Cookie Policy


SITE TRACKING TOOLS NOTICE

This notice (hereinafter, for simplicity, the "Cookie Policy") governs the processing of your personal data while browsing the website www.skinfirstcosmetics.it ("Site"), through the use of cookies and other tracking tools, carried out by Skin First Cosmetics S.r.l., with registered office at Via Lorenzo Mascheroni 14, 20145 – Milan (MI), Italy, VAT No. 11241570966, email privacy@skinfirstcosmetics.it ("Controller"), in accordance with current personal data protection laws, including EU Regulation 2016/679 ("GDPR") and Directive 2002/58/EC ("Directive") and any subsequent amendments.

1. Identity and contact details of the Representative

As the Controller is established within the EU, no representative has been appointed.


2. Contact details of the data protection officer

The Controller has appointed a Data Protection Officer ("DPO") pursuant to Article 37 GDPR. The DPO can be contacted at the following email address: dpo@skinfirstcosmetics.it


3. Means and purposes of processing

Browsing data

To complete the connection to the Site, some of your personal data are collected. This set of data includes, for example:

  • the IP address of the device you use;
  • the date and time of access;
  • the type of web browser;
  • the operating system used.

Cookies

Cookies are small text files that are downloaded onto your device when you visit the Site. They are used to improve your user experience. Cookies can remember your preferences, such as language or Site settings, to make subsequent visits to the Site simpler and more personalized. Cookies can be classified in various ways:


Based on how long the information is stored:

  1. Session cookies: these are temporary and are deleted every time you close the browser.
  2. Persistent cookies: these remain on your device until you delete them or until they expire.

Based on who manages the cookies:

  1. First-party cookies: these cookies are installed and managed directly by the Controller.
  2. Third-party cookies: these are installed by other websites that provide various kinds of services to the Site. In other words, these cookies are managed by websites other than the one you are visiting.

Based on the cookie's functional purpose:

  1. Technical cookies: cookies in this category allow the Site to function properly
  2. Statistical cookies: cookies in this category allow statistical analyses to be carried out relating to different domains, websites, or apps attributable to the Controller itself.
  3. Marketing cookies: cookies in this category allow the Controller to carry out marketing activities.
  4. Profiling cookies: cookies in this category allow the Controller to track information about you in order to provide you with personalized services based on your needs and preferences.

At the following link, in the "Details" section, all cookies used by the Controller within the Site are listed, in accordance with what you accepted in the banner: Cookie settings


4. Deleting and disabling cookies

You can configure your browser to prevent the processing of cookies, or delete them immediately after browsing. Below, we list the methods for disabling and deleting cookies in the main browsers:


5. Legal basis for processing and optional nature of consent

  1. Personal data processed while browsing the Site: the communication of such personal data is a contractual obligation, without which the Site's services could not be made properly available.
  2. Personal data processed with technical cookies: the communication of personal data is a contractual obligation, without which the Site's services could not be made properly available.
  3. Personal data processed with statistical cookies: the communication of personal data is entirely optional. If you do not give consent for the communication of such data, it will be impossible for the Controller to carry out this tracking activity. The legal basis for the processing is your consent, given in accordance with applicable law.
  4. Personal data processed with marketing cookies: the communication of personal data is entirely optional. If you do not give consent for the communication of such data, it will be impossible for the Controller to carry out this tracking activity. The legal basis for the processing is your consent, given in accordance with applicable law.
  5. Personal data processed with profiling cookies: the communication of personal data is entirely optional. If you do not give consent for the communication of such data, it will be impossible for the Controller to carry out this tracking activity. The legal basis for the processing is your consent, given in accordance with applicable law.

You may give consent to the processing of personal data through the tracking tools described in this Cookie Policy by clicking specific boxes within the relevant banners.


6. Profiling

If you consent to processing through tracking tools in order to use personalized services, your personal data may be subject to automated decision-making, with one or more specific algorithms determining which communications are most suitable for your profile or which may be of interest to you.


7. Source of the personal data and categories of data

The Controller will process only the personal data you provide in accordance with the Cookie Policy, collected through the Site. The Controller will not process data from publicly accessible sources. The Controller will not process special categories of personal data referred to in Article 9 of the GDPR.


8. Recipients and possible categories of recipients of personal data

Your personal data may be received by:

  • companies offering hosting services;
  • companies offering information society services, including in particular those offering hosting services;
  • companies carrying out statistical and market research, where the relevant consent has been given.


9. Transfer of personal data

The Controller intends to transfer Personal Data to entities established in a third country outside the European Union or to an international organization. Such entities may be, by way of example:

  • communications companies carrying out communication activities on behalf of the Controller;
  • communications companies carrying out communication activities on behalf of the Controller;
  • information society service providers.
  • companies providing third-party cookies.

The transfer of personal data to such entities, where established in a third country or an international organization, is carried out in the presence of an adequacy decision by the European Commission, which has verified that the third country, territory or one or more specific sectors within the third country, or the international organization in question ensures an adequate level of protection of rights. In any case, the Controller, should it deem it appropriate, reserves the right to enter into specific separate agreements requiring such entities to adopt adequate security measures, including organizational measures, aimed at providing appropriate safeguards for your rights. Personal data may therefore be transferred to the following countries: U.S.A.. To obtain a copy of such data or the place where they have been made available, simply send the relevant request to the Controller at the addresses indicated above.


10. Retention period of personal data

  1. Personal data processed while browsing the Site: the Controller will retain your personal data processed while browsing the Site for a period not exceeding 12 (twelve) months from the date of each collection;
  2. Personal data processed with technical cookies: the Controller will retain your personal data processed with technical cookies in order to allow you to properly use the Site for a period not exceeding 12 (twelve) months from the date of each collection;
  3. Personal data processed with statistical cookies: the Controller will retain your personal data processed to provide personalized services through statistical cookies for a period not exceeding 12 (twelve) months from the date of each collection;
  4. Personal data processed with marketing cookies: the Controller will retain your personal data processed to provide personalized services through marketing cookies for a period not exceeding 12 (twelve) months from the date of each collection;
  5. Personal data processed with profiling cookies: the Controller will retain your personal data processed to provide personalized services through profiling cookies for a period not exceeding 12 (twelve) months from the date of each collection.

In any case, the Controller reserves the right to ask you to renew and/or verify the consents given.


10. Right to object

As a "data subject", you have the right to object, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, pursuant to Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. The Controller shall refrain from further processing your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise, or defense of a legal claim. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling to the extent that it is related to such direct marketing. In the event of objection to processing for direct marketing purposes, personal data will no longer be processed for such purposes. You may object to the processing of your personal data for direct marketing purposes also only in part, for example by objecting only to the sending of promotional communications carried out through automated and/or digital tools, or to the sending of paper communications and/or the receipt of telephone communications. Where your personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out in the public interest.


11. Other rights

The Controller also wishes to inform you of the existence of the following rights:

  • Right of access: you have the right to obtain from the Controller confirmation as to whether or not personal data concerning you are being processed. In that case, you have the right to access your personal data and specific information, in accordance with Article 15 of the GDPR;
  • Right to rectification: you have the right to obtain from the Controller the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to obtain the completion of incomplete personal data, including by providing a supplementary statement, in accordance with Article 16 of the GDPR;
  • Right to erasure: you have the right to obtain from the Controller the erasure of personal data concerning you without undue delay. The Controller is obliged to erase personal data without undue delay if the reasons listed in Article 17 of the GDPR apply;
  • Right to restriction of processing: you have the right to obtain from the Controller restriction of processing if the reasons listed in Article 18 of the GDPR apply;
  • Right to data portability: you have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you provided to the Controller, as well as the right to transmit such data to another controller without hindrance from the Controller, in the cases and under the conditions specified in Article 20 of the GDPR;
  • Right to object to commercial communications: you have the right to object at any time, free of charge, to receiving commercial communications from the Controller;
  • Rights in relation to profiling: you have the right to obtain human intervention by the Controller, to express your point of view and to contest the decision, in accordance with Article 22 of the GDPR;
  • Right to lodge a complaint with the Supervisory Authority: you have the right to lodge a complaint with the Supervisory Authority for the Protection of Personal Data to report a violation of data protection rules, in accordance with Article 77 of the GDPR.


12. How to exercise your rights

You may exercise the rights set out in the Cookie Policy by addressing requests directly to the Controller at the email address privacy@skinfirstcosmetics.it, or by sending the relevant notice by registered mail with return receipt to the Controller's registered office as indicated above. You may lodge a complaint with the Supervisory Authority for the Protection of Personal Data in the manner provided on the official website, addressing it to the contact details available at https://www.garanteprivacy.it/home/footer/contatti.


13. Accessibility

The Cookie Policy is available at https://www.skinfirstcosmetics.it/pages/cookie-policy and at the Controller's offices.


14. Changes

The Controller may modify the Cookie Policy, including to comply with national and/or European Union law or technological developments. Any new versions of the Cookie Policy will be posted on the Site. We invite you to check the Cookie Policy periodically. Any changes will in any case be communicated to you through a pop-up on the Site or by different methods and/or IT tools. If the Controller were to substantially amend the Cookie Policy, providing for new processing purposes