Information on the Use of Email Data

This information is drawn up pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and provides users with detailed information regarding the methods of collection, use, storage and protection of personal data voluntarily provided by registering on the GlamLuxe mailing list.

GlamLuxe, as Data Controller , guarantees that the processing of personal data occurs in full compliance with current legislation, adopting adequate technical and organizational measures to protect the data processed. Subscription to the mailing list involves the periodic sending of promotional and informative communications relating to GlamLuxe products, services and commercial initiatives, based on the explicit consent provided by the user.

Pursuant to Article 5 of the GDPR , personal data will be processed according to the principles of lawfulness, correctness, transparency, minimization and limitation of storage , guaranteeing the security and confidentiality of the information provided.

This document describes in detail:

  • the purposes and legal basis of the processing of personal data;
  • the rights recognized to interested parties under the GDPR;
  • the methods of exercising rights, including the withdrawal of consent;
  • the measures adopted for the protection of personal data;
  • the duration of data retention and the methods of elimination or anonymization at the end of the established period.

For further information, please consult the Privacy Policy and the Terms and Conditions of Service available on the website.

1. DATA CONTROLLER

The Data Controller is GlamLuxe , with registered office in Milan; via Cesare Beccaria 5, contactable for any request relating to data processing at the email address privacy@glamluxe.it .

2. CATEGORIES OF DATA COLLECTED

The email address voluntarily provided by users is collected and processed exclusively for the purposes indicated in this information. Providing the name and surname, where requested, is optional and has the sole purpose of personalising the communications sent. Failure to provide such data does not affect registration to the mailing list or receipt of promotional emails .

3. PURPOSE AND LEGAL BASIS OF THE PROCESSING

The data collected will be processed for the following purposes:

a) Sending promotional communications and personalized offers relating to the products and services offered by GlamLuxe, pursuant to art. 6, par. 1, letter a) of the GDPR (consent of the interested party) .

b) Analysis and segmentation of users to improve the personalization of offers and communications sent, pursuant to art. 6, par. 1, letter f) of the GDPR (legitimate interest of the data controller) .

c) Management of requests relating to the modification or revocation of consent to guarantee the user's right to access, rectification and deletion of personal data, pursuant to art. 6, par. 1, letter c) of the GDPR (fulfilment of legal obligations) .

4. DATA RETENTION PERIOD

The data collected will be retained for a maximum period of 24 months from the last significant interaction of the user with the communications received . After this period, the data will be deleted or anonymized, except for conservation obligations required by current legislation.

5. METHODS OF TREATMENT

The processing of personal data will be carried out in compliance with the principles of lawfulness, correctness, transparency, purpose limitation and data minimization , as established by articles 5 and 32 of the GDPR .

The data will be processed using electronic and IT tools, with the adoption of adequate technical and organizational measures to guarantee their security, integrity and confidentiality , in order to prevent unauthorized access, alteration, disclosure or destruction of the data.

The processing operations include the collection, recording, organization, storage, consultation, use, limitation and deletion of data , exclusively for the purposes described in this information.

The processing will be carried out by authorised personnel and by service providers appointed by the Data Controller , who will act as Data Processors , pursuant to Article 28 of the GDPR .

In compliance with the security obligations set forth in Article 32 of the GDPR , the following measures are adopted:

  • Encryption and protection of personal data during transmission and storage.
  • Access to data restricted to authorized personnel and assigned service providers only.
  • Backup and disaster recovery systems , to ensure business continuity and protection from accidental losses.
  • Continuous monitoring of cybersecurity to prevent any data breaches.

Personal data will not be processed through automated decision-making processes that may affect the fundamental rights and freedoms of the data subject, in accordance with Article 22 of the GDPR .

6. NATURE OF THE PROVISION AND CONSEQUENCES OF REFUSAL

Providing your email address to subscribe to the mailing list is optional and based exclusively on the free, specific, informed and unequivocal consent of the user , pursuant to Article 6, paragraph 1, letter a), of the GDPR .

Failure to provide your email address will not affect your access to the services offered by GlamLuxe or your ability to make purchases on the site. However, without explicit consent to processing, the Data Controller will not be able to send promotional communications, exclusive offers or personalized updates regarding GlamLuxe products and services.

The user always has the possibility to revoke his/her consent at any time, without prejudice to the lawfulness of the processing carried out before the revocation.

To ensure maximum transparency and protection of the rights of the interested party, GlamLuxe does not require registration to the mailing list as a condition for accessing other services offered and does not implement any mandatory marketing practices .

Registration to the mailing list and receipt of promotional communications may also be modulated and personalized based on the user's preferences, where possible and always with explicit consent.

7. RIGHTS OF THE INTERESTED PARTY

Users, as interested parties, can exercise the rights provided for by articles 15-22 of the GDPR , including:

  • Right of access (art. 15 GDPR): obtain confirmation of whether or not personal data concerning them are being processed.
  • Right to rectification (art. 16 GDPR): obtain the correction of inaccurate data or the integration of incomplete data.
  • Right to erasure (“right to be forgotten”, art. 17 GDPR): obtain the erasure of personal data, except for legal retention obligations.
  • Right to restriction of processing (art. 18 GDPR): obtain temporary suspension of processing in the cases provided for by the legislation.
  • Right to data portability (art. 20 GDPR): receive data in a structured, commonly used and machine-readable format.
  • Right to object (art. 21 GDPR): to object to processing for legitimate reasons, including profiling based on interests.
  • Right not to be subject to automated decisions (Article 22 GDPR): obtain human intervention in automated decision-making processes.

Requests to exercise rights can be sent by email to [company email] , specifying the subject of the request.

8. REVOCATION OF CONSENT

The user has the right to revoke at any time the consent given to the processing of his/her personal data, without prejudice to the lawfulness of the processing carried out before the revocation, pursuant to art. 7, paragraph 3, of Regulation (EU) 2016/679 (GDPR) .

The withdrawal of consent can be exercised through the following methods:

  • Through the unsubscribe link present in each email received, to stop receiving promotional communications.
  • By completing the Consent Withdrawal Form , available in the Forms section of the site. The form, once completed, can be sent automatically by clicking on the dedicated button.

The Data Controller will handle the request within 30 days of receipt , in accordance with the obligations set forth in art. 12, paragraph 3, of the GDPR .

9. RECIPIENTS OF PERSONAL DATA

The personal data collected will be processed exclusively by the Data Controller and may be communicated to third parties exclusively for the purposes indicated in this information notice, in compliance with the principles of necessity, proportionality and data minimization , pursuant to Article 5 of the GDPR .

In particular, the data may be communicated to the following categories of recipients:

  • Email marketing and CRM service providers : third parties responsible for managing and sending electronic communications on behalf of the Data Controller (e.g. Klaviyo).
  • IT service providers and technology infrastructure : companies that offer hosting, cloud computing, software maintenance and cyber security to ensure the protection of the data processed.
  • Competent authorities or public bodies : in compliance with legal obligations, upon reasoned request and within the limits established by applicable legislation.

The recipients of the data operate as Data Processors , pursuant to Article 28 of the GDPR , or as independent Data Controllers , subject to verification of compliance with data protection regulations.

Personal data will not be disclosed to third parties for marketing purposes without the prior explicit consent of the user.

10. DATA SECURITY AND TRANSFER

The Data Controller adopts adequate technical and organizational measures to guarantee the security, integrity and confidentiality of personal data , in compliance with the provisions of Article 32 of the GDPR .

The security measures implemented include:

  • Encryption and data protection : use of security protocols for the transmission and storage of information, in order to prevent unauthorized access.
  • Access Control : Restrictions based on access privileges, limited to authorized personnel and designated service providers.
  • Monitoring and auditing : Continuous monitoring systems to detect and prevent any security breaches.
  • Backup and disaster recovery : Data rescue and recovery strategies to ensure business continuity and protection from accidental loss.

Transfer of data outside the European Union

Personal data will be processed and stored on servers located within the European Economic Area (EEA) . However, if it is necessary to transfer data to third countries outside the EU, the Data Controller undertakes to ensure that such transfer takes place in compliance with the guarantees provided for in Chapter V of the GDPR (articles 44-49) , through:

  • Adequacy decisions of the European Commission , for countries that ensure an adequate level of protection.
  • Standard Contractual Clauses (SCC) approved by the European Commission, to ensure processing in compliance with European regulations.
  • Any other additional security measures , assessed on the basis of the specific nature of the transfer.

In any case, the Data Controller ensures that the transfer of data will always take place in compliance with the principles of lawfulness, necessity and proportionality and will guarantee the user the possibility of obtaining more information on the guarantees adopted, by contacting the Data Controller at the references indicated in this information.

11. CHANGES TO THIS NOTICE

The Owner reserves the right to modify this information at any time. Any changes will be published on this page and, where necessary, communicated to users via email or other suitable means.