◆ Care

Privacy & Cookies

Last updated: [date] · GDPR (Reg. EU 2016/679). Working draft — have a professional review before relying on it.

IDUN Cosmetics S.R.L.S. ("IDUN", "we") respects your privacy and processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Italian Legislative Decree 196/2003 as amended.

1. Data Controller

IDUN Cosmetics S.R.L.S., Piazzola 2, 56040 Montecatini Val di Cecina (PI), Italia. Contact for privacy matters: [privacy email]. A Data Protection Officer is not mandatory for most businesses of this size; one is appointed only if core activity involves large-scale monitoring or special-category data. If appointed: [DPO name & contact].

2. What we collect

• You give us: name, billing/shipping address, email, phone, order history, and communications you send us. Payment card details are entered on our payment provider's systems — we do not store full card numbers.
• Collected automatically: IP address, device/browser data, pages viewed, and similar analytics data via cookies and similar technologies (see the Cookie Policy below).
• From partners: order, delivery, and fraud-prevention data from Shopify, payment providers, and carriers.

3. Why we process it, and the legal basis

• To process and deliver orders, manage returns, and provide support — performance of a contract (Art. 6(1)(b)).
• To manage the IDUN Circle subscription and recurring billing — performance of a contract.
• To comply with legal obligations (tax, accounting, consumer law) — legal obligation (Art. 6(1)(c)).
• To send marketing where you have opted in, and to show relevant ads — consent (Art. 6(1)(a)), which you may withdraw at any time.
• To secure the site, prevent fraud, and improve our products/service — legitimate interests (Art. 6(1)(f)).

4. Who we share it with

Service providers acting on our instructions, including: Shopify (store, checkout, order management), our payment providers ([Shopify Payments / PayPal / …]), shipping carriers ([carrier(s)]), our email/marketing platform (Klaviyo), and analytics/advertising providers (Google, Meta). Some providers may process data outside the EU/EEA; where they do, transfers are covered by Standard Contractual Clauses or an adequacy decision.

5. Retention

Order and tax records are kept for the period required by Italian law (generally 10 years for accounting). Marketing data is kept until you unsubscribe or object. Analytics data is kept for [period].

6. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time. Write to [privacy email]. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Cookie Policy

We use cookies and similar technologies to run the store, remember your preferences, measure traffic, and — with your consent — personalise marketing.

• Strictly necessary (always on): cart, checkout, security, load balancing. These do not require consent.
• Functional: remember preferences (e.g. language, region).
• Analytics: understand how the site is used (Google Analytics 4).
• Marketing/Profiling: measure and target advertising (Meta Pixel).

Non-essential cookies (analytics, marketing) are set only after you consent via our banner. You can change or withdraw your choice at any time via "Cookie preferences" in the site footer.

Changes

We may update this policy; the "last updated" date shows the current version.