Privacy Policy

1.1. Scope of This Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored and disclosed in connection with the Wellnessexpert online store available at:

www.wellnessexpert.it, www.wellnessexpert.eu, www.wellnessexpert.es, www.wellnessexpert.asia, www.spaskincare.de www.wellnessexpert.co.uk

This Privacy Policy applies to customers, website visitors and other natural persons whose personal data is processed through the Online Store.

1.2. Data Controller

The controller responsible for the processing of personal data is:

Premium Makeup OÜ

Registry code: 12240850

Registered address: Heki tee 4-57, Haabneeme, Viimsi Parish, Harju County, 74001, Estonia

Email: info @ wellnessexpert.it

Website: www.wellnessexpert.it

Premium Makeup OÜ is hereinafter referred to as the “Seller,” “Online Store,” “we,” “us” or “Data Controller.”

1.3. Processing Principles

The Data Controller processes personal data lawfully, fairly and transparently.

Personal data is collected only for specified and legitimate purposes and is not processed in a manner incompatible with those purposes.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.

Depending on how the customer uses the Online Store, we may process the following categories of personal data.

2.1. Identification and Contact Data

This may include:

•  first and last name;

•  email address;

•  telephone number;

•  billing address;

•  delivery address; and

•  company details where an order is placed on behalf of a business.

2.2. Order and Delivery Data

This may include:

•  products ordered;

•  product quantities;

•  order date and order number;

•  order value;

•  selected delivery method;

•  delivery status;

•  return and refund information; and

•  communications relating to the order.

2.3. Payment-Related Data

This may include:

•  selected payment method;

•  payment amount;

•  payment status;

•  transaction reference;

•  payer identification information;

•  payment date; and

•  information required to initiate, confirm or refund a payment.

The Online Store does not receive or store the customer’s complete online banking credentials, full payment card number, card security code or complete PayPal authentication information.

2.4. Customer Account Data

Where the Online Store offers customer accounts, we may process:

•  account identification details;

•  login and registration information;

•  order history;

•  saved contact and delivery details; and

•  customer preferences.

Passwords are not available to the Seller in readable form where they are stored using appropriate technical security measures.

2.5. Customer Service and Complaint Data

When a customer contacts us, we may process:

•  the content of the communication;

•  contact details;

•  order information;

•  photographs and other evidence submitted in connection with a complaint;

•  return requests; and

•  information necessary to answer the request or resolve the matter.

2.6. Direct Marketing Data

Where the customer has consented to receive marketing communications, we may process:

•  name;

•  email address;

•  marketing preferences;

•  consent information; and

•  information concerning withdrawal of consent.

2.7. Technical Data

Depending on the functionality and service providers used by the Online Store, we may process certain technical information, including:

•  IP address;

•  browser and device information;

•  access date and time;

•  website activity;

•  security logs; and

•  cookie identifiers.

Information concerning cookies and similar technologies should also be presented through the Online Store’s cookie notice or cookie settings, where applicable.

We primarily collect personal data:

•  directly from the customer when an order is placed;

•  when a customer creates an account;

•  when a customer contacts customer support;

•  when a return, refund or complaint is submitted;

•  when a customer subscribes to marketing communications;

•  automatically through the Online Store’s technical systems; and

•  from payment, delivery and other service providers where necessary to fulfil an order or confirm a transaction.

The customer is responsible for ensuring that the personal data provided to the Online Store is accurate and up to date.

4.1. Performance of a Contract

We process personal data where necessary to:

•  accept and administer orders;

•  process and confirm payments;

•  deliver products;

•  provide order confirmations and status notifications;

•  communicate with the customer;

•  process cancellations, returns and refunds;

•  handle complaints; and

•  exercise or defend rights arising from the sales contract.

The legal basis for this processing is the performance of a contract or taking steps at the customer’s request before entering into a contract.

4.2. Compliance with Legal Obligations

We process personal data where necessary to comply with:

•  accounting requirements;

•  tax requirements;

•  consumer protection requirements;

•  product safety requirements;

•  fraud prevention obligations;

•  obligations arising from payment services; and

•  requests from competent public authorities.

4.3. Legitimate Interests

Where permitted by applicable law, we may process personal data on the basis of our legitimate interests, including:

•  protecting the Online Store against fraud and misuse;

•  securing the Online Store and its technical systems;

•  managing and improving customer service;

•  establishing, exercising or defending legal claims;

•  maintaining records of customer communications; and

•  improving the operation and reliability of the Online Store.

When relying on legitimate interests, we consider the nature of the processing and the rights and interests of the affected person.

4.4. Consent

We process personal data on the basis of consent where consent is required, including for:

•  electronic direct marketing;

•  non-essential cookies; and

•  optional analytics or marketing technologies.

Consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

5.1. Payments Mediated by Maksekeskus

Payments made using the following payment methods may be mediated by Maksekeskus AS:

•  Estonian bank payments;

•  Latvian bank payments;

•  Visa;

•  Mastercard;

•  Apple Pay; and

•  Google Pay.

Payment takes place outside the Online Store in a secure payment environment.

Bank payments take place in the secure environment of the selected bank. Card and supported mobile-wallet payments take place in the secure payment environment provided through Maksekeskus AS and the relevant payment service providers.

5.2. Role of Maksekeskus

Premium Makeup OÜ is the controller of personal data processed for the operation of the Online Store.

For the purpose of initiating, executing, confirming and refunding payments, the Online Store transfers the personal data necessary for payment processing to the authorised processor:

Maksekeskus AS

Registry code: 12268475

Address: Liivalaia 45, Tallinn 10145, Estonia

Maksekeskus AS processes the transferred personal data for the provision of payment services and related purposes.

5.3. Data Transferred to Maksekeskus

Depending on the payment method, the information transferred to Maksekeskus AS may include:

•  order number or order reference;

•  payment amount and currency;

•  customer’s name;

•  customer’s email address;

•  customer’s telephone number, where required;

•  payer identification information;

•  selected payment method;

•  payment status;

•  transaction reference; and

•  other information technically necessary to initiate, confirm or refund the payment.

The Online Store transfers only the information reasonably necessary for payment processing.

5.4. Payment Credentials

The Seller does not have access to:

•  the customer’s full online banking credentials;

•  authentication codes used in the customer’s bank;

•  the customer’s full payment card number;

•  the payment card security code; or

•  other confidential authentication information entered directly in the payment provider’s secure environment.

5.5. Apple Pay and Google Pay

Where the customer selects Apple Pay or Google Pay, the relevant wallet provider may also process personal data in accordance with its own terms and privacy information.

The Online Store does not control personal data processing carried out independently by Apple, Google, the customer’s bank or card issuer.

PayPal payments are processed separately through the secure payment environment operated by the applicable PayPal entity.

PayPal payments are not mediated by Maksekeskus AS.

When a customer selects PayPal, the information necessary to process and confirm the payment may be transferred to PayPal. This may include:

•  payment amount;

•  currency;

•  order reference;

•  customer identification information;

•  email address;

•  payment status; and

•  transaction reference.

PayPal processes personal data in accordance with its own applicable privacy information and legal obligations.

The Seller does not have access to the customer’s complete PayPal authentication information or full payment card details entered directly in PayPal’s environment.

We may disclose personal data to third parties where this is necessary to fulfil an order, operate the Online Store, comply with legal obligations or protect our legitimate rights.

Recipients may include:

•  payment service providers;

•  banks and card payment networks;

•  delivery and courier companies;

•  parcel terminal and collection-point operators;

•  accounting service providers;

•  hosting and information technology service providers;

•  website and e-commerce platform providers;

•  customer support service providers;

•  legal and other professional advisers; and

•  competent public authorities where disclosure is required by law.

Service providers receive access only to the personal data necessary to perform the relevant service.

The Seller does not sell customers’ personal data to third parties.

Some service providers, including payment, hosting, analytics or technology providers, may process personal data outside Estonia or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, the transfer shall take place only where an appropriate legal basis and required safeguards are available under applicable data protection legislation.

Such safeguards may include:

•  an adequacy decision adopted by the European Commission;

•  standard contractual clauses;

•  other legally recognised transfer mechanisms; or

•  another valid legal basis for the transfer.

Personal data is retained only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.

9.1. Order and Accounting Records

Order, transaction, invoice and accounting information may be retained for seven years from the end of the relevant financial year, where this is required to comply with accounting and taxation obligations.

9.2. Customer Account Data

Customer account data is retained while the account remains active and thereafter only for as long as necessary to comply with legal obligations, resolve disputes or protect legitimate interests.

The customer may request closure of their account, subject to data that must continue to be retained by law.

9.3. Customer Service and Complaint Data

Customer service, return and complaint records are retained for as long as necessary to resolve the matter and, where appropriate, for the applicable limitation period.

9.4. Payment Data

Payment and transaction information is retained for as long as necessary to:

•  confirm and administer payments;

•  process refunds;

•  prevent fraud;

•  resolve disputes; and

•  comply with applicable legal obligations.

Payment service providers may apply their own legally required retention periods.

9.5. Direct Marketing Data

Personal data used for direct marketing is retained until:

•  the customer withdraws consent;

•  the customer unsubscribes; or

•  the purpose for which consent was obtained otherwise ends.

Information demonstrating that consent was given or withdrawn may be retained where necessary to demonstrate compliance with applicable law.

The Online Store sends newsletters, product offers and other electronic direct marketing communications only where:

•  the recipient has given the required consent; or

•  another lawful basis for direct marketing applies.

Creating a customer account, submitting an order or providing an email address for order administration does not automatically constitute consent to receive direct marketing.

Consent to direct marketing must be given separately and voluntarily.

The recipient may unsubscribe at any time by:

•  using the unsubscribe link included in a marketing email; or

•  contacting the Seller at info @ wellnessexpert.it.

Withdrawal from marketing communications does not affect order-related, service-related or legally required communications.

Subject to the conditions and limitations provided by applicable law, a person whose personal data we process may have the following rights.

11.1. Right of Access

The person has the right to request confirmation as to whether their personal data is being processed and to receive access to that data.

11.2. Right to Rectification

The person has the right to request correction of inaccurate personal data and completion of incomplete personal data.

11.3. Right to Erasure

The person may request deletion of personal data where there is no valid legal basis or continuing requirement for its retention.

The right to erasure does not apply where processing or retention is required by law or is necessary for the establishment, exercise or defence of legal claims.

11.4. Right to Restriction of Processing

The person may request restriction of processing in the circumstances provided by applicable law.

11.5. Right to Data Portability

Where applicable, the person may request personal data that they provided to us in a structured, commonly used and machine-readable format.

11.6. Right to Object

The person may object to processing based on legitimate interests where grounds relating to their particular situation exist.

The person has the right to object to the processing of personal data for direct marketing at any time.

11.7. Right to Withdraw Consent

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal of consent does not affect processing carried out lawfully before the withdrawal.

11.8. Right to Lodge a Complaint

A person who considers that their personal data has been processed unlawfully has the right to lodge a complaint with the competent supervisory authority.

In Estonia, the supervisory authority is the:

Estonian Data Protection Inspectorate
(Andmekaitse Inspektsioon)

Requests relating to personal data or this Privacy Policy may be sent to:

Premium Makeup OÜ

Email: info @ wellnessexpert.it

The request should clearly describe:

•  the identity of the person submitting the request;

•  the right they wish to exercise; and

•  the personal data or processing activity concerned.

We may request additional information where reasonably necessary to verify the identity of the person submitting the request.

Requests shall be handled within the period required by applicable data protection legislation.

The Seller applies reasonable technical and organisational security measures appropriate to the nature of the personal data and the risks associated with its processing.

Such measures may include:

•  access restrictions;

•  authentication controls;

•  secure website connections;

•  system updates;

•  data backups;

•  confidentiality obligations;

•  restricted access to administrative systems; and

•  cooperation with service providers that apply appropriate security measures.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, the Seller takes reasonable steps to reduce the risk of unauthorised access, disclosure, alteration, loss or destruction.

The Online Store may contain links to websites or services operated by third parties, including payment and delivery service providers.

The Seller is not responsible for personal data processing carried out independently by those third parties.

Customers should review the applicable privacy information of a third-party service before providing personal data directly to that service.

The Seller may amend this Privacy Policy where necessary to reflect:

•  changes in legal requirements;

•  changes in the operation of the Online Store;

•  the introduction or removal of payment or delivery methods;

•  changes in service providers; or

•  changes in personal data processing practices.

The current version of the Privacy Policy shall be published in the Online Store.

Material changes may also be communicated to customers through the Online Store or by another appropriate method.

Questions concerning this Privacy Policy or the processing of personal data may be sent to:

Premium Makeup OÜ

Registry code: 12240850

Address: Heki tee 4-57, Haabneeme, Viimsi Parish, Harju County, 74001, Estonia

Email: info @ wellnessexpert.it

Website: www.wellnessexpert.it