PRIVACY POLICY
PRIVACY POLICY NABLACOSMETICS.COM
Who is the Data Controller?
NABLA Cosmetics S.r.l. - Via Tortona, 33 - 20144 Milan (Italy) (hereinafter, the “Data Controller”). How can I contact the Data Controller? The company’s contact details are:
Email: info@nablacosmetics.com
Address: Via Tortona, 33 - 20144 Milan (Italy)
1. Introduction
Under the European General Data Protection Regulation (GDPR), legal entities are not considered data subjects and therefore the European Regulation does not apply to them. However, where personal data relating to a natural person are provided in the context of collecting company data, that natural person shall be considered a data subject under the aforementioned Regulation and the relevant legislation shall therefore apply.
2. What processing activities are carried out through the website?
And what are the legal bases, purposes and retention periods?
2.1 REGISTRATION
PURPOSE
The purpose of the processing is to enable registration on the website so that purchases can be made more easily and shipments and returns can be monitored.
LEGAL BASIS
Consent of the Data Subject. In the event of a dispute, the data will be processed for the purpose of bringing and/or defending legal claims on the basis of the Data Controller’s legitimate interest.
RETENTION PERIOD
The data will be processed until consent is withdrawn. If the account remains inactive for 3 years, we will send you an email to ask whether you are still interested in keeping it active; otherwise, the account will be deleted. The data may be processed for a longer period in the event of a dispute.
OTHER INFORMATION
Registration is not mandatory in order to make purchases, as purchases may also be completed as a “guest”.
REGISTRATION VIA SOCIAL MEDIA
Where registration is carried out through a social media account, the data will not be provided directly by the Data Subject but will be imported pursuant to Art. 14 GDPR. The data processed are: personal identification data and email address.
*Pursuant to Art. 4(7) GDPR, the Data Controller is the party that determines the purposes and means of the processing of personal data, and its responsibilities are set out in Art. 24 GDPR.
2.2 E-COMMERCE ACCESS / MEMBERSHIP PROGRAMME
PURPOSE
Creation and management of the user account, including the possibility of accessing reserved discounts. The purpose is also to allow beauty professionals to access the Membership Programme in order to obtain benefits and discounts, and to establish, exercise or defend a legal claim in the event of a dispute.
LEGAL BASIS
Performance of a contract. In the event of a dispute, the data will be processed for the purpose of bringing and/or defending legal claims on the basis of the Data Controller’s legitimate interest.
RETENTION PERIOD
The data will be processed for 12 months from registration. Thereafter, unless the conditions for keeping the account active continue to apply (for a further 12 months), the account will be deactivated. The data may be processed for a longer period in the event of a dispute.
OTHER INFORMATION
Registration is mandatory in order to make purchases under the preferential terms provided for this category of users.
2.3 PURCHASE
PURPOSE
The main purpose of the processing is to enable you to purchase and receive the requested product. In addition, the data are necessary for compliance with legal obligations (including accounting and tax obligations). The data may also be required in the event of disputes concerning the proper performance of the contract.
LEGAL BASIS
Performance of a contract and consequent compliance with the legal obligations incumbent upon the Data Controller. In the event of a dispute, the data will be processed for the purpose of bringing or defending legal claims, which corresponds to the Data Controller’s legitimate interest.
RETENTION PERIOD
The data will be deleted 10 years after performance of the contract. They may be retained for a longer period only in the event of disputes, for the purpose of establishing, exercising or defending a legal claim on the basis of the Data Controller’s legitimate interest.
OTHER INFORMATION
Provision of the data is mandatory and, if you refuse to provide them, it will not be possible to purchase the requested products.
2.4 PURCHASE USING EXPRESS CHECKOUT
PURPOSE
The main purpose of the processing is to enable the User to purchase and receive the purchased product. The data are also necessary for compliance with legal obligations (including accounting and tax obligations).
Lastly, they may be required in the event of disputes concerning the proper performance of the contract.
LEGAL BASIS
Performance of a contract and consequent compliance with the legal obligations incumbent upon the Data Controller.
In the event of a dispute, the data will be processed for the purpose of bringing or defending legal claims, which corresponds to the Data Controller’s legitimate interest.
RETENTION PERIOD
The data will be deleted 10 years after performance of the contract.
They may be retained for a longer period only in the event of disputes, for the purpose of establishing, exercising or defending a legal claim on the basis of the Data Controller’s legitimate interest.
SOURCE AND CATEGORIES OF DATA PROCESSED
Where a purchase is made using express checkout, personal identification, shipping, billing and contact data will be imported from PayPal, Shop Pay and Google Pay (Art. 14 GDPR).
2.5 NEWSLETTERS / DIRECT EMAIL MARKETING (DEM) BY AUTOMATED OR TRADITIONAL MEANS
PURPOSE
The purpose of the processing is to send you newsletters and direct email marketing (DEM) communications.
Email communications may include technologies that make it possible to determine whether the message has been opened and whether the User has interacted with its content, in order to improve its effectiveness and relevance. In addition, subject to specific consent, such commercial communications may also be sent via WhatsApp.
LEGAL BASIS
Consent given by the Data Subject.
RETENTION PERIOD
1 year from the last communication sent.
OTHER INFORMATION
Consent, including consent limited to the tracking pixel or to the channel used to receive such communications, may be withdrawn at any time. The User is entirely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide data identified as essential, the Data Controller will not be able to fulfil the stated purpose.
2.6 TRANSACTIONAL EMAILS
PURPOSE
The purpose of the processing is to send you information relating to the purchase made.
LEGAL BASIS
Performance of the contract and compliance with legal obligations.
RETENTION PERIOD
Until delivery of the order, or for a longer period in the event of a dispute.
OTHER INFORMATION
Consent, including consent limited to the tracking pixel or to the channel used to receive such communications, may be withdrawn at any time. The User is entirely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide data identified as essential, the Data Controller will not be able to fulfil the stated purpose.
2.7 MARKETING VIA WHATSAPP
PURPOSE
The purpose of the processing is to send you commercial communications via
WhatsApp.
LEGAL BASIS
Consent given by the Data Subject.
RETENTION PERIOD
1 year from the last communication sent.
OTHER INFORMATION
Consent may be withdrawn by the Data Subject at any time.
2.8 MARKETING AND PROFILING THROUGH DIGITAL PLATFORMS
PURPOSE
The purpose of the processing is to show you marketing content based on your interests, as identified through your interactions with our website or social media. This includes the use of retargeting tools offered by digital platforms to deliver targeted advertising messages.
LEGAL BASIS
Consent, which may be obtained through various methods:
1 Through Cookies on Our Website: Your consent to marketing and profiling cookies is collected through the cookie settings on our website.
2 For CRM Custom Audience Campaigns (Prospecting and Retargeting): for these campaigns, we obtain your explicit consent to use your contact details (e.g. email address) for marketing purposes.
Interaction with Social Media Pages: If you have consented to the use of profiling cookies on our Website, we may process your contact details and the information communicated during your interactions with Social Media Pages. We use this information, in accordance with your social media privacy settings, to show you personalised marketing advertisements.
RETENTION PERIOD
The data will be retained until consent is withdrawn through the cookie settings.
OTHER INFORMATION
1 Consent obtained through Cookies on Our Website: The User may manage or withdraw this consent at any time, as described in our Cookie Policy. Please also note that cookies may be either first-party or third-party cookies and may therefore be installed, through our website, directly by Meta.
2 Consent obtained for CRM Custom Audience Campaigns (Prospecting and Retargeting): This consent allows us to process your data to identify similar audiences (lookalikes) and to show targeted advertisements on social media and other digital platforms.
Where the User is subject only to segmentation, consent is not required.
2.9 ABANDONED CART
PURPOSE
The purpose of the processing is to send 1 email inviting the User to complete a purchase that was interrupted on the website.
LEGAL BASIS
The Data Controller’s legitimate interest in the completion of the purchase.
RETENTION PERIOD
72 hours
OTHER INFORMATION
Provision of the data is automatic and results from the partial completion of the shopping cart.
2.10 CONTACT US (ANY FORM OF CONTACT)
PURPOSE
The purpose of the processing is to enable the submission of requests for information and to respond to them, and to establish, exercise or defend a legal claim in the event of a dispute.
LEGAL BASIS
Performance of pre-contractual measures taken at the request of the Data Subject. In the event of a dispute, the data will be processed for the purpose of bringing or defending legal claims, which corresponds to the Data Controller’s legitimate interest.
RETENTION PERIOD
We will process the data for the time necessary to respond to requests and will subsequently delete them. They may be retained for a longer period only in the event of potential disputes, for the purpose of establishing, exercising or defending a legal claim on the basis of the Data Controller’s legitimate interest. Data obsolescence is reviewed every 12 months.
OTHER INFORMATION
The User is entirely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide data identified as essential, the Data Controller will not be able to fulfil the stated purpose.
2.11 BROWSING DATA
PURPOSE
Website security
LEGAL BASIS
We will process the data on the basis of the company’s legitimate interest in IT security and compliance with legal obligations. The legal basis for processing cookies other than strictly necessary cookies is consent.
RETENTION PERIOD
24 months
OTHER INFORMATION
For information on cookies, please refer to the relevant policy.
2.12 REVIEWS
PURPOSE
The purpose is to share one’s experience and promote the company.
LEGAL BASIS
Consent given by the Data Subject to the publication of the review on the website.
RETENTION PERIOD
Reviews will be published on the website until they become obsolete and/or until consent is withdrawn.
OTHER INFORMATION
Consent may be withdrawn at any time. The User is entirely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide data identified as essential, the Data Controller will not be able to fulfil the stated purpose.
3. What else do I need to know?
The data will be processed lawfully, fairly and with the utmost confidentiality, in compliance with the appropriate security measures required by the applicable Code and the Regulation. Processing will be carried out by digital means. The data will not be publicly disclosed. Furthermore, the User will not be subject to automated decision-making, such as profiling, unless the User consents to such processing through the installation of cookies or other tracking tools, which are governed by the relevant policy.
4. Who will my data be disclosed to?
The Data Controller may disclose the data to all parties to whom disclosure is required by law for the fulfilment of purposes prescribed by law. The Data Controller also uses certain companies or IT tools that process Data Subjects’ personal data exclusively in the Data Controller’s interest; all such parties are duly appointed as data processors pursuant to Art. 28 GDPR. The data will also be disclosed to payment gateways acting as independent data controllers. The list of data processors is available at the Data Controller’s registered office.
5. Where are the data stored and transferred?
Personal data will be managed and stored on servers located in European and non-EU countries. The Data Controller ensures that transfers outside the EU are carried out in accordance with Arts. 44-47, Chapter V of the GDPR, through the execution of Standard Contractual Clauses or on the basis of adequacy decisions.
6. What are my rights and how can I exercise them?
a) Rights of the Data Subject
As a Data Subject, the User has the rights set out in Art. 15 et seq. of the Regulation, namely:
1. RIGHT OF ACCESS (Art. 15 GDPR)
The Data Subject has the right to obtain confirmation as to whether or not personal data concerning them exist, even if not yet recorded, and to have such data communicated in an intelligible form.
2. RIGHT TO RECTIFICATION (Art. 16 GDPR)
The Data Subject has the right to obtain the rectification of inaccurate personal data concerning them and the completion of incomplete data.
3. RIGHT TO ERASURE (Art. 17 GDPR)
The Data Subject has the right to obtain the erasure of personal data where specific grounds apply, such as withdrawal of consent, objection to processing, where the data are no longer necessary for the purposes for which they were collected and processed, or in the event of unlawful processing. Erasure will not always be possible; however, the Data Controller will be responsible for providing adequate reasons where a request cannot be granted.
4. RIGHT TO RESTRICTION OF PROCESSING (Art. 18 GDPR)
The Data Subject has the right to obtain restriction of processing in specific circumstances, for example where rectification or objection has been requested, for the period necessary to assess the request.
5. RIGHT TO DATA PORTABILITY (Art. 20 GDPR)
Where processing is based on consent or on a contract and is carried out by automated means, the Data Subject may receive the data in a structured, commonly used and machine-readable format or request that they be transmitted to another data controller.
6. RIGHT TO OBJECT (Art. 21 GDPR)
The Data Subject has the right to object, in whole or in part:
a) on legitimate grounds, to the processing of personal data concerning them, even where such data are relevant to the purpose for which they were collected;
b) to the processing of personal data concerning them for purposes not covered by Art. 2.
The User may submit an objection to the processing of their personal data pursuant to Art. 21 GDPR, stating the reasons justifying the objection. The Data Controller reserves the right to assess the request, which will not be accepted where compelling legitimate grounds for the processing exist that override the User’s interests, rights and freedoms.
7. RIGHT TO LODGE A COMPLAINT
The Data Subject has the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 GDPR if they believe that the processing of their data is contrary to the applicable legislation.reclamo
b) How to exercise your rights:
The Data Subject may exercise the rights referred to in the preceding section at any time by contacting the Data Controller at the addresses indicated above.
Last updated: 18/08/2026
This privacy notice was drafted by Polimeni.Legal
