Data Protection and Privacy Notice pursuant to Articles 13 and 14 of Regulation (EU)

This Privacy Notice sets out clearly and transparently how AKOSS COSMETICS SRL, owner of the brand M’AMOUR DE BIO, collects, uses, stores and protects the personal data of users who visit the website, make online purchases, submit enquiries or interact with our digital services. The processing of personal data is conducted in accordance with the principles of law, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality.

1. Scope

This Privacy Notice applies to all processing of personal data carried out through the website www.mamourdebio.com and any associated digital services.

It covers, in particular, data collected when browsing the website, creating a customer account, placing an order, subscribing to the newsletter, submitting a customer service enquiry, or interacting with the brand’s communication and marketing tools.

2. Categories of Data Processed

Depending on the circumstances, the Data Controller may process identification and contact data, data relating to orders, payments, deliveries, returns and refunds, customer service request data, technical browsing data, marketing preferences, and data collected via cookies or similar tools, as further described in the Cookie Policy.

As a general rule, the website is not intended for the deliberate collection of personal data from minors. Products are intended for purchase by adults.

3. Sources of Data

Data may be collected directly from the individual concerned, for example when completing a form, placing an order or contacting customer services.

Certain data may also be collected automatically during browsing, or may be received from third-party service providers involved in the technical management of the website, payment processing or logistics, to the extent strictly necessary for the performance of the contractual relationship or the provision of the requested service.

4. Purposes of Processing Data and Legal Basis

Personal data is processed to enable browsing and to ensure the secure and proper functioning of the website; to manage and complete orders; to provide customer support; to comply with civil, tax, administrative and accounting laws; to send commercial communications, newsletters and promotional content, subject to consent where required; to analyse and improve the browsing experience; and to establish, exercise or defend the rights of the Data Controller.

Depending on the circumstances, the legal basis for processing your data will be one or more of the following: the performance of a contract or pre-contractual steps; compliance with a legal obligation; your consent; or the legitimate interests of the Data Controller, where permitted by law.

5. Nature and Provision of Data

The provision of data marked as mandatory is necessary to enable access to certain services, the proper management of orders, the delivery of products, invoicing and the handling of user requests.

The provision of data for marketing purposes is optional. Declining to give consent does not affect the ability to make purchases or receive assistance.

6. Processing Methods and Security Measures

Personal data is processed using electronic, digital and, where necessary, paper-based means, in accordance with the purposes set out above and in a manner designed to ensure security, confidentiality and integrity.

The Data Controller implements technical and organisational measures appropriate to the level of risk, aimed at preventing unauthorised access, loss, alteration, disclosure or destruction of personal data.

7. Recipients of Data

Personal data may be disclosed, to the extent relevant to the purpose, to authorised internal staff, IT and hosting service providers, payment service providers, logistics operators and couriers, administrative, tax or legal advisors, and to parties supporting the Data Controller in the management of the website, customer care, CRM or customer communications.

These parties may act as independent data controllers in their own right or, where applicable, as data processors appointed in accordance with Article 28 of the GDPR.

8. Transfers of Data to Non-EEA Countries

Where data is processed by providers located outside the European Economic Area for technical or organisational reasons, the Data Controller will ensure that such transfers are carried out in compliance with applicable law and on the basis of appropriate safeguards, including adequacy decisions, standard contractual clauses or other instruments recognised under European law.

9. Retention Periods

Personal data is retained for no longer than is necessary for the purposes for which it was collected, having regard to legal obligations, administrative and accounting requirements, the need to manage any disputes, and the principle of data minimisation.

Data relating to orders and the contractual relationship is retained for the duration of the contract and for such further period as may be required by applicable law. Data processed for marketing purposes is retained until consent is withdrawn or an objection is raised, subject to any longer period permitted by law.

10. Rights of the Data Subject

The data subject may exercise, in the cases and within the limits set out in Articles 15–22 of the GDPR, rights of access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent.

The data subject also has the right to make a complaint with the competent supervisory authority, and to obtain clear information regarding the processing of their personal data.

11. Right to Make a Complaint with the Supervisory Authority

Where a data subject considers that the processing of their personal data infringes the law, they have the right to make a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), without prejudice to any other administrative or judicial remedy available under the law.

12. Cookies and Tracking Tools

The website uses cookies and other tracking tools as described in the Cookie Policy. Strictly necessary cookies do not require user consent; non-technical cookies, analytics cookies not classified as technical cookies, and profiling cookies, are used only in the cases and manner permitted by applicable law.

13. Links to Third-Party Websites

The website may contain links to third-party websites, platforms or services. The Data Controller is not responsible for their respective privacy notices or for the manner in which third-parties process personal data. Users are therefore encouraged to consult the privacy notices of any third-party websites they visit.

14. Minors

The website and its related purchasing services are intended for adult users. The Data Controller does not knowingly collect personal data from minors in the course of its e-commerce activities and, should it become aware of any inadvertent processing carried out without a valid legal basis, it will proceed to delete such data without undue delay.

15. Amendments to this Notice

This Privacy Notice may be updated at any time to reflect changes in legislation or legal interpretation, updates to digital services or organisational changes within the Data Controller. The updated version will be made available on the website, indicating the relevant revision date.

Annex — Contact Details

To exercise any of the rights set out in this Notice, please contact the Data Controller at support@mamourdebio.com or at the registered office address listed above. Including the nature of your request in the subject line of your message will help ensure it is handled promptly and effectively.