LEGAL

Privacy Notice pursuant to Regulation (EU) 2016/679 (GDPR)

Pursuant to Regulation (EU) 2016/679 on personal data protection (hereinafter "GDPR"), WYCON S.p.A., with registered office at Piazza IV Novembre, 4 - 20124 Milan, VAT No. 02317910186, informs all data subjects about the types of data collected, how they are used, the purposes, and the parties with whom they are shared. The rights of data subjects and how to exercise them are also described. Data processing will be based on principles of fairness, lawfulness, and transparency, respecting the confidentiality and rights of data subjects.

A. Data Controller and Data Processors
The data controller (hereinafter, "Controller") is:

WYCON S.p.A.
Piazza IV Novembre, 4 – 20124 Milan
VAT No. 02317910186

The data processors, pursuant to art. 28 of the GDPR (hereinafter "Processors"), include:

Splio Italia S.r.l., headquartered at via Emilio Motta 10, 20144 Milan, Italy.

B. Types of data processed
The data subject to processing include:

Browsing data on the www.wyconcosmetics.com site through cookies and tracking systems;

Personal data voluntarily provided for registration to services and participation in initiatives promoted by WYCON S.p.A. or co-promoting third parties;

Data related to purchases made online or at WYCON cosmetics points of sale.

Note: this notice does not apply to websites outside the wyconcosmetics.com domain. WYCON S.p.A. is not responsible for data processing carried out by third parties outside this domain.

C. Cookies
The site uses cookies and similar technologies to ensure functionality, performance analysis, and personalized advertising. For more information or to manage preferences, please consult the full cookie policy:
👉 https://www.wyconcosmetics.com/p/cookies

D. Purposes of personal data processing
Purposes not requiring consent:
[Base giuridica: esecuzione del contratto]

Management of services and initiatives promoted by WYCON S.p.A. online or in stores;

Accounting, tax, and administrative management.

[Base giuridica: esecuzione di misure precontrattuali]

Filling out and managing forms for information requests, contacts, and reports.

Purposes requiring explicit consent:
Direct marketing

Sending, including automated, communications via mail, email, SMS, push notifications, or social networks related to promotions, events, discounts, or initiatives by WYCON S.p.A. and/or third parties.
[Base giuridica: consenso]

Commercial profiling and market research

Analysis of purchasing behaviors, interests, and preferences to improve the commercial offer and personalize communications.
[Base giuridica: consenso]

E. Processing methods, scope of communication, and data circulation
Processing is carried out using electronic, telematic, and manual tools, ensuring adequate security standards. Data may be processed by:

Authorized internal staff (marketing, administration, support);

External processors appointed under Article 28 GDPR;

Third parties (e.g., IT service providers, mailing companies, marketing agencies), with prior consent if required.

Data is processed within the European Union. In case of transfers outside the EU, appropriate safeguards will be adopted pursuant to Articles 44 et seq. GDPR, including any adequacy decisions, standard contractual clauses, or additional measures. The data subject will be clearly informed.

F. Nature of data provision
Mandatory for the purposes under points D.1 and D.2: failure to provide data makes it impossible to access the services.

Optional for marketing and profiling purposes: lack of consent does not prevent registration but limits access to personalized offers and communications.

G. Data subject rights
The data subject has the right to:

access, rectify, update, or delete your data;

object to processing;

request data portability;

withdraw consent given at any time;

file a complaint with the Data Protection Authority.

For exercising your rights:
✉️ privacy@wyconcosmetics.com
📮 WYCON S.p.A. – Via Interporto di Nola – Interporto di Nola – Lotto C3 – 80035 Nola (NA), Italy.

H. Data retention period
Administrative data: retained for the duration required by law (tax, accounting).

Marketing and profiling data: retained for 24 months from the last consent or significant interaction.

Personal data: until consent is revoked or removal from the program.

I. Data Protection Officer (DPO)
The DPO can be contacted for any information regarding the processing of personal data:

📧 privacy@wyconcosmetics.com
📮 WYCON S.p.A. – Via Interporto di Nola – Interporto di Nola – Lotto C3 – 80035 Nola (NA), Italy.

Updates to this policy
This privacy notice may be updated at any time. We invite you to consult it periodically to check for any changes.

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

For Wycon s.p.a., the privacy and security of your personal data are very important, which is why we collect and manage them with the utmost care and adopt specific measures to keep them safe.
Below you will find the main information on the processing by Wycon s.p.a. of your personal data in relation to your browsing on the website www.wyconcosmetics.com and the use of the services offered. 

This privacy notice is provided by Wycon Spa (VAT No. 02317910186) based in Milan, Piazza IV novembre n.4, as Data Controller pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), in order to provide the user with complete, clear and transparent information about the methods of processing personal data, the purposes pursued and the rights exercisable by the data subject.

1. Data Controller

The Data Controller is Wycon spa (VAT No. 02317910186) based in Milan, Piazza IV novembre n.4, which determines the purposes and means of processing the collected personal data.

The Data Controller ensures that all processing is carried out in compliance with the principles set out in art. 5 GDPR, including lawfulness, fairness, transparency, minimization and storage limitation.

2. Categories of personal data processed

The categories of personal data that Wycon s.p.a. collects and processes when you browse, use web services or purchase products on www.wyconcosmetics.com, are as follows:

- personal data, such as first name, last name, gender, age/date of birth; 

- contact information, such as address, email, phone number; 

- payment method data, billing data if applicable, shipping address for products;

- connection, geolocation and browsing data, such as IP address, cookies and similar technologies; 

- additional information necessary for the performance of the requested services;

- No special categories of personal data will be processed.

The Company collects and uses different types of personal data (common) depending on the specific purposes pursued.

Providing the requested data may be mandatory or optional. 

Failure to provide data marked as mandatory makes it impossible for the Data Controller to execute the contract or provide the available services. Providing additional data will be optional.

Wycon s.p.a. neither processes nor stores banking data (e.g., IBAN) or credit card information.

Transactions are managed by third-party providers, capable of guaranteeing the highest security standards, acting as independent data controllers.

3. Purposes of processing and legal bases (Art. 6 GDPR)

The processing of personal data takes place for:

a) conclude and execute the purchase contract for products offered on the website (payment, invoicing, product shipping, and possible return management); 

b) administrative-accounting purposes as fulfillment of legal obligations;

c) ensure identification and provision of services offered to registered users;

d) ensure customer care support service via email or phone;

e) management of participation in the WYCON FAN loyalty program;

f) only with your explicit consent, we will send commercial and promotional communications to the email address or phone number provided following the purchase of one of our products;

g) only with your explicit consent, we will use the data you provided online to access individual services (to make purchases or data provided following enrollment in the loyalty program) to process them and allow us to develop products and services aligned with your preferences and interests, and thus send you advertising communications as close as possible to your tastes, including through automated systems that, however, do not produce legal or other significant effects for the data subject;

h) carry out checks and security activities aimed at preventing and protecting against fraudulent activities, counterfeiting, and abusive behaviors (including by third parties) that conflict with current regulations, contractual provisions applicable to the Site and related services, and rules of fairness and good faith;

i) create statistical reports and behavioral models in order to examine – in aggregated and pseudonymized form – the economic effectiveness of the commercial initiatives undertaken by Wycon s.p.a.

4. Processing Methods (Art. 32 GDPR)

The Data Controller uses electronic and paper tools and adopts appropriate technical and organizational measures to protect personal data from unauthorized access, accidental loss, disclosure, or alteration.

However, although the Company applies adequate administrative, technical, and physical measures to safeguard the data in its possession from loss, theft, unauthorized use, disclosure, and alteration, it cannot guarantee the exclusion of all possible IT risks. 

Data is processed exclusively by parties who have been given specific and detailed instructions, and by service providers under a specific written data processing agreement, who act as independent Data Processors.

While using the features offered by our website, we use cookies and other technologies to collect data on your usage and better target promotions. To learn more, we invite you to review our Cookie Policy.

5. Communication of personal data.

Your personal data will be processed by Wycon s.p.a. and its specifically trained and authorized personnel.

 Data may also be communicated exclusively to authorized parties or appointed Data Processors, such as:

- legal, tax, and accounting consultants;

- IT service providers and cloud computing companies;

- shippers;

- companies affiliated with Wycon s.p.a.;

- public authorities in cases provided by law;

No further use incompatible with the purposes indicated above is foreseen.

The list of appointed Data Processors can be requested by writing to the address   privacy@wyconcosmetics.com.

6. Data transfer to third countries (arts. 44–49 GDPR).

The collected data will be processed within the European Union. Should the data need to be transferred outside the European Union for network or technical reasons, the Data Controller will ensure the adoption of adequate safeguards, including:

- adequacy decisions by the European Commission;

- Standard Contractual Clauses (SCC);

- additional technical and organizational measures.

7. Data retention periods (art. 5, par. 1, lett. e, GDPR)

The collected data will be stored by the Data Controller in a form that allows the identification of the data subject, for a limited period of time, varying depending on the type of activity involving the processing of your personal data. Once this period expires, your data will be permanently deleted or irreversibly anonymized. This is without prejudice to cases where retention for a longer period is required for potential disputes, requests from competent authorities, or under applicable law.

Specifically:

a) data collected to conclude and execute purchase contracts for goods on the website: until completion of administrative-accounting formalities. Billing data will be kept for ten years from the invoice date;

b) registered user data: data will be kept until you request deletion of your profile;

c) payment data: until payment certification and completion of related administrative-accounting formalities following the expiration of the withdrawal right and the terms applied for payment disputes;

d) data collected for joining the WYCON FAN program: these data are kept until the subscription to the loyalty service is canceled;

e) data used for commercial communication activities towards users who purchase products on the website: these data are kept until the activity ceases or you specifically revoke consent;

f) email address provided to receive our newsletters (communications about news and commercial promotions): until consent is revoked;

h) data used for commercial communications, market research, and satisfaction surveys, as well as for personalizing commercial communications: until consent is revoked;

i) data used to personalize the Site and show personalized commercial offers: until you request cessation of the activity and in any case within 12 (twelve) months from the last interaction of any kind with Wycon s.p.a.

8. Data subject rights (arts. 15–22 GDPR)

You can exercise your rights at any time regarding the specific processing of your personal data by Wycon s.p.a., in particular:

• Right of access (art. 15) – to obtain confirmation of processing, a copy of the data, and information on logic, purposes, and categories processed;

• Right to rectification (art. 16) – to obtain correction or updating of inaccurate or incomplete data;

• Right to erasure (art. 17) – to request deletion of data when legal conditions apply;

• Right to restriction (art. 18) – to obtain suspension of processing in specific circumstances;

• Right to data portability (art. 20) – to receive data in a structured format and transfer it to another controller;

• Right to object (art. 21) – to oppose processing based on legitimate interest;

• Right not to be subject to automated decisions (art. 22) – except with explicit consent or contractual necessity.

Pursuant to art. 19 of the GDPR, the data controller will inform each recipient to whom personal data has been disclosed of any corrections, deletions, or restrictions of processing carried out under arts. 16-17-18 GDPR, unless this proves impossible or involves a disproportionate effort.

To ensure that our users' data is not violated or misused by unauthorized parties, before accepting your request to exercise any of the rights listed, we will ask you for some information to verify your identity.

9. Minors

The services on this site are intended for individuals aged 18 or older.

Wycon s.p.a. does not request, collect, use, or freely disclose personal data provided by individuals under 18 years of age. If Wycon s.p.a. becomes aware of having collected data from a minor, it will delete it. If you are under 18, please do not register or proceed with purchasing a product online.

10. Additional rights (arts. 12–14 GDPR)

You will also have the right to:

- receive clear and transparent information about the processing;

- be informed in case of personal data breaches (data breach) that may pose high risks;

- obtain a copy of the documentation related to the processing and agreements with the Data Processors.

11. How to exercise your rights

If you wish to report incorrect processing of the data provided or to exercise the rights listed above, the data subject may:

- send a registered letter with return receipt to the registered office of Wycon spa in Milan, Piazza IV novembre no.4;

- send an email to the D.P.O. (Data Protection Officer) appointed by Wycon spa at privacy@wyconcosmetics.com.

The Data Controller will respond without undue delay, in any case within 30 days.

You can revoke your consent to optional data processing at any time by contacting the D.P.O. (Data Protection Officer) appointed by Wycon spa by sending an email to  privacy@wyconcosmetics.com or, alternatively, send a registered letter with return receipt to the registered office of Wycon spa in Milan, Piazza IV novembre no.4, attention to the D.P.O. (Data Protection Officer).

If the data subject believes their rights have been violated, they have the right to file a complaint with the Data Protection Authority, following the procedures indicated by the Authority at the following web address http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or by sending written communication to the Data Protection Authority, Piazza Montecitorio no.121, 00186 Rome.

12. Updates to this privacy notice

The Data Controller may update this privacy notice to comply with regulatory or organizational changes. Each updated version will be made available through appropriate means.