NOTICE ON THE PROCESSING OF PERSONAL DATA
(EU REGULATION 2016/679)
personal data collected pursuant to art. 13 GDPR

Cosmetica HUB S.p.A., in the person of its legal representative pro tempore, with registered office in Milan (MI) at Foro Bonaparte no. 67, VAT no. 09198410962, hereinafter the DATA CONTROLLER, in its capacity as data controller, informs you, pursuant to art. 13 of EU Regulation no. 2016/679, hereinafter GDPR, that your data will be processed in the following manner and for the following purposes:

1) identity and contact details of the data controller and of the data protection officer: the data controller through the website www.mulaccosmetics.com  is Cosmetica HUB S.p.A., in the person of its legal representative pro tempore, with registered office in Milan (MI) at Foro Bonaparte no. 67, VAT no. 09198410962, which can be contacted at the email address cosmetica@legalmail.it.You may also contact the Data Protection Officer (DPO), Avv. Enrica Vasini, Tax code VSNNRC78M45C573E, who can be contacted at the email address enrica.vasini@ordineavvocatirimini.it . You may contact the data controller and the DPO to exercise the rights granted to the data subject under the GDPR and to obtain the updated list of all data processors, both internal and external, sub-processors, and persons authorised to process data.

2) subject matter of the processing: simply browsing the site does not involve any registration, except for the use of certain technical cookies discussed later at point 13 of this notice. While browsing the site, the controller www.mulaccosmetics.com processes connection data, such as, for example, the visitor's IP address. Simply browsing the site does not involve any registration, while the use of cookies, both its own and third-party cookies,  is provided for, for which please refer to the cookie policy on the site www.mulaccosmetics.com. Access to the private account area, on the other hand, requires entering and using an email address and a password chosen by the user, which may be remembered by means of a technical cookie, subject to the visitor's consent. Geolocation of the user's position, in order to identify the nearest point of sale to the visitor, does not relate to the location of the data subject and therefore does not involve the processing of personal data. Providing personal data in order to purchase the controller's products and services through access to the private account area involves providing personal data as well as data relating to where the ordered goods are to be delivered; providing such data is optional, but failure to provide it makes it impossible for the controller to accept and deliver the orders placed. Providing personal data in the “contacts” section involves providing personal data; providing such data is optional, but failure to provide it makes it impossible for the controller to respond to the contact request.

3) Purpose of the processing and legal basis.
 your data is processed:

A) without the need for your express consent, pursuant to art. 6(1)(b) GDPR, for the following sales or service purposes:
-  for the performance of a contract to which the data subject is a party, or for the performance of pre-contractual measures adopted at the data subject's request.  
This is the case where the data subject proceeds to purchase products or services offered by the Controller by browsing online on the site www.mulaccosmetics.com and by accessing the private account area to make online purchases. The same applies to data relating to where the ordered goods are to be delivered, as the concluding act of the contract between the parties (performance by the controller).  
-to fulfil the pre-contractual, contractual and tax obligations arising from the relationship with you   
-to fulfil the obligations set out by law, by a regulation, by EU legislation, or by an order of an Authority (such as, for example, in anti-money-laundering matters)  
-to exercise the controller's rights, for example the right of defence in any legal proceedings.
- to respond to a contact request made through the “contacts” section of the site.

 For those who subscribe to the newsletter,

B) Only with your specific and separate prior consent (art. 6(1)(a) GDPR), and we inform you that you may withdraw previously given consent at any time, it being understood that, for processing carried out on the basis of explicit consent, the processing is lawful until such consent is withdrawn, for the following marketing purposes:
-to send you emails, mail and/or SMS, and/or telephone contacts, newsletters, commercial communications and/or advertising material regarding products or services offered by the Controller, and to gauge your satisfaction with the quality of the services, by subscribing to the newsletter via the site  www.mulaccosmetics.com

C)  Only with your specific and separate prior consent (art. 6(1)(a) GDPR), and we inform you that you may withdraw previously given consent at any time, it being understood that, for processing carried out on the basis of explicit consent, the processing is lawful until such consent is withdrawn, as regards, while browsing the site www.mulaccosmetics.com the use of cookies, as further detailed in the cookie policy on the site. There are different types of cookies, which require acceptance by the user/visitor. The user has the option not to accept the use of cookies by selecting the appropriate settings in the banner that appears at the start of browsing on the aforementioned site, or to change their choices.  

D) For a legitimate interest of the data controller, for statistical purposes or to improve browsing on the site www.mulaccosmetics.com. Specifically, as regards statistical purposes, this refers to the use by the aforementioned website of the Google Analytics program, which is however used by the controller only with IP anonymisation enabled. The IP address transmitted by the user's browser is not combined with other Google data. The legal basis for this processing is, precisely, art. 6(1)(f) of the GDPR.  

E) For a legitimate interest of the data controller (art. 6(1)(f) GDPR), in the case of sending soft spam, as defined by art. 130(4) of the Privacy Code, relating to products similar to those you have already purchased. Please note that you may always object to the aforementioned soft spam at any time by sending a communication to the address: support@mulaccosmetics.com, entering “no soft spam” in the subject line, or by following the instructions in the footer of the emails

F) for the performance of a contract to which the data subject is a party, or for the performance of pre-contractual measures adopted at the data subject's request, pursuant to art. 6(1)(b) GDPR, the processing is necessary. The purpose is to grant the data subject access to the private account area at their request, in order to make purchases. Providing the data is optional, but failure to provide it makes it impossible for the controller to conclude the requested contract.
The purpose is to provide the services requested by the data subject 

4) method of processing: the processing of your personal data is carried out by means of the operations set out in art. 4(2) GDPR, namely: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, alignment or combination, restriction, erasure, destruction, and portability at your request. Your personal data is processed both in paper and electronic and/or automated form. Personal data is processed using automated tools for the time strictly necessary to achieve the purposes for which it was collected. As is your right, automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, will not be based solely on such automated processing, unless it is necessary for the conclusion or performance of a contract between the data subject and a data controller, or unless there is explicit consent from the data subject. We inform you that specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorised access.

5) recipients or categories of recipients of personal data 
The data collected is used solely to fulfil the services requested by the user, such as, for example, accessing private account areas to use the related services and to order goods online, geolocation to identify the store closest to the user's position, or for the collection, management and shipping of orders that the customer intends to place online. Data provided by the user on these occasions will not be further disclosed except to persons or companies duly authorised by the Controller (internal and/or external data processors, sub-processors, persons authorised to process data) and will not be disseminated without your consent. Without the need for your express consent, the controller may disclose your data for the purposes referred to in point 3 A) of this notice to Supervisory Bodies, Judicial Authorities, as well as to all those parties to whom disclosure is mandatory by law and for the performance of the aforementioned purposes. Such parties will process the data in their capacity as independent data controllers. Data may be transferred to a third country outside the EU to third parties solely for the purposes indicated above and in full compliance with the processing consented to by the User. The data processor Extera srl is based in a country outside the EU, as indicated in the site's registration details. In order to safeguard the right that the European Union considers fundamental, data collected within European territory must be transferred to international organisations or non-EU countries in accordance with the strict rules established by Chapter V of the EU Regulation: the transfer must take place in compliance with the principles underlying proper processing and in the presence of sufficient and adequate safeguards to protect all data subjects. The data controller guarantees, pursuant to arts. 46 and 48 of EU Regulation 2016/679, that transfers to third parties resident in non-EU countries will take place in compliance with such rules, in particular with the provisions of art. 46(3)(a) of the GDPR.

6) data retention periods.
The controller will process personal data for the periods established by the applicable regulations, specified below, pursuant to art. 13 GDPR: ten years for documents and related data of a civil, accounting and tax nature, as provided for by the laws in force, for the data referred to in point 3 A). With regard to data processed for marketing purposes under point 3 B), such data will be retained in compliance with the principle of proportionality and, in any case, until the purposes of the processing have been achieved or, if earlier, until the data subject withdraws their specific consent. Data referred to in points 3) C and 3) D will be retained until the end of the session by means of a technical cookie. Data referred to in point 3) E will be retained until any objection is raised and, in any case, until the purpose for which it was collected and processed has been fulfilled. Ten years for documents and related data of a civil, accounting and tax nature, as provided for by the laws in force, for the data referred to in point 3 F)

7) rights of the data subject
The data subject has the right to ask the data controller for access to the personal data held by the latter, the rectification or erasure of such data, or the restriction of the processing concerning them, or to object to the processing of personal data, and also has the right to request the portability of their personal data held by the controller.

8) consent given and its withdrawal
Where processing is based on explicit consent for one or more specific purposes of the data subject, pursuant to art. 6(1)(a), or on the explicit consent of the data subject pursuant to art. 9(2)(a) for one or more specific purposes of the data subject, you are informed that it is the data subject's right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent given before its withdrawal.

9) right to lodge a complaint with a supervisory authority 
The controller informs the data subject that, should they identify any unlawfulness, lack of transparency, lack of fairness on the part of the controller, or any other irregularity under the GDPR in the processing of their data, it is their right to lodge a complaint with the supervisory authority (the Garante per la protezione dei dati personali, the Italian Data Protection Authority) or to take legal action 

10) nature of the provision of personal data and consequences of any refusal to provide it.
The provision of personal data is optional, except in specific cases where there is a legal obligation. Any refusal to provide it makes it impossible to conclude contracts for the Controller's services, supplies, and sale of goods referred to in points 3 A) 3 B) and 3 C) and 3 D) of this notice.  

11) profiling
The controller informs you that your personal data will not be processed by means of an automated decision-making process (including profiling) without the express consent of the user

12) further processing of data for further purposes 
The controller informs you that your data will be processed solely for the purposes for which it was provided. Further processing for purposes other than those for which the data was provided will require further authorisation from the data subject.  

13) Cookies
By using the site  www.mulaccosmetics.com, you consent to the use of cookies in accordance with this policy. Please note that the cookies used are technical cookies necessary for the proper functioning of the site, as well as third-party cookies.

Third-party cookies are cookies managed by third parties that may collect and track certain browsing data. This site uses the Google Analytics service with the anonymisation option enabled.

Cookies are managed by the user via the initial banner, and consent given can always be withdrawn.