Customer Privacy Policy

Customer Privacy Notice to be provided pursuant to Article 13 of EU Regulation 2016/679 (GDPR)

Identity and contact details of the Data Controller

The Data Controller is: Barò Beauty Lab S.r.l. Registered Office: Via G. Carducci No. 125 - 20099 Sesto San Giovanni (MI) Operating Office: Piazza Michele Ferrero, 8, 12050 Alba CN Tax identification and VAT number 14800490964

The Data Protection Officer (DPO), appointed by the Data Controller pursuant to Articles 37 et seq. of the GDPR, is Omniconsulting S.r.l.s., with registered office in Turin, Via Roma 366, tax identification and VAT number 11868170017, emaildpo@barocosmetics.it.

Category of personal data

By way of example, Barò Beauty Lab S.r.l. collects the following types of personal data:

1. 1) personal details, such as first and last name, place and date of birth, sex, residential address, and alternative contact details;
2. 2) contact details, such as the shipping address, telephone number (landline and/or mobile), and email address;
3. 3) tax data, such as the tax identification number (where an invoice is required)
4. 4) purchase-related data
5. 5) in the case of collection through an online Form, browsing data such as IP address, time of access to the website and/or registration, any registration referrer, methods of access to the server, and the numerical code indicating the status of the response provided by the server.

No sensitive data, or data belonging to the special categories referred to in Article 9 of the GDPR, or data relating to offenses or criminal convictions, is collected.

Personal data is collected directly from the data subject through:

• - completing the registration/order-entry Form on the online e-commerce websites;
• - or by postcard;
• - or through other active online and telephone contact channels.

Processing purposes, legal basis, and retention periods

The Processing of Personal Data is based on the principles of fairness, lawfulness, transparency, and protection of the Customer’s privacy and rights, and is carried out for the following purposes:

1. (1) To create an account on Barò Beauty Lab’s online e-commerce websites S.r.l.
2. (2) To enter and process orders for products and services;
3. (3) To comply with administrative, accounting, civil, tax, regulatory, and European Union legal obligations;
4. (4) To provide customer support (via chat, telephone, or email) for any needs related to purchasing our products or using our services;
5. (5) For marketing purposes, in order to send commercial communications using traditional means (ordinary mail and telephone with an operator) or automated means (email, telephone without an operator, SMS, social media, WhatsApp) relating to the Controller’s activities or those of the Controller’s partners;
6. (6) To conduct market research and statistical analyses: marketing, and the analysis and creation of profiles and preferences;
7. (7) To disclose data to third parties as specified in the following section “Scope of Data Disclosure”
8. (8) To promote similar services or products by email to data subjects who have already used them, by sending informational and/or promotional communications so that our customers remain updated about our news and initiatives.
9. (9) To enable data subjects to select an offer of purchase discount vouchers of interest to them by sending their email address and IP address, in pseudonymized and encrypted form, to companies specializing in the management of Voucher Networks, including Sovendus GmbH, Hermann-Veit-Str. 6, 76135 Karlsruhe.

For the purposes set out in points (1), (2), and (4), the relevant legal basis is the performance of pre-contractual or contractual obligations (GDPR, pursuant to Article 6(b)). The data retention period is determined on the basis of the time required to execute the order or fulfill the pre-contractual obligations, at every stage, from receipt of the order through its delivery and any subsequent assistance.

For the purpose set out in point (3), the relevant legal basis is compliance with legal obligations (GDPR, pursuant to Article 6(c)). The data retention period is determined on the basis of the individual national and EU provisions that impose legal obligations on the Controller.

For the purposes set out in points (5), (6), and (7), the legal basis is the data subject’s consent (GDPR, pursuant to Article 6(a)). The retention period will end when the customer withdraws consent and/or expresses their wish to object to processing, by communicating this in accordance with the procedures set out in the section “Data Subject Rights pursuant to Articles 15–22,” and in any event no later than 24 months after the last relevant contact or purchase.

For the purpose set out in point (8), the legal basis for processing is the legitimate interest (GDPR, pursuant to Article 6(f)) in keeping data subjects who have already used Barò’s products informed about offers relating to similar services, in compliance with Article 130(4) of the Privacy Code, without prejudice to the data subjects’ right to object to processing at any time.

For the purpose referred to in point (9), the legal basis for processing is legitimate interest (GDPR, formerly Article 6(f)). The pseudonymized hash value of the email address is used by the company specializing in managing Voucher Network to take into account any advertising restriction. The IP address is used exclusively for data security purposes and is generally anonymized after seven days.

Providing the data is mandatory for the processing that Barò Beauty Lab must carry out to fulfill its pre-contractual and contractual obligations toward the data subject, as well as legal, regulatory, and other statutory obligations. Failure to provide such data may result in the contract not being performed or being performed only in part and/or the relationship not continuing.

Barò Beauty Lab retains and processes personal data for the time strictly necessary to fulfill the purposes indicated, throughout the duration of the commercial relationship and/or for the period required by applicable civil and tax regulations. For marketing purposes, the retention period is limited to the period during which the user remains active or until they withdraw their consent to the processing. Whenever you receive an email from Barò Beauty Lab S.r.l., you will still have the option—if you no longer wish to receive communications and invitations from us—to request the deletion of your contact details.

Processing methods

Personal data are processed by the Data Controller primarily by electronic means and are stored within its corporate management system, on dedicated servers.

Appropriate security measures are implemented to prevent the loss or alteration of data—even accidental—unlawful or incorrect use, and unauthorized access.

The processing that the Data Controller will carry out on personal data does not involve any automated decision-making process that could produce legal effects concerning the data subject or similarly significantly affect them.

Scope of data disclosure

Customer data will be accessible, within the scope of their respective functions, to the employees and collaborators of the Data Controller (e.g., employees of the Sales Department) duly designated to perform specific tasks and/or functions as authorized persons/persons in charge, to external collaborators and service providers for the Data Controller, designated as data processors, who have been given specific written instructions, insofar as this is strictly necessary to pursue the purposes (“Processing Purposes”) of this information document. The data collected and processed may therefore be disclosed exclusively for the purposes specified above to:

1. 1) Postal operators or other couriers for the delivery of correspondence;
2. 2) Transport companies for the shipment of goods;
3. 3) Banking/financial institutions for the management of collections and payments;
4. 4) Business consultants and self-employed professionals, including those working in association with one another, who collaborate with the Controller (e.g., accountants, persons responsible for auditing financial statements, and administrative, tax and contract consultants);
5. 5) Insurance companies;
6. 6) Public entities in compliance with legal obligations
7. 7) Companies specializing in the management of Voucher Networks

The data may also be disclosed to supervisory authorities, law enforcement agencies and the judiciary to assert or defend one’s own right or a third party’s right in legal proceedings.

Only with prior, specific, freely given and optional consent, which may be withdrawn at any time, may personal data be disclosed to third-party companies that are customers, clients or partners of the Controller so that, acting as independent data controllers, they may send commercial communications via the web, post, email and telephone (SMS, MMS, telemarketing). These third parties belong to the following product and service categories: car manufacturers, car dealerships, insurance intermediaries, insurance companies, banks, financial companies, credit brokers, financial agents, commercial distributors, communication agencies, media centers, companies active in direct marketing and list brokerage, electricity or energy service providers, fixed-line and mobile telephone and ADSL service providers, publishing houses, distributors of newspapers, periodicals and books, suppliers of food and wine products, office-supply providers, providers of digital and/or satellite TV services and television broadcasters, manufacturers and/or distributors of childcare products, companies operating in the fast-moving consumer goods sector, roadside assistance companies, nonprofit associations and ONLUS organizations, or third parties for their own marketing and commercial initiatives using automated and non-automated tools concerning products and/or services, including those different from the services offered by the Controller. Therefore, these entities will process the user’s personal data as independent data controllers pursuant to Regulation (EU) 2016/679. The complete and updated list of entities that process the user’s personal data as independent data controllers is available from the Controller.

Location of processing and transfer of data to non-EU countries

The Data are not transferred outside the European Union, but the Data Controller reserves the right to change the location of the servers, including outside the European Union, ensuring, in such case, that the transfer will take place in compliance with the applicable provisions and with adequate legal safeguards.

Rights of data subjects pursuant to Articles 15–22, GDPR

By writing to the Data Controller at the postal address Barò Beauty Lab S.r.l. Registered Office: via G. Carducci no. 125 - 20099 Sesto San Giovanni (MI) Operating Office: Piazza Michele Ferrero, 8, 12050 Alba CN, the data subject may exercise the rights of: access (Art. 15, GDPR), rectification (Art. 16, GDPR), erasure and the right to be forgotten (Art. 17, GDPR), restriction of processing (Art. 18, GDPR), notification in the event of rectification or erasure (Art. 19, GDPR), data portability (Art. 20, GDPR), withdrawal of consent, objection to processing (Art. 21, GDPR), and objection to profiling (Art. 22, GDPR). At any time, the data subject may request the complete and up-to-date list of data processors and third parties to whom personal data may be disclosed.

Complaint to the Supervisory Authority

The data subject has the right to lodge a complaint with the Supervisory Authority, which in Italy is the Italian Data Protection Authority – Piazza Venezia 11, 00187 Rome (RM) – www.garanteprivacy.it, by sending an email to protocollo@pec.gpdp.it, using the form available on the Authority’s website.