Privacy policy

NOTICE ON THE PROCESSING OF PERSONAL DATA
(EU REGULATION 2016/679)
personal data collected pursuant to art. 13 GDPR

Cosmetica HUB S.p.A., in the person of its legal representative pro tempore, with registered office in Milan (MI) at Via Foro Buonaparte no. 67, VAT no. 09198410962, hereinafter the DATA CONTROLLER, in its capacity as data controller, informs you, pursuant to art. 13 of EU Regulation no. 2016/679, hereinafter GDPR, that your data will be processed in the following manner and for the following purposes:

1) identity and contact details of the data controller and of the data protection officer: the data controller through the website www.rvblab.com is Cosmetica HUB S.p.A., with registered office in Milan (MI) at Via Foro Buonaparte no. 67, VAT no. 09198410962, which can be contacted at the certified email address cosmetica@legalmail.it . You may also contact the Data Protection Officer (DPO), Avv. Enrica Vasini, Tax code VSNNRC78M45C573E, who can be contacted at the email address enrica.vasini@ordineavvocatirimini.it. You may contact the data controller and the DPO to exercise the rights granted to the data subject under the GDPR and to obtain the updated list of all data processors, both internal and external, sub-processors, and persons authorised to process data.

2) subject matter of the processing: while browsing the site www.rvblab.com this privacy policy applies both to the user/data subject who browses the site without registering, and to the user/data subject who voluntarily provides their data to create their own account and access certain sections of interest and to make use of certain services offered by the data controller. Please note that processing carried out in order to receive information on the controller's products and services within the relevant private account areas involves providing personal data; providing such data is optional, but failure to provide it makes it impossible for the controller to provide further information requested by the data subject. While browsing the site www.rvblab.com Cosmetica s.r.l. has been guided by the core principles of EU Regulation 679/2016, namely the principles of lawfulness, fairness, transparency, security and data minimisation. The controller, while browsing the site www.rvblab.com, processes connection data, such as, for example, the visitor's IP address. Simply browsing the site does not involve any registration, while the use of cookies is provided for, both its own and third-party cookies, for which please refer to the cookie policy on the site www.rvblab.com. Access to the private account area, on the other hand, requires registration by entering and using an email address and a password chosen by the user, which may be remembered by means of a technical cookie, subject to the visitor's consent. The data controller also processes data relating to the data subject, such as, for example, the contact details provided by the data subject, the payment method and details, as well as the location to which the purchased goods are to be shipped, where the data subject voluntarily provides such data when purchasing products available on the site, since obtaining such contact details is necessary in order to fulfil the data subject's requests. For the legal bases, please refer to the relevant section of this notice.

3) Purpose of the processing and legal basis.
 your data is processed:

A) without the need for your express consent, pursuant to art. 6(1)(b) GDPR, for the following sales or service purposes:
-  for the performance of a contract to which the data subject is a party, or for the performance of pre-contractual measures adopted at the data subject's request.  
This is the case where the data subject proceeds to purchase products or services offered by the Controller by browsing online on the site www.rvblab.com and by accessing the private account area to make online purchases. The same applies to data relating to where the ordered goods are to be delivered, as the concluding act of the contract between the parties (performance by the controller).  
-to fulfil the pre-contractual, contractual and tax obligations arising from the relationship with you   
-to fulfil the obligations set out by law, by a regulation, by EU legislation, or by an order of an Authority (such as, for example, in anti-money-laundering matters)  
-to exercise the controller's rights, for example the right of defence in any legal proceedings.
- to respond to a contact request made through the “contacts” section of the site.

B) For a legitimate interest of the data controller, for statistical purposes or to improve browsing on the site www.rvblab.com. Specifically, as regards statistical purposes, this refers to the use by the aforementioned website of the Google Analytics program, which is however used by the controller only with IP anonymisation enabled. The IP address transmitted by the user's browser is not combined with other Google data. The legal basis for this processing is, precisely, art. 6(1)(f) of the GDPR.  

C)  Only with your specific and separate prior consent (art. 6(1)(a) GDPR), and we inform you that you may withdraw previously given consent at any time, it being understood that, for processing carried out on the basis of explicit consent, the processing is lawful until such consent is withdrawn, as regards, while browsing the site www.rvblab.com the use of cookies, as further detailed in the cookie policy on the site. There are different types of cookies, which require acceptance by the user/visitor. The user has the option not to accept the use of cookies by selecting the appropriate settings in the banner that appears at the start of browsing on the aforementioned site, or to change their choices.  

For those who subscribe to the newsletter

D) Only with your specific and separate prior consent (art. 6(1)(a) GDPR), and we inform you that you may withdraw previously given consent at any time, it being understood that, for processing carried out on the basis of explicit consent, the processing is lawful until such consent is withdrawn, for the following marketing purposes:
-to send you emails, mail and/or SMS, and/or telephone contacts, newsletters, commercial communications and/or advertising material regarding products or services offered by the Controller, and to gauge your satisfaction with the quality of the services, by subscribing to the newsletter via the site www.rvblab.com

E) For a legitimate interest of the data controller (art. 6(1)(f) GDPR), in the case of sending soft spam, as defined by art. 130(4) of the Privacy Code, relating to products similar to those you have already purchased. Please note that you may always object to the aforementioned soft spam at any time by sending a communication to the address: customercarervblab@cosmeticahub.com, entering “no soft spam” in the subject line, or by following the instructions in the footer of the emails

F) for the performance of a contract to which the data subject is a party, or for the performance of pre-contractual measures adopted at the data subject's request, pursuant to art. 6(1)(b) GDPR, and the processing is necessary when you register for the private account area. The purpose is to grant the data subject access to the private account area at their request, in order to make purchases. Providing the data is optional, but failure to provide it makes it impossible for the controller to conclude the requested contract.
The purpose is to provide the services requested by the data subject

4) method of processing: the processing of your personal data is carried out by means of the operations set out in art. 4(2) GDPR, namely: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, alignment or combination, restriction, erasure, destruction, and portability at your request. Your personal data is processed both in paper and electronic and/or automated form. Personal data is processed using automated tools for the time strictly necessary to achieve the purposes for which it was collected. As is your right, automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, will not be based solely on such automated processing, unless it is necessary for the conclusion or performance of a contract between the data subject and a data controller, or unless there is explicit consent from the data subject. We inform you that specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorised access.

5) recipients or categories of recipients of personal data 
The data collected is used solely to fulfil the services requested by the user, such as, for example, accessing private account areas to complete purchases of products available on the site www.rvblab.com, or to receive commercial communications relating to products available on the site (newsletter), or to receive information on products similar to those already purchased by the data subject. Data provided by the user on these occasions will not be further disclosed except to persons or companies duly authorised by the Controller (internal and/or external data processors, sub-processors, persons authorised to process data) and will not be disseminated without your consent. Without the need for your express consent, the controller may disclose your data for the purposes referred to in point 3 C) of this notice to Supervisory Bodies, Judicial Authorities, as well as to all those parties to whom disclosure is mandatory by law and for the performance of the aforementioned purposes. Such parties will process the data in their capacity as independent data controllers. Data may be transferred to a third country outside the EU to third parties solely for the purposes indicated above and in full compliance with the processing consented to by the User. The data processor Extera srl is based in a country outside the EU, as indicated in the site's registration details. In order to safeguard the right that the European Union considers fundamental, data collected within European territory must be transferred to international organisations or non-EU countries in accordance with the strict rules established by Chapter V of the EU Regulation: the transfer must take place in compliance with the principles underlying proper processing and in the presence of sufficient and adequate safeguards to protect all data subjects. The data controller guarantees, pursuant to arts. 46 and 48 of EU Regulation 2016/679, that transfers to third parties resident in non-EU countries will take place in compliance with such rules, in particular with the provisions of art. 46(3)(a) of the GDPR.

6) data retention periods.
The controller will process personal data for the periods established by the applicable regulations, specified below, pursuant to art. 13 GDPR: ten years for documents and related data of a civil, accounting and tax nature, as provided for by the laws in force, for the data referred to in point 3 A). Data referred to in points 3) B and 3) C will be retained until the end of the session by means of a technical cookie. With regard to data processed for marketing purposes under point 3 B), such data will be retained in compliance with the principle of proportionality and, in any case, until the purposes of the processing have been achieved or, if earlier, until the data subject withdraws their specific consent. Data referred to in point 3) E will be retained until any objection is raised and, in any case, until the purpose for which it was collected and processed has been fulfilled. Ten years for documents and related data of a civil, accounting and tax nature, as provided for by the laws in force, for the data referred to in point 3 F)

7) rights of the data subject
The data subject has the right to ask the data controller for access to the personal data held by the latter, the rectification or erasure of such data, or the restriction of the processing concerning them, or to object to the processing of personal data, and also has the right to request the portability of their personal data held by the controller.

8) consent given and its withdrawal
Where processing is based on explicit consent for one or more specific purposes of the data subject, pursuant to art. 6(1)(a), or on the explicit consent of the data subject pursuant to art. 9(2)(a) for one or more specific purposes of the data subject, you are informed that it is the data subject's right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent given before its withdrawal.

9) right to lodge a complaint with a supervisory authority 
The controller informs the data subject that, should they identify any unlawfulness, lack of transparency, lack of fairness on the part of the controller, or any other irregularity under the GDPR in the processing of their data, it is their right to lodge a complaint with the supervisory authority (the Garante per la protezione dei dati personali, the Italian Data Protection Authority) or to take legal action 

10) nature of the provision of personal data and consequences of any refusal to provide it.
The provision of personal data is optional, except in specific cases where there is a legal obligation. Any refusal to provide it makes it impossible for the Controller to provide the advice and responses referred to in points 3 A), 3 B), 3 C) and 3 F) of this notice.  

11) profiling
The controller informs you that your personal data will not be processed by means of an automated decision-making process (including profiling) without the express consent of the user

12) further processing of data for further purposes 
The controller informs you that your data will be processed solely for the purposes for which it was provided. Further processing for purposes other than those for which the data was provided will require further authorisation from the data subject.  

13) Cookies
By using the site www.rvblab.com, you consent to the use of cookies in accordance with this policy. Please note that the cookies used are technical cookies necessary for the proper functioning of the site, as well as third-party cookies.

Cookies are managed by the user via the initial banner, and consent given can always be withdrawn.