Privacy policy
Privacy Policy
Last updated: 7 September 2026
1. Data controller
The Data Controller of the personal data collected through the Ischia Beauty website and online store is:
Ischia Beauty Officine Termali s.r.l.
Via Michele Mazzella, 94
80077 Ischia (NA)
Italy
VAT No. (P. IVA): 09454951212
Tax Code (Codice Fiscale): 09454951212
REA (Economic and Administrative Index) No.: NA-1033466
Email: info@ischiabeauty.com
Telephone: +39 081 99 69 75
Mobile: +39 351 013 4647
This Privacy Policy describes how personal data is collected and processed when you visit the website, use its features, create an account, make a purchase, subscribe to marketing communications, use the Store Locator or communicate with Ischia Beauty.
The website and the online store are built and operated through the Shopify platform.
2. What is meant by personal data
“Personal data” means any information relating to an identified or identifiable natural person.
Data that has been anonymised in such a way that the data subject is no longer identifiable does not fall within the scope of this Privacy Policy.
3. Categories of data processed
Depending on how you interact with the website, Ischia Beauty may process the following categories of personal data.
Identification and contact data
For example:
- first name and surname;
- email address;
- telephone number;
- residential or delivery address;
- billing address.
Data relating to orders and transactions
For example:
- products purchased;
- products returned;
- amounts;
- discounts used;
- order date and number;
- delivery method;
- shipping status;
- purchase history;
- any Gift Cards used.
Invoicing data
Where requested:
- Tax Code (Codice Fiscale);
- VAT number;
- company name;
- billing address;
- Recipient Code/SDI (Codice Destinatario/SDI);
- any further information necessary to issue the invoice.
Payment data
Full credit or debit card details are normally collected and processed directly by the payment service providers and are not stored in full by Ischia Beauty.
Ischia Beauty may receive and retain information such as:
- payment method used;
- payment status;
- transaction identifier;
- amount;
- any partial or tokenised information made available by the provider.
Account data
If you use a customer account, the following may be processed:
- account identifier;
- login data managed by the platform;
- preferences;
- order history;
- account settings.
Communications with Ischia Beauty
The data contained in communications sent to customer service is processed, for example requests relating to:
- orders;
- products;
- returns;
- complaints;
- product advice;
- general enquiries.
We ask you not to disclose health data or other special categories of personal data unless strictly necessary.
Where such information is disclosed spontaneously and its processing is necessary in order to handle the request, Ischia Beauty will process it only where an appropriate condition provided for by law exists and, where necessary, will request specific consent.
Technical and device-related data
The following may be processed:
- IP address;
- browser type;
- device type;
- operating system;
- online identifiers;
- technical information about the connection;
- security data and logs.
Browsing data
Subject to consent where required, information may be collected relating to:
- pages visited;
- products viewed;
- products added to the cart;
- interactions with the website;
- campaigns through which the user reached the website;
- activities relating to browsing and purchases.
Data relating to marketing preferences
For example:
- newsletter subscription;
- consents given;
- objections;
- unsubscriptions from the newsletter;
- interactions with the communications received;
- commercial preferences.
Location data
If you voluntarily choose to use a feature such as “use my location” in the Store Locator, the browser and the location service provider may process data relating to your location in order to identify the nearest points of sale.
Access to your location takes place only following the specific authorisation requested by the device or the browser.
4. Sources of the data
Personal data may be collected:
Directly from you
For example when you:
- place an order;
- create an account;
- request an invoice;
- fill in a form;
- contact customer service;
- subscribe to the newsletter;
- exercise a right;
- make a return.
Automatically through the website
Through:
- cookies;
- technical logs;
- similar technologies;
- security tools;
- analytics or marketing tools, subject to consent where required.
From providers used to deliver the services
For example:
- Shopify;
- payment providers;
- couriers;
- marketing and communication tools;
- advertising tools;
- services relating to the Store Locator.
From third-party platforms or partners
When you interact with features or services connected to such parties and when the related disclosure of data is permitted by the applicable legislation.
5. Purposes and legal bases of the processing
Management of orders and of the contract
We use the data to:
- manage the cart and the checkout;
- process the order;
- receive and verify the payment;
- prepare the products;
- arrange shipping;
- send communications about the order;
- handle returns and refunds;
- provide assistance relating to the purchase.
Legal basis: performance of a contract or the taking of pre-contractual steps at the request of the data subject, pursuant to Art. 6(1)(b) GDPR.
Management of the customer account
The data is used to create, maintain and manage the account features requested by the user.
Legal basis: performance of the service requested by the data subject, pursuant to Art. 6(1)(b) GDPR.
Customer service
We use the data to respond to requests relating to products, orders, shipments, returns or other services.
Legal basis: performance of the contract or of pre-contractual steps and, in cases not directly connected with a contract, the legitimate interest of Ischia Beauty in responding to the requests received and providing assistance, pursuant to Art. 6(1)(b) and (f) GDPR.
Tax, accounting and legal obligations
The data may be processed for:
- invoicing;
- accounting records;
- retention of documents;
- tax obligations;
- obligations provided for by consumer legislation;
- responding to the authorities;
- managing any legal obligations.
Legal basis: compliance with a legal obligation, pursuant to Art. 6(1)(c) GDPR.
Fraud prevention and security
We may process technical data and data relating to accounts and transactions in order to:
- protect the website;
- prevent unauthorised access;
- verify suspicious transactions;
- combat fraud;
- protect customers, Ischia Beauty and IT systems.
Legal basis: the legitimate interest of Ischia Beauty in the security of its systems, the prevention of fraud and the protection of its rights, pursuant to Art. 6(1)(f) GDPR, as well as any applicable legal obligations.
6. Newsletter and direct marketing
Ischia Beauty may use email, SMS or other electronic channels to send commercial and promotional communications where it has a valid legal basis.
As a rule, electronic promotional communications are sent on the basis of the prior consent of the data subject.
Consent:
- is optional;
- is not necessary in order to make purchases;
- may be withdrawn at any time;
- may be withdrawn by using the unsubscribe link contained in the emails or by contacting Ischia Beauty.
Communications to existing customers
In the cases permitted by Art. 130(4) of the Italian Privacy Code (Codice Privacy), Ischia Beauty may use the email address provided in the context of a previous sale to offer its own products or services similar to those already purchased, provided that the customer has been adequately informed and has not objected.
The customer may object free of charge and at any time.
7. Marketing automation and abandoned carts
Ischia Beauty uses marketing automation tools, including through Klaviyo, to manage newsletters and certain commercial communications.
Automated promotional communications, including any connected with:
- products viewed;
- abandoned carts;
- browsing on the website;
- previous purchases;
are sent only where the recipient may lawfully be contacted in accordance with the applicable legislation.
Any use of browsing data for marketing or profiling purposes takes place only with prior consent where required.
8. Personalised advertising and profiling
Subject to consent, Ischia Beauty may use cookies, pixels or similar technologies to:
- measure the effectiveness of campaigns;
- create advertising audiences;
- show more relevant advertisements;
- understand how users interact with the website;
- carry out remarketing activities.
For this purpose, services such as Meta Platforms and any other advertising tools indicated in the Cookie Policy may be used.
Legal basis: consent of the data subject, Art. 6(1)(a) GDPR, together with the rules applicable to cookies and other tracking tools.
Failure to give consent does not prevent you from using the website or making a purchase.
9. Cookies and other tracking tools
The website uses cookies and similar technologies.
Technical cookies necessary for the operation of the website may be used without consent in the cases provided for by law.
Non-necessary cookies and tracking tools, including those used for advertising, profiling or certain forms of analytics, are used only after the user has given their consent, where required by the applicable legislation.
The user may:
- accept;
- refuse;
- select certain categories;
- subsequently change their preferences.
Preferences can be managed through the cookie banner and through the “Cookie preferences” function made available on the website.
Further information on the purposes, providers and duration of cookies is available in the Cookie Policy.
10. Providers and recipients of the data
For the purposes described, personal data may be disclosed to parties that provide services necessary for the business of Ischia Beauty.
These may include:
Shopify
For:
- e-commerce platform;
- hosting and infrastructure;
- accounts;
- checkout;
- order management;
- security;
- store features.
Payment providers
Including, depending on the method chosen:
- Shopify and its related payment services;
- PayPal;
- Klarna;
- card schemes;
- providers involved in Apple Pay or Google Pay;
- financial institutions involved in bank transfers.
Some of these parties process the data as independent controllers in accordance with their respective privacy notices.
Klaviyo
For activities such as:
- newsletters;
- management of marketing consents;
- automations;
- commercial communications;
- analysis of interactions with the communications;
- any features relating to reviews and to activity on the website.
Processing operations that require consent are carried out only where such consent has been validly obtained.
Meta Platforms
Subject to consent where required, for the following activities:
- advertising measurement;
- remarketing;
- creation of audiences;
- campaign analysis.
Store Locator service / MAPMIGO
To provide the point-of-sale search feature and, where the user activates it, the location-based search.
Couriers and logistics operators
To:
- ship orders;
- communicate information about the delivery;
- handle any logistical problems.
Professionals and consultants
For example:
- accountants;
- tax advisers;
- legal advisers;
- IT providers;
- cybersecurity providers;
within the limits necessary for their respective activities.
Public authorities
Where the disclosure is required by a legal provision or by a lawful order, or is necessary to protect a right.
The providers that process data on behalf of Ischia Beauty are selected and managed in compliance with the applicable data protection obligations.
11. Relationship with Shopify
Shopify provides the technological infrastructure used to operate the store.
Shopify processes certain personal data in order to provide its services to Ischia Beauty.
For certain specific features, Shopify may also process information for its own purposes as described in its own privacy policy.
In such circumstances, Shopify's role in relation to the processing is determined by the relevant purposes and by the applicable agreements.
Shopify's Privacy Policy is available on the official Shopify channels.
12. Transfers of data outside the European Economic Area
Some technology providers used by Ischia Beauty may have their registered office or infrastructure outside the European Economic Area (EEA).
When personal data is transferred to a third country, the transfer is carried out through one of the mechanisms provided for by the GDPR, as the case may be, such as:
- an adequacy decision of the European Commission;
- the EU-U.S. Data Privacy Framework, where applicable to the recipient concerned;
- Standard Contractual Clauses approved by the European Commission;
- other safeguards recognised by the applicable legislation.
Where required, additional measures are adopted to ensure an adequate level of protection.
The data subject may request further information on the safeguards used by contacting:
13. Retention periods
The data is retained only for the time necessary for the purposes for which it was collected and in compliance with legal obligations.
Data relating to orders, invoices and accounting
This data is retained for the period required by the applicable civil and tax legislation, generally 10 years, unless further retention is necessary for disputes, audits or specific legal obligations.
Account data
This data is retained for as long as the account remains active and thereafter for any period necessary to comply with legal obligations or to protect rights.
Requests to customer service
These are retained for the time necessary to handle the request and, thereafter, where necessary to document the assistance provided, to manage disputes or to comply with legal obligations.
Data used for marketing
Data used on the basis of consent is processed until:
- consent is withdrawn;
- the data subject objects;
- or until the processing is no longer necessary in relation to the stated purposes.
Ischia Beauty periodically reviews the need to retain such information.
The information necessary to document consent or to comply with an objection request may be retained further to the extent necessary to demonstrate compliance with the legislation and to avoid further unwanted communications.
Cookies and tracking data
The relevant periods are indicated in the Cookie Policy and in the cookie preferences panel.
Security-related data
Logs and security information are retained for a period proportionate to the needs of incident prevention, detection and management and are subsequently deleted or anonymised, unless there are further legal requirements.
At the end of the respective periods, the data is erased or anonymised where it is no longer necessary.
14. Mandatory or optional nature of the provision of data
Some data is necessary in order to enter into or perform a contract.
For example, in order to place an order, data such as the following is necessary:
- identity and contact details;
- delivery address;
- information necessary for payment.
Failure to provide such information may make it impossible to complete the purchase or to provide the service requested.
The data necessary to comply with tax or legal obligations must be provided where required by law.
By contrast, the following are optional:
- consent to marketing;
- consent to non-necessary cookies;
- consent to advertising profiling;
- authorisation to access your location.
Refusing such optional processing does not prevent you from making purchases on the website.
15. Automated decision-making
Ischia Beauty does not ordinarily use personal data to take decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect him or her within the meaning of Art. 22 GDPR.
Automated systems may, however, be used to:
- identify potential fraud;
- flag anomalous transactions;
- improve security.
The alerts generated by such tools may be subject to review.
Some payment or financial service providers, for example Klarna, may independently carry out assessments relating to payment authorisation, credit or risk on the basis of their own procedures.
Where such parties act as independent controllers, the related processing is governed by their privacy notices.
16. Data security
Ischia Beauty adopts technical and organisational measures appropriate to the risk in order to protect personal data against:
- loss;
- unauthorised access;
- destruction;
- alteration;
- unlawful disclosure.
However, no IT system can guarantee absolute security.
In the event of a personal data breach, Ischia Beauty applies the procedures provided for by Arts. 33 and 34 GDPR where the relevant conditions are met.
17. Rights of the data subject
In the cases provided for by the GDPR, you may exercise the following rights:
- access to your personal data;
- rectification of inaccurate data;
- erasure of data;
- restriction of processing;
- portability of data in the cases provided for;
- objection to processing based on legitimate interest;
- objection at any time to direct marketing, including profiling related to such marketing;
- withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
The exercise of these rights is free of charge, save in the exceptional cases provided for by law.
To exercise them, you may contact:
Ischia Beauty may request the information reasonably necessary to verify the identity of the person making the request and to avoid disclosing data to unauthorised persons.
18. Withdrawal of marketing and cookie consent
To stop receiving promotional emails, you may use the “Unsubscribe” link contained in the communications received.
You may also contact:
For cookies and tracking tools, you may change or withdraw your consent through “Cookie preferences”, available on the website.
Withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.
19. Complaint to the Garante (Italian Data Protection Authority)
If you believe that the processing of your personal data infringes the applicable legislation, you have the right to lodge a complaint with the:
Garante per la protezione dei dati personali (Italian Data Protection Authority)
This is without prejudice to the right to have recourse to the other remedies provided for by law.
20. Minors
The Ischia Beauty website and store are not specifically directed at minors.
The capacity of a minor to validly enter into a contract remains governed by the applicable civil law.
For processing based on consent relating to the direct offer of information society services, in Italy a minor who has reached the age of 14 may give consent independently in the cases provided for by law.
For minors under the age of 14, in the cases governed by Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code (Codice Privacy), consent must be given or authorised by the holder of parental responsibility.
Ischia Beauty does not knowingly collect personal data of minors in breach of these provisions.
If you believe that data of a minor has been transmitted in a non-compliant manner, you may contact us at:
21. Store Locator and location
The Store Locator feature makes it possible to find Ischia Beauty points of sale or partner establishments.
The search can be used without necessarily allowing access to your precise location.
If you choose to use the geolocation feature, the browser or the device will request authorisation.
The location is used to identify nearby points of sale and is not intentionally used by Ischia Beauty for advertising purposes without a further appropriate legal basis.
The feature may be provided through third-party services, including MAPMIGO, which may process technical data necessary for the operation of the service.
22. Third-party websites and services
The website may contain links to websites or services operated by third parties.
When the user leaves the Ischia Beauty website and accesses independent services, the related processing is subject to the privacy notices prepared by the respective controllers.
Ischia Beauty is not responsible for processing carried out independently by third parties on their own services.
23. Changes to this Privacy Policy
This Privacy Policy may be updated, for example, following:
- changes in legislation;
- the introduction or removal of services;
- changes in the methods of processing;
- the introduction of new providers;
- technological changes to the website.
The updated version is published on the website with an indication of the relevant date.
Where the changes so require under the applicable legislation, a further communication will be provided to data subjects or new consent will be requested.
24. Privacy contacts
For questions relating to this Privacy Policy or to exercise your rights:
Ischia Beauty Officine Termali s.r.l.
Via Michele Mazzella, 94
80077 Ischia (NA)
Italy
Email: info@ischiabeauty.com
Telephone: +39 081 99 69 75
Mobile: +39 351 013 4647
VAT No./Tax Code (P. IVA/C.F.): 09454951212
REA No.: NA-1033466
