Privacy policy

1. Data controller

Laboratori Cosmetici Milano S.R.L. (LCM S.R.L. for short), Via Dogana 3, 20123 Milan (MI), Italy, VAT no. IT13400340967.

For any privacy request you can write to privacy@auraelcosmetics.com.

2. What data we process

• Order data: full name, email, phone (optional), shipping address, quantity and any notes you choose to add.
• Payment data: you enter it directly on Worldline’s secure page (ClicPay). We never receive or store your card details.
• Technical browsing data: IP address, browser type and requests to the site, processed by our hosting provider to run and protect the site.
• Usage statistics: pages visited and interactions, collected with Google Analytics only if you give consent.
• Newsletter and cart reminders: your email, language and the quantity chosen at checkout, only if you sign up.

3. Why we process them and on what legal basis

• Handling your order, payment, shipping and customer care: performance of a contract (Art. 6(1)(b) GDPR).
• Sending you the order confirmation with the payment link and, if the order is still awaiting payment, a single reminder: performance of a contract (Art. 6(1)(b) GDPR).
• Checking the first-purchase discount through your email: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Meeting accounting and tax obligations: legal obligation (Art. 6(1)(c) GDPR).
• Protecting the site from abuse and automated submissions, including the Cloudflare Turnstile anti-bot check at checkout: legitimate interest (Art. 6(1)(f) GDPR).
• Measuring in aggregate how the site is used: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Sending you the newsletter and, if you do not complete an order you started, a reminder: consent (Art. 6(1)(a) GDPR), confirmed by email and revocable through the link in every message.
• Measuring whether newsletters are delivered and which links are clicked, to improve them: legitimate interest (Art. 6(1)(f) GDPR). We do not track email opens.

Order data is required to fulfil your purchase: without it we cannot ship the product. Consent to statistics is optional and does not affect your purchase.

4. How long we keep them

• Order data and accounting records: for as long as needed to handle the order, then for 10 years as required by law.
• Technical browsing data: for the short time needed to keep the site secure.
• Google Analytics statistics: 14 months.
• Newsletter subscription: until you unsubscribe. Unconfirmed requests and cart data are deleted after 30 days.

5. Who we share data with

We do not sell your data. We only share it with those who help us provide the service:

• Cloudflare, Inc.: site hosting, order database and anti-bot protection.
• Worldline Merchant Services Italia S.p.A.: card payment processing through ClicPay.
• Resend (Plus Five Five, Inc.): sending service emails and the newsletter.
• Couriers and shipping services: delivery of your parcel.
• Google Ireland Limited: Google Analytics statistics, only with your consent.
• Accounting and tax advisers, and authorities when the law requires it.

6. Transfers outside the European Union

Cloudflare, Google and Resend may process some data in the United States. In these cases the transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

7. Your rights

You can ask at any time to access, correct or delete your data, restrict its processing, receive it in a portable format or object to processing based on legitimate interest. You can withdraw your consent to statistics from “Cookie preferences” at the bottom of every page.

To exercise your rights write to privacy@auraelcosmetics.com. If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (garanteprivacy.it).

8. Changes

We may update this notice. The date of the last change is always shown at the top. For cookies, see also the cookie policy.