Privacy policy

Dear Customer,

We at Epilate S.r.l. believe that the protection of our customers’ personal data is an added value. With this Information Notice on the Processing of Personal Data (“Information Notice”) we intend to explain how we will process your personal data, explaining the methods and purposes of processing and informing you of your rights under applicable legislation. For the sake of clarity, we inform you that the words “processing” and ‘processing’ used herein in the Notice, have the meaning set forth in Regulation (EU) 2016/679 (“GDPR”) thus having to be understood as the activities and/or set of activities that are carried out with reference to personal data such as, for example, accessing, transmitting or reading personal data, storing or modifying them, etc.

In the event that you disclose to us personal data referable to third parties and/or act as a legal representative of a third party (e.g., your son or daughter), you warrant that you have duly informed such parties of the content of this Notice and that you have obtained all authorizations required by applicable law.

If you have any queries regarding the processing of your personal data, you may contact us by sending an e-mail communication to dpo@epilate.it

Dear Customer,

We at Epilate S.r.l. believe that the protection of our customers’ personal data is an added value. With this Information Notice on the Processing of Personal Data (“Information Notice”) we intend to explain how we will process your personal data, explaining the methods and purposes of processing and informing you of your rights under applicable legislation. For the sake of clarity, we inform you that the words “processing” and ‘processing’ used herein in the Notice, have the meaning set forth in Regulation (EU) 2016/679 (“GDPR”) thus having to be understood as the activities and/or set of activities that are carried out with reference to personal data such as, for example, accessing, transmitting or reading personal data, storing or modifying them, etc.

In the event that you disclose to us personal data referable to third parties and/or act as a legal representative of a third party (e.g., your son or daughter), you warrant that you have duly informed such parties of the content of this Notice and that you have obtained all authorizations required by applicable law.

If you have any queries regarding the processing of your personal data, you may contact us by sending an e-mail communication to dpo@epilate.it

1. The Data Controller and Data Protection Officer (“DPO”).

Epilate S.r.l. (hereinafter, “Epilate” or “Data Controller”) – with its registered office in Milan, Via dei Piatti 11 – provides you with this Notice in its capacity as Data Controller, in compliance with the provisions of the GDPR, Legislative Decree 196/2003, as amended and supplemented, the relevant measures and guidelines of the national and European data protection authorities, as well as the applicable national and European legislation (jointly, “Applicable Legislation”). For any queries regarding the processing of your personal data, you may send an e-mail to dpo@epilate.it

In addition, the Controller has appointed a personal data protection officer pursuant to Articles 37 et seq. GDPR. The DPO can be contacted at any time by sending an e-mail to dpo@epilate.it

2. Categories of data processed, purpose of processing and legal basis

Epilate will process, by both manual and automated means, only the data strictly necessary to pursue the purposes of the processing set out in the table below.

Legal basis

Execution of a contract to which you are a party or the execution of pre-contractual measures taken at your request, pursuant to Art. 6(1)(b) GDPR.With regard to data relating to your health status (so-called special data), processing is carried out on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.

Execution of pre-contractual measures taken at your request, pursuant to Art. 6(1)(b) GDPR.

Legitimate interest of the Controller in promoting products and services similar to those you have already purchased, pursuant to Art. 6(1)(f) GDPR.

Informed, free, unequivocal and specific consent, pursuant to Art. 6(1)(a) GDPR.

Data processed

Common personal data such as first and last name, gender, place of residence or domicile, email address, cell phone number, social security number.The provision of such personal data is optional, but necessary in order to be able to contact you again and follow up on your request; in case of failure to provide such data, the Data Controller will not be able to contact you to arrange the free consultation you have requested.

Common personal data communicated by you such as first name, last name email address and telephone number, place of domicile and/or residence.You are free to object in relation to the processing based on legitimate interest at any time by writing to Epilate which, accordingly, will discontinue any communication of a commercial or promotional nature.Similarly, if given, you are free to revoke your consent for the purposes of commercial or promotional communication by writing to Epilate which, again, will discontinue any communication of a commercial or promotional nature. Withdrawal of consent and/or failure to provide it will have no effect on the execution of the contract and the provision of aesthetic treatment.

In addition, we would like to inform you that, to the extent strictly necessary, the data processed by Epilate will also be processed in order to (v) comply with legal obligations applicable to the Controller pursuant to Art. 6(1)(c) GDPR), (vi) to exercise or defend a right of the Data Controller pursuant to Art. 6(1)(f) GDPR), or (vii) to plan and/or carry out corporate and/or corporate reorganization transactions (e.g. mergers, acquisitions, divestments, etc.) pursuant to Art. 6(1)(f) GDPR. Where necessary, we will deliver you one or more specific privacy notices to supplement this one. In any case, you may contact the Controller at any time by writing to the contact details set out in this Notice.

3. Period of data retention

The personal data processed by Epilate will be processed for the time strictly necessary to perform the contract to which you are a party and/or until the guarantee on the aesthetic treatment produces its effects, and achieve the purposes of the processing indicated above; thereafter, the personal data will be retained, with appropriate security measures, for the applicable prescriptive period (in any case not exceeding 10 years) or for the longer period necessary to comply with legal obligations and/or for purposes of judicial protection.

The personal data processed on the basis of your consent and/or on the basis of Epilate’s legitimate interest will be processed for a maximum period of 24 months from the last commercial or promotional communication sent, but in any case no longer than the deletion period indicated in the previous period, unless before that time you exercise your right to object and/or withdraw consent (if given). In the latter case, the processing will cease immediately.

At the end of the indicated retention period, personal data will be deleted or anonymized.

For more information on retention periods, please contact Epilate at the contact details indicated in this Policy.

4. Recipients of personal data and transfer of personal data beyond the European Economic Area.

Where strictly necessary for the pursuit of the purposes indicated in paragraph 2 above, the personal data processed by Epilate may be communicated to third parties – duly authorized – who carry out activities related or instrumental to Epilate’s business (e.g. call center companies, IT maintenance, freelance professionals and/or consulting companies), companies that support and/or collaborate with Epilate in the organization of promotional campaigns, as well as to the competent authorities, if required by applicable regulations.

Depending on the case, these parties may act as autonomous data controllers, or as data processors who process personal data on behalf of Epilate by virtue of specific instructions under Article 28 GDPR.

In addition, where you have made a request through our online and/or telephone channels for a free consultation in a geographic area where there is no beauty center operated directly by Epilate, your common personal data will be disclosed as a pre-contractual measure to a beauty center operated by a third party operating as a franchisee of Epilate. These latter entities act as autonomous data controllers based on the respective privacy notices that will be delivered to you by the individual franchisees.

Nel caso in cui i destinatari dei dati personali siano situati al di fuori dello Spazio Economico Europeo, il trasferimento avverrà esclusivamente a fronte di apposite garanzie per tutelare i diritti e le libertà degli interessati, attraverso l’adozione di uno degli strumenti previsti dal Capo V GDPR.

5. The rights provided by the applicable Legislation

If the prerequisites set forth in the Applicable Legislation are met, you may at any time exercise the rights recognized in the field of personal data protection, such as: the right to request access to your personal data, and the rectification or cancellation thereof or the restriction of processing, or to object to processing, as well as the right to data portability; the right to revoke consent, if given, without prejudice to the processing carried out before the revocation; the right to lodge a complaint with the competent Privacy Authority – in Italy, the Garante per la protezione dei dati personali – as well as to bring judicial remedies.

To exercise these rights, you may send an e-mail to dpo@epilate.it