Data Protection Framework (TADPF)’; and
in the case of transfers to non-EEA countries other than the USA: as appropriate, by:
Adequacy Decisions issued by the EU Commission in accordance with Article 45 of the GDPR, or
Written agreements whereby the data importer established outside the EEA, in relation to the processing operations falling within its remit, undertakes to PASSIONE BEAUTY to comply with personal data protection obligations that are substantially equivalent to those imposed on PASSIONE BEAUTY by EU legislation; such agreements shall, as a minimum, incorporate the standard texts approved by the EU Commission (the so-called “ r Standard Contractual Clauses” or “SCCs”) in accordance with Article 46 of the GDPR, subject to any additions that are no less favourable to the data subject.

12. DURATION OF PROCESSING

Personal data is processed and retained for the following respective periods:

during the pre-contractual phase: 24 months from the date of collection;
in relation to the contract entered into with you or with third parties connected to you: for the entire duration of the contract;
for loyalty programme purposes: for the entire duration of the Loyalty Programme (subject to possible enrolment in a new loyalty initiative upon the Programme’s expiry); in the event of early withdrawal from the Programme, the data will be retained for administrative purposes only for a maximum of 3 months, subject to any specific legal obligations regarding the retention of accounting and contractual documentation.
following the termination of the aforementioned contractual relationship: no longer than the time required to fulfil the aforementioned obligations, tasks and/or purposes and to demonstrate compliance with them to the supervisory authorities, i.e. for 11 years (i.e. 1 year after the expiry date of our legal retention obligations, which is normally 10 years).
Data processed for IT security purposes (e.g. log records): 1 year from the time of collection (unless a dispute arises, in which case see the following point).
In the event of any out-of-court or legal dispute arising with you and/or third parties: for the time necessary to safeguard the Data Controller’s rights and, in particular, until the expiry of the tenth year following the last enforceable act resulting from a final and binding decision between the parties or any other act of equivalent effect.
In the case of soft-spam: until the data subject objects.
In the event of basic profiling: until the data subject objects.
In the case of advanced profiling: 36 months from the date of collection, after which we will ask you to expressly renew your consent; in the event of early withdrawal of your consent: until the day following receipt of your withdrawal (internal systems will be updated monthly, for organisational and technical reasons).
In the case of direct marketing: until the data subject withdraws their consent, which may be exercised at any time.

Subsequently, once the above time limits have elapsed, the data will be permanently deleted or rendered permanently anonymous (thereby eliminating any possibility of linking the data to the data subject in question).

13. RIGHTS OF THE DATA SUBJECT

With regard to personal data, you may exercise the following rights:

to request confirmation from our Company as to whether or not personal data concerning you is being processed and, if so, to obtain access to the personal data and to the following information (NB: all of which is contained in this document):
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations;
- where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
- the existence of the data subject’s right to request from our Company the rectification or erasure of personal data, or the restriction of the processing of personal data concerning them, or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the data are not collected from the data subject but from third parties: information on their origin (source);
- the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
where personal data are transferred to a third country outside the EEA, the data subject has the right to be informed of the existence of appropriate safeguards relating to the transfer;
to request, and obtain without undue delay, the rectification of inaccurate data; taking into account the purposes of the processing, the completion of incomplete personal data, including by providing a supplementary statement;
to request the erasure of data if:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
- the data subject objects to the processing, unless there are compelling legitimate grounds for the processing, or objects to processing carried out for direct marketing purposes (including profiling for such direct marketing);
- the personal data has been processed unlawfully;
- the personal data must be erased to comply with a legal obligation under Union law or the law of the Member State to which our Company is subject;
- the personal data has been collected in connection with the provision of information society services from our Company’s database;
to request the restriction of processing concerning the data subject, where one of the following circumstances applies:
- the data subject disputes the accuracy of the personal data; in this case, the restriction of processing (i.e. the suspension thereof) may apply for the period necessary for our company to verify the accuracy of such personal data;
- the processing is unlawful (for example, because the Data Subject was not provided with the prior information required by law) and the Data Subject objects to the erasure of the personal data (i.e. they prefer that we retain them in our paper and/or electronic records) and instead requests that their use be restricted as described above;
- although our Company no longer requires the personal data for the purposes of processing, the data is necessary for the data subject to establish, exercise or defend a legal claim;
- the Data Subject has objected to the processing carried out for direct marketing purposes, pending verification as to whether our Company’s legitimate grounds override those invoked by the Data Subject;
to obtain, upon request, from the Data Controller a list of the third-party recipients to whom the personal data have been disclosed;
to withdraw, at any time, consent to the processing of their personal data where such consent was previously given for one or more specific purposes, it being understood that this shall not affect the lawfulness of the processing based on the consent given prior to the withdrawal;
to receive, in a structured, commonly used and machine-readable format, the personal data concerning the data subject that they have provided to our Company and, where technically feasible, to have such data transmitted directly to another data controller without hindrance from us, provided that the following (cumulative) condition is met:
- the processing is based on the data subject’s consent for one or more specific purposes, or on a contract to which the data subject is a party and for the performance of which the processing is necessary;
- the processing is carried out by automated means (software) (the so-called ‘right to data portability’).

The exercise of the aforementioned right to data portability is without prejudice to the right to erasure set out above.

not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or which similarly significantly affects them.
to lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR (Data Protection Authority) or to bring proceedings before the appropriate courts pursuant to Article 79 of the GDPR.

14. AMENDMENTS

This Privacy Policy, from the date of its publication, supersedes any previous version thereof. Unless otherwise specified, the previous Privacy Policy will continue to apply to cookies collected up to that point.

We reserve the right to make changes to this Privacy Policy at any time by notifying users on this page or via email, text message or push notification. Please check this page regularly, referring to the date of the last update shown at the bottom.

Should you not accept any future changes, you must cease using the Website or the features to which the change relates; failure to do so will be deemed to constitute acceptance of the changes (except for those that alter the conditions for obtaining consent, where required, to the processing of your personal data).