Informativa sulla privacy
We understand that the privacy of personal data, and how it is used, matters a great deal to you. For this reason, we want you to be able to trust that Cosmetica Etica, the owner of The Body Shop brand in Italy, handles your personal data with the utmost care. This privacy notice will help you understand what personal data we collect, why we collect it, and how we use it.
We invite you to take a few minutes to read about our data protection practices and to let us know if you have any questions. To do so, simply send us an email at privacy@thebodyshop.it.
You have the right to object to certain uses of your personal data, including the use of your personal data for direct marketing. Below you can see what your rights are and how you can exercise them.
Who collects the data?
All personal data provided by the user, or collected for The Body Shop in Italy, is collected by the company Cosmetica Etica S.r.l.. This privacy notice applies to personal data collected through the website thebodyshop.it in relation to the services and products we offer.
For further information, visit the website www.thebodyshop.it.
This privacy notice also applies to marketing content, including offers and advertisements relating to The Body Shop Italia's products and services, which we (or a service provider acting on our behalf) send to users on third-party websites, platforms and applications, based on information about the user's use of the site. These third-party websites generally have their own privacy notices and terms of use. We recommend reading them before using such websites.
What personal data is collected?
Personal data means any information that can be used to directly or indirectly identify a specific individual.
You are not obliged to provide Cosmetica Etica S.r.l. with the personal data we request. However, if you choose not to, we may be unable to provide you with our products and services, offer you a high-quality service, or respond to all of your requests.
We may collect personal data from numerous sources. This includes:
● personal data you provide to us directly,
● personal data we collect automatically, and
● personal data we collect from other sources.
Personal data means any information that can be used to directly or indirectly identify a specific individual. This definition includes direct marketing campaigns and/or prize competitions, as well as online collection through our websites, applications, and pages on third-party platforms, and applications accessible through or used by such third-party platforms.
When you contact us, we may ask you to provide your personal data. We may also combine it with other information to improve our products, services, content and advertising.
How do we collect personal data?
Personal data you provide to us directly
We collect data on how you use our services and products, such as the types of content you view or interact with, or the frequency and duration of your activities. We also collect the personal data you provide when you sign up for a marketing newsletter, take part in a survey, or register an account to purchase our products. For this purpose, we may request personal data such as name, gender, date of birth, address, email address, phone number, or credit card details. More information about these specific categories of data we collect, and how we use them, is available in the corresponding section below.
Personal data we collect automatically
In addition, we receive and store certain types of personal data whenever you interact with us online. For example, we use cookies and tracking technologies to obtain personal data when the user's web browser accesses our websites or advertisements, as well as other content provided by Cosmetica Etica S.r.l. on behalf of The Body Shop brand in Italy on other websites. Users' personal data is also collected when they carry out searches, make purchases, post content, take part in competitions or surveys, or communicate with our customer service teams. The types of personal data we collect include, for example: IP address, device ID, location data, computer and connection data such as browser type and version, time zone settings, browser plug-in type and version, operating system, and purchase history, which Cosmetica Etica S.r.l. sometimes combines with similar information from other customers. From time to time, when you visit the thebodyshop.it website, we may also use software tools to measure and collect data about your session, including page response times, download errors, length of visits to certain pages, page interaction data, and methods used to leave the site. We may also collect technical data that helps us identify your device, in order to prevent fraud and for diagnostic purposes.
Personal data we collect from other sources
We collect personal data from other sources, including our trusted partnerships with third parties and, where we manage The Body Shop Italia accounts on third-party platforms, for example when you use the "Like" feature on Facebook or the +1 feature on Google+. We also receive data on the interactions of users and other visitors with our advertisements, in order to assess whether our advertisements are relevant and successful. We also collect data about you and your activities from third parties when we offer joint services or products, or from third-party data enrichment providers that enable The Body Shop to obtain additional information about the personal data we hold.
When and why do we collect special category personal data?
Certain categories of personal data, such as ethnic origin, religion, health status, sex, or biometric data, are classified as "special categories of data" and, as such, benefit from additional protection under European Union data protection legislation.
We limit the circumstances in which we collect and process data belonging to these special categories.
In certain circumstances, Cosmetica Etica S.r.l. collects data relating to your health status, such as allergies, pregnancy, or skin type, in order to send you personalised advertisements and relevant offers. This data is collected and processed by Cosmetica Etica S.r.l. only if you have given your consent. In some cases, you may have requested services or products that do not directly involve the collection of data of these special categories, but that may include your religion, your health, or other special category data. To illustrate the circumstances in which Cosmetica Etica S.r.l. collects and processes data of these special categories, we have prepared the following examples for you:
Cosmetica Etica S.r.l. collects data on skin conditions. Cookies may be set on the registration page that also collect this data. For more information on the profiling activities carried out on the thebodyshop.it website, please see the corresponding section.
Similarly, Cosmetica Etica S.r.l. collects personal data relating to consumers' allergies in order to provide them with appropriate advice on products and treatments.
How do we protect children's data?
We are aware of the importance of taking additional precautionary measures to protect the privacy and safety of children who use The Body Shop's products and services in Italy.
The thebodyshop.it website is designed to be used by adults. Where one of our websites is aimed at a younger audience, we will require the consent of a parent or legal guardian before collecting personal data, where required by applicable laws and regulations.
If you are a minor, that is, if you are of an age for which the consent of a parent or guardian is required, you must read the terms of this privacy notice together with your parents or guardians to make sure you have understood and accepted everything. If we discover that we have collected personal data from a minor without the consent of a parent or legal guardian, and such consent would have been required, we will delete that personal data as soon as possible. Access to certain parts of the thebodyshop.it website and/or the right to receive prizes, samples, or other free gifts is limited to users who have reached the age of majority.
We occasionally use your personal data to carry out age checks and enforce these age limits.
For what purposes do we use your data?
We collect, process, and disclose your personal data only for specific and limited purposes. For example, to process your payments, assess and manage complaints, develop and improve our products, services, communication methods and website functionality, and to offer you personalised products, targeted communications and advertising, as well as product recommendations.
We also create profiles by analysing information about your online behaviour while browsing, searching and purchasing, as well as your interactions with our brand communications, creating segments (groups sharing certain common characteristics) and classifying your personal data into one or more of these segments.
In addition, Cosmetica Etica S.r.l. also processes your personal data by automated means. An automated decision is a decision made solely by automated means, without any human involvement in the decision-making process relating to your personal data.
We collect, process and disclose your personal data only for the following purposes:
● To process your payments when you purchase our products, to provide you with order status, to process your requests and questions, and to assess and process any complaints;
● To process and respond to your requests, or to contact you regarding questions and/or requests;
● To develop and improve our products, services, communication methods and website functionality;
● For the purposes of competitions or promotional campaigns you have taken part in;
● To provide you with information and manage your registration and/or subscription to our newsletter or other communications;
● To manage our day-to-day business needs relating to your participation in our competitions, prize draws, promotional activities or requests;
● To authenticate the identity of people who contact us by phone, electronic means, or otherwise;
● For internal training and quality assurance purposes;
● To better understand consumers' interests, wishes and changing needs, improve our website and our current products and services, and/or develop new products and services;
● To offer you personalised products, targeted communications and advertising, as well as product recommendations.
When we collect and use your personal data for the purposes described above, or for other purposes, we will inform you before or at the time the data is collected.
Where necessary, we will ask for your consent to the processing of your personal data. Once you have consented to the processing of your personal data, you have the right to withdraw your consent at any time.
In some cases, our processing of your personal data is based on a legitimate interest. A legitimate interest may exist, for example, when you sign up for one of our brands' loyalty programmes and we use the personal data collected to carry out data analysis and improve our products and services. This basis is used only when necessary to achieve a legitimate interest, for example to help perform a contract or to optimise a service. However, it does not override your personal rights. We rely on legitimate interest only where there is no other, less invasive way of processing your personal data. We assure you that, where legitimate interest is used as a basis for processing your personal data, we will record this and you will have the right to request that information.
Profiling
Cosmetica Etica S.r.l. uses your personal data to create profiles. We create profiles by analysing information about your online behaviour while browsing, searching and making purchases, as well as your interactions with our brand communications, creating segments (groups sharing certain common characteristics) and classifying your personal data into one or more of these segments. Cosmetica Etica S.r.l. uses these segments to personalise the website and our communications with you (for example, to show relevant content when you visit our site or when we send a newsletter) and to display relevant offers and advertisements relating to The Body Shop products and services on the thebodyshop.it website and on third-party websites. In addition, segments may also be used for third-party campaigns on the thebodyshop.it website. Cosmetica Etica S.r.l. profiles your data if you have given your consent, for example if you have accepted cookie settings in your web browser or if you have subscribed to an email newsletter from one of our brands.
You can withdraw your consent at any time to prevent your personal data from being used in this way, by changing your browser settings or visiting the Manage Cookies section of our cookie notice, or by unsubscribing from the use of your email address privacy@thebodyshop.it if you registered on one of our websites or for a marketing newsletter.
For example:
Cosmetica Etica S.r.l. collects data with your consent from:
● our websites, regarding what you view and how you interact with our content;
● our digital on-screen advertising that we deliver to you on social media platforms and on other publishers' websites;
● forms in which you enter your online interests and send them to us.
We also track the products you buy when you click on one of our on-screen advertisements and subsequently purchase something from our business partners' offering.
If you have registered to receive emails or SMS messages from us, we monitor whether you open, read or click on the content to see what interests you, so that we can offer you more content that we believe you may like.
We use this data to build a profile based on your preferences. This way, on your next visit, we can tailor our online content to what we believe is most likely to interest you.
Based on this profile information, we may also show you advertisements that we believe you may like and would want to see when viewing content from us or from our network of publishers with whom we openly collaborate. Occasionally, with your consent, we may use your current location to show you advertisements relating to offers or events taking place near you that we believe may interest you.
We may also use information you have provided to selected third parties, and that you have agreed to share, such as your age, gender, life stage, lifestyle and broader interests, to identify people we believe have interests similar to yours and who might be interested in similar advertising.
Automated decision-making
In certain circumstances, Cosmetica Etica S.r.l. processes your personal data by automated means. An automated decision is a decision made solely by automated means, without any human involvement in the decision-making process relating to your personal data.
We do not make decisions that have a significant impact on you based solely on automated decision-making. If we do, we will inform you and provide you with clear information that our decision is based on an automated process, also indicating the legal basis on which it is founded. For example, Cosmetica Etica S.r.l. processes your personal data using automated means only where necessary for the conclusion or performance of a contract with you, or if you have given your prior explicit consent.
You have the right not to be subject to a decision based solely on automated processing that produces legal effects or other significant effects concerning you. In particular, you have the right to:
● request human intervention;
● express your point of view;
● obtain an explanation of the decision reached after such an assessment;
● challenge the decision.
Who do we share your data with?
Cosmetica Etica S.r.l. shares users' personal data internally and with selected third parties. We share users' personal data, for example, with third-party service providers, other third parties, and in the event of business transfers or disclosures required by law.
Third-party service providers
In order to fulfil your requests, answer your questions, process your orders, redeem vouchers, provide you with samples, allow you to take part in prize competitions, or to offer you numerous other features, services and materials on our websites, we transmit your personal data to third-party service providers who perform functions on our behalf, such as companies that host or manage the thebodyshop.it website, process payments, analyse data, provide customer support, provide postal or delivery services, and sponsors or other third parties who take part in or manage our offers. They have access to the personal data necessary to carry out their activities, but may not use it for other purposes. They must also process such personal data in accordance with this privacy notice and as permitted by applicable data protection laws and regulations.
Other third parties
Your personal data is also used by us, or transmitted to our sponsors, advertisers, advertising networks, ad servers, social media networks and analytics companies, or other third parties, in connection with marketing, offers, data enrichment and other offerings, as well as product information.
Business transfers
Your personal data will be used by us for internal reasons, primarily for business and operational purposes. As part of the further development of our business, we may sell or acquire assets, subsidiaries, or business divisions. In such transactions, users' personal data is generally included among the business assets transferred, but remains subject to the commitments made in a prior privacy notice (unless, of course, the user gives their consent). In the event that we, our business, or substantially all or part of our assets or activities relating to the thebodyshop.it website are acquired by another company, your personal data will be transferred to that company as part of the due diligence process and will be transferred to that company as one of the assets. Even in the event that bankruptcy or reorganisation proceedings are initiated by or against us, all such personal data will be treated as one of our assets and may therefore be sold or transferred to third parties.
Legal disclosure
We may transfer and disclose your personal data to third parties in order to comply with a legal obligation;
● if we believe in good faith that this is required by applicable law;
● at the request of an authority conducting an investigation;
● to verify or enforce our "Terms of Use" or other applicable policies;
● to detect or protect against fraud or other technical or security vulnerabilities;
● to respond to an emergency;
● or otherwise to protect the rights, property, safety or wellbeing of third parties, visitors to the thebodyshop.it website, or the public.
International data transfers
Cosmetica Etica S.r.l. shares personal data internally or with third parties for the purposes described in this privacy notice.
Cosmetica Etica S.r.l. transfers personal data collected within the European Economic Area (EEA) abroad only in the following circumstances:
● to follow your instructions;
● to comply with a legal obligation;
● to work with our agents and advisers whom we use to assist us in managing our business and providing our services.
When we transfer personal data outside the EEA, Cosmetica Etica S.r.l. ensures that such data is protected in the same way as it would be if used within the EEA. We adopt one of the following safeguards:
● transfer to a country outside the EEA whose data protection legislation guarantees a level of protection equivalent to that within the EEA;
● entering into a contract with the foreign third party establishing that the personal data must be protected to the same standards applicable within the EEA;
● transfer of personal data to organisations that are part of specific arrangements relating to cross-border data transfers with the European Union (for example, the Privacy Shield, a framework that sets data protection standards for data sent between the United States and European countries).
How do we protect your personal data?
Cosmetica Etica S.r.l. takes the security of your personal data very seriously. We do everything possible to protect your personal data from misuse, interference, loss, unauthorised access, alteration or disclosure.
Our measures include implementing appropriate access controls, investing in the latest data security features to protect the IT environments we use, and ensuring that, where possible, personal data is encrypted, pseudonymised and anonymised.
Access to your personal data is granted only to our employees and representatives on a "need to know" basis and is subject to strict contractual confidentiality obligations when processing is carried out by third parties.
How long do we keep your personal data?
We will retain your personal data for as long as necessary for the purpose for which it is processed. For example, if you purchase something from us online, we will retain data relating to your purchase in order to perform the contract you have entered into with us and, subsequently, we will retain your personal data for a period of time that allows us to process or respond to complaints, requests or concerns relating to the purchase.
Your data may also be retained to allow us to continue improving your experience with us and to ensure that you receive the loyalty rewards to which you are entitled.
We retain the identifiable data we collect directly for targeting purposes for as long as possible. We subsequently use means to permanently delete it.
We will actively review the personal data in our possession and securely delete it or, in some cases, anonymise it, where there is no legal, business, or consumer reason to continue retaining it.
What are your rights?
Your rights in relation to the processing of your personal data. You can exercise these rights at any time. Below you will find an overview of these rights, along with an explanation of what they mean for you. You can exercise your rights by emailing us at privacy@thebodyshop.it.
The right to be informed
You have the right to receive clear, transparent and easily understandable information about how we use your personal data and about the rights you have in this regard. For this reason, we provide you with this information as part of this notice.
Right of access and rectification
You have the right to access your personal data at any time, and to correct or update it at any time. We are aware of the importance of this and, if you wish to exercise any of your rights, please contact us.
Right to data portability
The personal data you have provided to us is portable. This means that, in certain circumstances, it can be moved, copied or transferred electronically.
Right to erasure
In certain circumstances, you have the right to request the deletion of your data. If you would like us to delete the personal data we hold about you, please let us know and we will take the necessary steps to fulfil your request in accordance with legal requirements. If the personal data we have collected is no longer needed for any purpose and we are not legally required to retain it, we will do everything possible to delete, destroy, or permanently render it unidentifiable.
The right to restrict processing
In certain circumstances, you have the right to restrict the processing of your personal data.
Right to object
In certain circumstances, you have the right to object to certain types of processing, including processing for direct marketing purposes (for example, receiving emails from us informing you of various potential opportunities, or being contacted by us for this purpose).
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint directly with a supervisory authority regarding the way we process your personal data.
Right to withdraw consent
If you have given us your consent to something we do with your personal data (that is, we rely on your consent as the legal basis for processing your personal data), you have the right to withdraw your consent at any time (this does not, however, mean that anything we did with your personal data with your consent up until that point was unlawful). You can withdraw your consent to the processing of your personal data at any time by contacting us using the details provided below.
Rights relating to automated decision-making
You have the right not to be subject to a decision based solely on automated processing that produces legal effects or other significant effects concerning you. In particular, you have the right to:
● request human intervention;
● express your point of view;
● obtain an explanation of the decision reached after such an assessment; and
● challenge the decision.
For further information and advice about your rights, please contact the data protection authority in your country of residence.
How can I contact Cosmetica Etica S.r.l.?
As a first point of contact, please email privacy@thebodyshop.it.
If you have questions or concerns about Cosmetica Etica S.r.l.'s privacy notice or its data processing, or if you would like to lodge a complaint about a possible breach of local data protection laws, you can contact Cosmetica Etica S.r.l. at the following address: Corso di Porta Romana, 6 – 20122 – Milan, or at the certified email (PEC) address cosmeticaetica@legalmail.it.
When we receive a data protection question or a data access request, we have a dedicated team that reviews the enquiry and works to respond to your specific requests or questions. If your request is of a more substantial nature, we may ask you for further information. All such enquiries will receive a response. If you are not satisfied with the response received, you can forward your complaint to the competent supervisory authority in your country of residence. If you ask us to, we will do our best to provide you with information about the complaint channels relevant and applicable to your situation.
How do we keep this notice up to date?
We will update this privacy notice when necessary, in order to reflect customer feedback and changes made to our products and services. When we make changes to this notice, we will update the "last updated" date at the top of this statement. If the changes are significant, we will highlight them more clearly (including, for certain services, an email notification of changes to the privacy notice). We keep previous versions of this privacy notice in an archive, so that you can consult them at any time.
We will not restrict your rights under this privacy notice without your consent.
Additional privacy terms or notices
In addition to this privacy notice, there may be specific campaigns or promotions governed by additional privacy terms or notices. We recommend reading such additional terms or notices before taking part in such campaigns or promotions, as you will be required to comply with them if you decide to take part. All additional privacy terms, conditions or notes will be clearly highlighted.