Privacy Policy – Chaska Cosmetics

Introduction

CHASKA Cosmetics is an e-commerce company specializing in pharmaceuticals, food supplements, personal care, and cosmetics. It processes the personal data of Internet users, particularly those who visit its websites.

CHASKA Cosmetics is committed to protecting the privacy and rights of individuals and is therefore committed to applying specific, protective rules of conduct—in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”)—that ensure safe, controlled, and confidential online browsing.

This privacy policy may change over time, including as a result of additions and amendments to relevant legislation and regulations, or due to our institutional decisions.

Therefore, we invite you to periodically consult this section of our website. Thank you, therefore, for reviewing the rules our company has established for collecting and processing personal data and for consistently providing a satisfactory service to users of our websites.

This Privacy Policy applies exclusively to CHASKA Cosmetics websites and not to those of other companies, organizations, associations, professionals, or any other legal entity or individual.

Basic Principles of the CHASKA Cosmetics

Privacy Policy processing (Article 4, paragraph 2, GDPR: “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction“) of personal data (Article 4, paragraph 1, GDPR: “any information relating to an identified or identifiable natural person (‘data subject‘); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychic, economic, cultural or social) exclusively for the purposes and according to the methods illustrated in the information to be provided, which is presented to the user each time they access a section of the site where the direct or indirect provision of personal data is required;
use the data voluntarily provided by the user;
use technical cookies to facilitate navigation on the site and analytical cookies for statistical purposes;
use profiling cookies to send users personalized messages and banners based on their web browsing, both on and off the site;
transmit data to third parties (data processors – Article 4, paragraph 8, GDPR: “the natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller”) exclusively for purposes instrumental to what we have expressly requested and carefully selected;
Communicate data to third parties for activities related to the matters of interest or when required by law, regulation, or EU legislation;
Respond to requests for access to personal data, rectification or erasure of the same, restriction of processing, or the right to object to their processing for legitimate reasons. Ensure the exercise of the right to data portability, as well as object to the processing of data for the purposes of informative and promotional communications regarding our commercial initiatives, offers and discounts, new products and catalogs, surveys, and research, and inform you of the possibility of lodging a complaint with the supervisory authority;
Ensure correct and lawful processing of your data, safeguarding your privacy, as well as implementing appropriate security measures to protect the confidentiality, integrity, and availability of the data.

Purpose of data processing and methods of processing – legal basis of processing – data collection criteria

Purpose of Data Processing

As further explained in the sections that allow you to subscribe to our website’s reserved services by providing your personal data, the requested data is used to respond to requests expressly made by the user. Specifically, all data collection and subsequent processing activities are aimed at pursuing the institutional and commercial objectives of CHASKA Cosmetics, specifically:

processing registration requests and activating user profiles, providing services reserved for registered users (including managing any orders placed and any product reviews), including managing the user’s profile, and providing service communications related to the website’s operation and additional features/services.
processing orders at all stages, from order collection to delivery, and managing payments and any debt collection, as well as allowing customers to leave product reviews.
send the requested newsletter.
respond to requests made through contacts spontaneously established by the user, such as requests for notification when an unavailable product is back in stock or for information on our products
Direct the user to our social media channels
Comply with administrative and other mandatory regulations under applicable national law or European Union decisions
Conduct direct marketing activities relating to our products and services (promotional communications, direct sales offers, surveys and market research, product catalog updates)
Conduct direct marketing activities with profiling related to direct marketing based on the preferences and behaviors or purchasing and consumption tendencies, interests of the interested party, or in combination with other information obtained from our own or third-party archives
dissemination of images in video and photographic format, testimonials and statements, including those released through the Data Controller’s social media channels, for the sole purpose of disseminating them to the public – in its own informational, informative, advertorial material, and/or website or during public events or in media such as print and TV and other digital and non-public dissemination channels – to publicize and document commercial initiatives and relationships, reviews, projects and institutional activities, as well as to create a historical archive of CHASKA Cosmetics‘ commercial initiatives to be used during events of special importance (e.g., anniversaries of the Data Controller’s foundation) to represent the developments of CHASKA Cosmetics‘ commercial and sales activities.
statistical processing of customer characteristics and their orders, as well as registered users, users who request information, or users of services provided through the site.
The resulting statistical reports may also be disseminated through CHASKA Cosmetics‘ communication channels, such as its website, at events and conferences, in printed and online illustrative materials, or digital media, in print (e.g., newspapers and magazines) and through media (e.g., TV). Similarly, aggregated and anonymous reports may be made available to third-party companies, entities, and organizations for their anonymous studies and research in the sector in which the Data Controller operates.
exercise, assert, or defend a right of their own or of a third party in court.

Data processing methods

Personal data is processed by the Data Controller using both paper-based and electronic and telematic means and is stored within its IT system.
Appropriate security measures are implemented to prevent the loss or alteration of data—even accidental—unlawful or improper use, and unauthorized access.
All processing operations carried out on this site will be carried out using procedures related to the purposes for which the data was collected and in compliance with current security regulations, for the purposes specified from time to time in the information to be provided pursuant to Article 13 of the GDPR.
To perform profiling activities related to direct marketing as per point 8, “Purpose of processing,” CHASKA Cosmetics will analyze, using electronic procedures, customer preferences and purchasing and consumption behaviors, or customer preferences and interests (e.g., purchase frequency, amount spent, offer subscription campaign), or the user’s characteristics, propensities, interests, and preferences in general. Therefore, processing will involve selecting stored personal information so that the user can be contacted with offers and purchase proposals, surveys, and research of interest and in line with their preferences, avoiding disturbed by unwanted contact.
For direct marketing activities—with or without profiling—as per points 7 and 8 of the “Purpose of Processing” section, the Data Controller uses the contact details provided by the data subject and the contact methods they primarily use.
The telephone number provided by the data subject will be used for the purposes set out in points 7 and 8, “Purpose of Processing,” only subject to the application of the provisions of Law 05/2018. If registered in the “Public Register of Objections,” the telephone number will not be used for such purposes, unless subsequent consent is given directly to CHASKA Cosmetics for such contact.
The contacts referred to in points 7 and 8 of the “Purpose of Processing” section may be made using traditional communication tools (e.g., postal mail, landline or mobile phone with operator) or electronic means (e.g., email, SMS). The purposes referred to in point 11, “Purpose of Processing” may involve the partial or total reprocessing, as well as the matching and interconnection of creative works with other materials already available to the Data Controller.
Health data will be processed exclusively to fulfill the user’s request and not for direct marketing activities, with or without profiling.

Legal basis for processing

The legal basis for processing depends on the purpose of the processing itself. The different legal bases applied for the individual processing purposes pursued by CHASKA Cosmetics are listed below.

For the purposes referred to in points 1. to 5. of the “Purposes of data processing,” the legal basis is Article 6, paragraph 1, letter b), GDPR, since the processing is aimed at fulfilling pre-contractual or contractual obligations to which the data subject is a party. Specifically, to allow the user to subscribe to the services referred to therein and, therefore, to fulfill a request expressly made by the user or of specific interest to him or her. An additional legal basis is the consent referred to in Article 9, paragraph 2, letter a), GDPR, where the service of interest (e.g., the purchase of medicines) involves the collection of health-related data (e.g., inferred from the product purchased or the request made or the communication of adverse effects resulting from use of the product).
For the purposes referred to in point 6., “Purposes of data processing,” the legal basis is Article 6, paragraph 1, letter b), GDPR. 6, paragraph 1, letter c), GDPR since the processing is aimed at fulfilling legal obligations to which the Data Controller is subject.
For the purposes referred to in point 7. “Purpose of data processing”, the legal basis is the “legitimate interest” (Article 6, paragraph 1, letter f), GDPR, recital C47, GDPR and Opinion 09 April 2014, no. 6 of Working Party 29, paragraph III.3.1.) of CHASKA Cosmetics in maintaining the relationship voluntarily established by the data subject who, through his or her action (registration on the site, purchase or request for information) has expressed his or her approval of our commercial activity, and to inform him or her about our marketing and direct sales activities, to publicize new products and brands, product catalog updates, to present offers, discounts, promotions, to involve him or her in surveys and research on the level of satisfaction with his or her experience with CHASKA Cosmetics, allowing the data subject to learn about these opportunities and to decide, if desired, to place orders or carry out other actions. This is counterbalanced by the person’s expectations to receive information from the Data Controller regarding products and services that are of interest to him and with which he has already voluntarily established a relationship, through his own action.
For the purposes referred to in point 8., “Purpose of data processing,” the legal basis is the data subject’s consent (Article 6, paragraph 1, letter a), GDPR).
The promotional email communications referred to in points 7 and 8., “Purpose of data processing,” conducted with customers are supported by the legal basis set forth in Article 130, paragraph 4, of Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, which permits the sending of emails for the direct sale of products similar to those purchased to the email address provided during the purchase process. The customer has the right to object to such emails at any time. Similarly, this applies to the sending of promotions and direct sales proposals to the customer’s postal address pursuant to the provisions of the Guarantor’s provision on “Simplifications of certain obligations in the public and private sectors with respect to processing for administrative and accounting purposes” of 19 June 2008.
For the purposes referred to in points 9 and 10, “Purpose of data processing,” the legal basis for processing is the data subject’s consent (Article 6, paragraph 1, letter a), GDPR).
For the purposes referred to in point 11, “Purpose of data processing,” the legal basis is the data subject’s consent (Article 6, paragraph 1, letter a), GDPR). Additionally, the legal basis is the “legitimate interest” (Article 6, paragraph 1, letter f), GDPR, Recital C47, GDPR, and Opinion No. 6 of April 9, 2014, of Working Party 29, paragraph III.3.1.) of CHASKA Cosmetics in disseminating information and experiences of current and potential customers in their relationships with CHASKA Cosmetics and in promoting its commercial activities and their development. Based on the same legal bases indicated above, CHASKA Cosmetics will use the content to create a historical archive of its commercial and institutional activities.
CHASKA Cosmetics guarantees that testimonials, statements, and images will be disclosed only for purposes permitted by applicable law, and with respect for the decorum, dignity, and reputation of the individuals involved. CHASKA Cosmetics cannot be held responsible for any harmful consequences resulting from the dissemination of testimonials and statements, sounds, images, and/or photographs attributable to violations committed by third parties outside of CHASKA Cosmetics‘ control. Interested parties acknowledge that no compensation is due for the use and dissemination of the testimonials, images, and audio in question. It is also expressly understood and accepted that the aforementioned images and audio/video recordings are and will remain the exclusive property of CHASKA Cosmetics.

Data Collection Criteria

The forms to be filled out include both data that is strictly necessary to participate in the requested activity, the failure to provide which will prevent the request from being processed, and optional data. Mandatory data is usually marked with an asterisk. Therefore, the user is free to provide the personal data contained in the request forms or otherwise indicated in contacts with CHASKA Cosmetics to request information or for the other purposes listed above. In these cases where data provision is mandatory, failure to provide such data may make it impossible to obtain what has been requested. The need to request data as mandatory for participation in individual initiatives or to process orders or make requests has been considered in compliance with the provisions of Article 25 of the GDPR (“Data Protection by Design and by Default”), which require the prior assessment of appropriate technical and organizational measures, such as “pseudonymization.”
(Article 4, paragraph 5, GDPR: “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person“), aimed at effectively implementing data protection principles, such as data minimization, and integrating the necessary safeguards into the processing in order to meet the requirements of the GDPR and protect the rights of data subjects. Furthermore, CHASKA Cosmetics has implemented appropriate technical and organizational measures to ensure that, by default, only personal data necessary for the specific purpose of the processing resulting from the initiative or service (e.g., order, website registration) to which the data subject has voluntarily subscribed are processed.

Criteria used to define data retention periods

The data will be retained in our archives (Article 4, paragraph 6, GDPR: “any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis“) according to criteria that vary depending on the data category, the nature of the processing, and the purposes of the processing.
The criteria or specific retention period are described in the information to be provided pursuant to Article 13, GDPR, when providing personal data.

In principle, CHASKA Cosmetics applies the following criteria to establish data retention:

For the purposes referred to in point 1. “Purpose of data processing,” the data retention period is determined based on the time required to complete registration and for as long as the user is registered and uses the reserved services. Data will also be deleted if the user decides to close their profile.
User data (and their profile) will be deleted if improper behavior is detected by the user while browsing the site or in actions performed through it.
In this case, the Data Controller will inform the competent authorities and disclose the user’s data.
For the purposes referred to in point 2. “Source and purpose of processing,” the data retention period is determined based on the time required to fulfill the order or pre-contractual obligations, at all stages, from order acceptance to delivery (e.g., payments and reminders, refunds, returns, communications on order progress, issuance of purchase receipts and delivery notes), as well as to manage any reviews left.
For the purposes referred to in point 3. “Purpose of data processing,” the data will be retained for as long as the user is interested in the newsletter service, maintaining their subscription. Subsequently, they will be deleted from our archives.
For the purposes set out in point 4, “Purpose of data processing,” the data will be retained for the time necessary to fully process the request made by the data subject. This may be longer if the request is not satisfied upon initial contact and requires further exchanges of information between the data subject and the Data Controller, or if the data subject intends to ask further questions related to the initial request.
For the purposes set out in point 5., “Purpose of data processing,” all data of users who access CHASKA Cosmetics‘ social media pages are retained in the archives for the period necessary to maintain contact established through this channel by the user, and voluntarily extended over time based on the user’s interest in maintaining their profile on the Data Controller’s pages.
For the purposes set out in point 6., “Purpose of processing,” the data retention period is determined based on individual national and EU regulations that impose legal obligations to which the Data Controller is subject. Therefore, for administrative, tax, and accounting purposes, the data is retained for a period of 10 (ten) years.
For the purposes set out in point 7. “Purpose of data processing,” the data is retained in our archives for the period necessary to maintain the ongoing relationship established with the individual and to inform them of our commercial activities, allowing CHASKA Cosmetics to legitimately continue its marketing and direct sales activities for as long as the individual is deemed to remain interested in our products and services, especially if they are registered or a regular customer. As a guideline, the data of said data subjects will be retained for a period of two years from the last action taken (e.g., unsubscription or last order placed). This retention period will obviously be interrupted when the individual indicates their wish to no longer receive further information and offers from CHASKA Cosmetics, communicating this in the manner described in the chapter “Rights of data subjects with respect to their data.” CHASKA Cosmetics will adopt appropriate technical and organizational measures to no longer contact the individual.
For the purposes set out in point 8., “Purpose of data processing,” the data will be retained in our archives as long as the individual’s profile matches the personalized contacts created by cross-referencing the information available to us and, therefore, as long as CHASKA Cosmetics continues its sales and marketing activities with products, offers, promotions, research, and surveys deemed to be of interest to the individual because they reflect their characteristics and behaviors and are, therefore, specifically relevant to them. In principle, data relating to the behavioral characteristics of data subjects will be retained for a period of one year from the date of their last action. Retention will cease, even before the retention period described here, if you object at any time to the processing of your personal data for profiling purposes related to direct marketing, in accordance with the procedures described in the section “Rights of Data Subjects with Respect to Their Data.” CHASKA Cosmetics will adopt appropriate technical and organizational measures to no longer contact the individual.
For the purposes referred to in point 9., “Purpose of data processing,” the data will be retained in our archives based on the processing purposes performed by CHASKA Cosmetics as an independent data controller for the performance of promotional activities on third-party products and services for as long as the user is deemed to remain interested in the third-party services and products. This period is reduced if the user objects as explained in the “Rights of data subjects with respect to their data” section. The Data Controller will adopt appropriate technical and organizational measures to no longer contact the individual.
For the purposes referred to in point 10., “Purpose of data processing,” the data is retained in our archives for the period necessary to prepare archives to be communicated to third parties. Naturally, the Data Controller will retain in its archives the data communicated for its own purposes listed in the “Purpose of data processing” section.
For the purposes referred to in point 11., “Purpose of data processing”, the data will be retained for as long as the testimonials in image and declarative format are deemed relevant to publicizing and representing our commercial initiatives and the development of our business to the public, and are relevant to the Data Controller’s institutional objectives.
For further clarification, images, sounds, and testimonials will be retained in our archives for as long as the communication activity and the context of the recordings are objectively significant to representing institutional events and our commercial activity and its development. Subsequently, they will be deleted by destruction and will no longer be reconstructable or traceable to the individuals involved. Although with a longer time frame, the content referenced herein will be retained for training purposes and for the use of a historical archive to represent the evolution of CHASKA Cosmetics‘ commercial activity and successful expansion in the target market.

After the periods specified above, the identifying data will be transformed into anonymous form and used only for statistical reports that do not allow the identification of the individual but are useful for adapting the services, product catalog, and promotional and commercial initiatives of CHASKA Cosmetics. The personal data (identifying the individual) will therefore be destroyed, unless otherwise ordered by supervisory authorities, law enforcement agencies, or the judiciary, or to exercise, assert, or defend the rights of CHASKA Cosmetics or a third party in court, as described above.

Data Processing Location

The processing operations related to this site’s web services take place at the headquarters of CHASKA Cosmetics and are handled by authorized personnel.

If necessary, personal data collected through the site may be processed by personnel of third-party companies that maintain the site’s technological components at their own offices, as well as by other parties located primarily within the European Union, carefully selected and appointed as data processors pursuant to Article 28 of the GDPR.

Transfer of personal data to third countries or international organizations

The processing, including storage, of personal data takes place on servers owned by the Data Controller and/or third-party companies duly appointed as data processors, located within the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to transfer the processing, including storage, to countries outside the EU. In this case, the Data Controller hereby ensures that the data transfer will be carried out in compliance with applicable legal provisions, stipulating – where necessary – agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses required by the European Commission Decision of 05/02/2010 (Articles 45, 46, 47, and 49, GDPR).

Data Controller

CHASKA Cosmetics, email infochaskacosmetics@gmail.com, is the data controller (Article 4, paragraph 7, GDPR: “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”), pursuant to and for the purposes of the GDPR. It decides how and for what reasons, as communicated in the information to be provided to data subjects, to collect and use the personal data provided by the user, as well as the tools to process it and the security procedures to implement to ensure its integrity, confidentiality, and availability, subject to the obligations and responsibilities set forth in Article 24, GDPR.

Data processors and persons authorized to process

Your personal data may be processed, either manually or electronically or electronically, either directly by CHASKA Cosmetics or by third parties who, with experience, technical skills, professionalism and reliability, carry out processing operations on our behalf, respecting the security and confidentiality of the information and constantly controlled by us in their work.
The data controller is “the natural or legal person, the public authority, the service or other body that processes personal data on behalf of the data controller” (art. 4, paragraph 8, GDPR) and is contractually bound by CHASKA Cosmetics, with the definition of the operating limits on the data, the data it can process and the categories of interested parties to which they are referred, the nature and purpose of the processing, the data retention limits, the obligations and rights that CHASKA Cosmetics has towards the controller, and with the prohibition of using it different from the assignment entrusted.

It may, if authorized, formally, in a general or specific manner, by CHASKA Cosmetics make use of other managers, who are contractually bound by the initial manager appointed directly by CHASKA Cosmetics: violations committed by such other managers fall under the responsibility of the initial manager and not of CHASKA Cosmetics.

The complete and updated list of data processors (and, if applicable, of the controllers appointed by the original controller, subject to our authorization) can be requested at infochaskacosmetics@gmail.com (alternatively, by writing to CHASKA Cosmetics).

The personal data collected will be made available to persons authorized by CHASKA Cosmetics pursuant to art. 29, GDPR that carry out processing activities essential for the pursuit of the purposes indicated above; the categories of persons authorized to process are, from time to time, specified in the information to be provided pursuant to art. 13, GDPR. In general, these are the people in prose of providing specific services, administration, management of information services, relations with actual and potential customers, organizers of promotional and advertising campaigns, commercial and institutional activities.

Scope of communication and dissemination of data

User data may be communicated to third parties for various purposes. To be precise, the following lists the various cases that involve the communication of data to third parties.

For purposes related to the provision of the service to which the user has subscribed, the data may be made available to third parties, who will act as independent data controllers, and who provide instrumental services to satisfy the user’s request (for example, issuing credit cards to manage transactions related to orders). This communication is allowed, as reported in “Legal basis of processing”, without the consent of the interested party (art. 6, paragraph 1, letter b), GDPR).
The data must be communicated to third parties, independent data controllers, as necessary to comply with legal or regulations. This communication is allowed, as reported in “Legal basis of the processing”, without the consent of the interested party (art. 6, paragraph 1, letter c), GDPR).
The data may also be communicated to control bodies, police forces and the judiciary to assert or defend their right or the right of a third party in court. Such communication is allowed without the consent of the interested party pursuant to art. 6, paragraph 1, letter f), GDPR, that is to say by virtue of the legitimate interest of the Data Controller or a third party to safeguard their rights and fundamental freedoms provided that those of the interested party do not prevail.
It is possible that customers’ personal data will be disclosed to third parties for their independent processing for marketing purposes, but only if the person has given his consent.
The possibility that personal data will be disseminated is not excluded: this can happen if the service to which the user has subscribed contemplates such processing: for example, they may be disseminated through our social channels, even in image format, if the interested party intends to testify to his experience with CHASKA Cosmetics, disseminate his reviews on the products or wants to relate to CHASKA Cosmetics through social channels. All these cases of data dissemination will occur with the prior consent of the interested party or, even without the consent, where the data have been made manifestly public by the interested party.

Other third parties who collaborated with CHASKA Cosmetics

CHASKA Cosmetics, in the context of its sales promotion activities and presentation of its offers and range of catalog products, as well as its institutional commercial activity in general, as well as to improve the services provided to people who have relations with CHASKA Cosmetics or otherwise interested in the products marketed by us, may contact third-party services that collaborate with and receive from CHASKA Cosmetics and data held in its archives.

Here it is clarified that these transmissions of information and data always take place in an anonymized manner or with “pseudonymization” techniques (art. 4, paragraph 5, GDPR (“the processing of personal data in such a way that personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is stored separately and subject to technical and organizational measures to ensure that such personal data are not attributed to an identified or identifiable natural person“). These anonymized data are processed, by way of example and not exhaustive by:

Facebook
Google (privacy policy http://www.google.it/intl/it/policies/privacy)
Instagram

Social media

The data of users who adhere to the social media pages of CHASKA Cosmetics (fans of the page or subscribers to a group of followers of a given promotional or incentive initiative for the sale of products or novelties in the CHASKA Cosmetics catalog), decide, with this action, to explain their intention to follow news, comments, evolutions of CHASKA Cosmetics. These users, following their behavior, may lawfully receive promotional messages regarding the topics for which they have manifestly declared, implicitly by adhering to the page, that they are interested. The sending of promotional communications regarding a specific product or range of products or an institutional or commercial activity in a broad sense, carried out by CHASKA Cosmetics to which the relative page refers must be considered lawfully conductable if, from the context and the mode of operation of the social network, also according to the information provided spontaneously by the user, it can be inferred that, unequivocally, the user has in some way expressed his willingness to receive that type of messages, with a behavioral formula that is conclusive of an implicitly declared consent. Therefore, pursuant to the provision of the Guarantor issuing guidelines on promotional activity and the fight against spam of July 04, 2013, register of measures no. 330, CHASKA Cosmetics may contact the active members of its social pages in order to send informative and promotional messages on initiatives, services, events and direct sales activities and promotions to develop its business.

When the user leaves the group or stops following the events of CHASKA Cosmetics or exercises the right to object to the processing of data for promotional purposes, then this assumption expires and, CHASKA Cosmetics intends to continue using the data for such promotional and institutional activities, will require the user’s consent.

Conversely, the contact data of the primary user will be used by CHASKA Cosmetics, subject to a request to the individual contact for an express consent adequately and previously informed, specific for the promotional messages of CHASKA Cosmetics and released in free form.

Rights of the interested parties with respect to data concerning them

You can exercise, at any time, at the e-mail infochaskacosmetics@gmail.com (alternatively, by writing to CHASKA Cosmetics), the rights pursuant to articles 15-22, GDPR in the following:

Right of access (article 15, GDPR)

The person has the right to request if his personal data is being processed and, therefore, has the right to access information concerning him and to have news about:

Purpose of the processing (e.g.: fulfillment of an order);
Categories of personal data; (e.g.: personal data, behavioral purchase data)
Recipients or the categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients of third countries or international organizations;
Where possible, the expected period of retention of personal data or, if it is not possible, the criteria used to determine that period;
Existence of the right to request the rectification or deletion of personal data or the restriction of the processing of personal data or to object to their processing;
Right to lodge a complaint with a supervisory authority;
If the data is not collected directly from the person, all available information on their origin;
Existence of an automated decision-making process, including profiling and significant information on the logic used, as well as the importance and expected consequences of such processing for the person. (e.g.: if the person has associated a profile of consumption habits by crossing the amount of spending with spending frequency and promotional campaign).

Right of rectification (Article 16, GDPR)

The person has the right to obtain the rectification of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the person has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

Right to be forgotten (Article 17, GDPR)

The person has the right to obtain the deletion of personal data concerning him and has the obligation to delete personal data without undue delay, for one of the following reasons:

The personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
The consent on which the processing is based is revoked and if there is no other legal basis for the processing (e.g. legitimate interest, regulatory or contractual obligations);
You object to the processing for marketing and profiling purposes and there is no overriding legitimate reason to proceed with the processing;
Personal data have been processed unlawfully;
Personal data must be deleted to comply with a legal obligation under Union or Member State law to which you are subject.

Right to restriction of processing (Article 18, GDPR)

The person has the right to obtain the limitation of the processing of his personal data when one of the following reasons exists:

The person disputes the accuracy of the personal data, for the period necessary to verify the accuracy of such personal data;
The processing is illegal and the person opposes the deletion of personal data and instead requests that its use be limited (e.g.: does not mean that the processing is carried out for marketing purposes but only for management and administrative purposes);
Although the data are no longer needed for the purposes of processing, the personal data are necessary for the establishment, exercise or defense of a right in court;
The person has objected to the processing if the processing is based on his legitimate interests, pending verification of the possible prevalence of his legitimate reasons over those of the person

Obligation to notify in case of rectification or deletion of personal data or limitation of processing (article 19, GDPR)

La persona ha il diritto di richiedere che la rettifica o la cancellazione dei dati o limitazione del trattamento sia comunicata da CHASKA Cosmetics ad altri soggetti cui eventualmente i dati sono stati comunicati. CHASKA Cosmetics potrebbe non ottemperare alla richiesta, se i mezzi da impiegare sono sproporzionati rispetto al diritto alla riservatezza invocato dalla persona.

Right to data portability (“data portability“) (Article 20, GDPR)

This right allows the person to receive in a structured format, commonly used and readable by an automatic device the personal data concerning him provided to a person who submits his data for processing and has the right to want to transmit such data to a subject for the use of the latter without impediments from the subject to whom he provided them. This right can be exercised in the following cases:

The treatment is based on consent or a contract or pre-contractual measures requested by the same person and, at the same time
The processing is carried out by automated means.

The person has the right to obtain that his data be transferred directly from one subject to another (from the one to whom he has provided it to the one to whom he wants it to be transmitted), if technically possible.

Right of opposition (Article 21, GDPR)

The person has the right to object to the processing of his data for the pursuit of the legitimate interest of CHASKA Cosmetics or of third parties, provided that the interests or fundamental rights and freedoms of the person that require the protection of personal data do not prevail, including for profiling purposes.

If personal data are processed for marketing purposes, the person has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is related to such marketing activity.

Automated decision-making process relating to individuals, including profiling (Article 22, GDPR)

The person shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which similarly affects his or her person significantly. In particular, it has the right to object to the profiling to which it is subjected through automated processes.

This right cannot be exercised if the decision:

Is necessary for the conclusion or execution of a contract;
It is authorised by Union or Member State law, which also specifies appropriate measures to protect the rights, freedoms and legitimate interests of the person;
Is based on explicit consent.

The person has the right to express his opinion and to challenge the decision of CHASKA Cosmetics.

Response times

As established by the GDPR, CHASKA Cosmetics will respond to the person within one month of the request, unless complex procedures must be put in place (or the requests are numerous) that do not allow this time to be met. Full feedback is allowed within three months of the request, but we are obliged to notify you within one month of the request originally transmitted (art. 12, paragraph 3, GDPR).

Complaint to the Control Authority

The interested party has the right to contact the Supervisory Authority to assert their rights.

For Italy it is the Guarantor for the Protection of Personal Data, Piazza Venezia 11, 00187 Rome (RM) – www.garanteprivacy.it, to which the complaint can be sent to the address protocollo@pec.gpdp.it, using the model (https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524&zx=e0yn0riezmmw) made available by the authority or in free form.

What are cookies and how are they used by CHASKA Cosmetics.

Cookies are information stored on the hard drive of your PC and that is sent from your browser to a Web server and that refers to your network usage. Consequently, they allow you to know the services, the sites frequented and the options that, surfing the net, have been manifested.

This information is not, therefore, provided spontaneously and directly, but leaves a trace The data collected through cookies will be used for technical needs, in order to guarantee easier, immediate and faster access to the site and its services and easier navigation for the individual user.

Profiling cookies may also be used, subject to the user’s consent, to create user profiles based on the sections of the site or the actions performed by the user himself on this site or by surfing the net.

The use of so-called session cookies (which are not stored persistently on the user’s computer and are automatically deleted when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to allow safe and efficient exploration of the site. The so-called session cookies that are used on this site avoid the use of other computer techniques potentially harmful to the confidentiality of users’ navigation and do not allow the acquisition of personal data identifying the user. Conversely, profiling cookies allow you to know the user’s web browsing and detect your interests, expressed needs and preferences and then allow you to create advertising campaigns or create profiles to better target, in a personalized way, promotional, institutional and awareness communications. In any case, you can configure the browser so that you are notified when you receive a cookie and then decide whether to accept it.

Navigation data

The computer systems and software procedures responsible for the operation of this site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified users, but which by their very nature could, through processing and associations with data held by third parties, make it possible to identify the users themselves. This data category includes the IP addresses or domain names of the computers used by users that connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (a good end, error or similar) and other parameters related to the user’s operating system and computer environment. This data is used only to obtain anonymous statistical information on the use of the site and to check its correct functioning and is deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site.

The security of your personal data

CHASKA Cosmetics adopts suitable and preventive security measures to safeguard the confidentiality, integrity, completeness and availability of your personal data. As established by the regulatory provisions governing the security of personal data, technical, logistical and organizational measures are developed that aim to prevent damage, even accidental losses, alterations, improper and unauthorized use of data concerning you.

In particular, CHASKA Cosmetics has implemented technical and organizational measures aimed at ensuring a level of security appropriate to the risk that could invalidate the rights and freedoms of individuals, including the confidentiality and confidentiality of information concerning them. Adopt security policies that include, but are not list:

The “pseudonymization” (art. 4, paragraph 5, GDPR: “the processing of personal data in such a way that personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is stored separately and subject to technical and organizational measures to ensure that such personal data is not attributed to an identified or identifiable natural person“) and/or the encryption of data
Systems that permanently safeguard the confidentiality, integrity, availability and resilience of processing systems and services
Systems designed to promptly restore the availability and access of personal data in the event of a physical or technical incident
Procedures to test, verify and regularly evaluate the effectiveness of technical and organizational measures in order to ensure the safety of the treatment.

Similar preventive security measures are adopted by third parties (data processors) to whom we have entrusted operations to process your data on our behalf.

On the other hand, CHASKA Cosmetics is not responsible for untrue information sent directly by the user (example: correctness of the e-mail address or postal delivery or other personal data), as well as information concerning him and that has been provided by a third party, even fraudulently.

Credit card and financial information required for purchases

The purchase of our products is allowed by credit / prepaid card of the VISA circuits, Mastercard, Maestro (Visa, Visa Electron, PayPal Card, Mastercard, American Express), PayPal, PostePay, bank transfer, cash on delivery. In case of payment with credit cards, CHASKA Cosmetics uses the secure payment service of the company Pay Pal which provides for the use of the SSL security protocol. The confidential credit card data (card number, expiration date holder, security code) are encrypted and thus transmitted to the payment manager. CHASKA Cosmetics therefore never has access and does not store the data of the credit card used by the user to pay for purchases, not even in the event that the user proceeds to save the credit cards, except where appropriate, limited to the data relating to the cardholder for identification of the person and verification of the legitimacy of using the credit card, to protect him from fraud.

With PayPal payment, the system communicates directly with PayPal in total security so CHASKA Cosmetics never becomes aware of the data relating to the payment method. The amount will be charged directly to the credit card (Visa, Visa Electron, Postepay, Mastercard) or prepaid card (PostePay) for which the data was entered. With each transaction, PayPal will send an email confirming the transaction. In case of cancellation, the amount will be refunded to the PayPal account or credit/prepaid card.

Finally, in general, CHASKA Cosmetics assumes no responsibility with reference to unauthorized or fraudulent uses by third parties of the information relating to the tools used for the transaction necessary for the payment of orders.