1. General Information
   G&P COSMETICS SRL (hereinafter also referred to as the “Company” or “G&P”) hereby informs you (hereinafter also referred to as the “User” or the “data subject”), that for the purposes indicated below, it will process your personal data (or those of the company you represent if acting on its behalf), which you have provided. Only data necessary to pursue the purposes indicated in this privacy policy will be requested and processed. You must only provide your data and/or the data of the company represented by you. If you are acting on behalf of a company, the activities envisaged by this privacy policy will be carried out in relation to the company using the data provided by you, thus consenting to the processing (where consent is required) on behalf of the company you represent.

    

2. Purposes and legal basis
   The Company will process your data:
   

    

   • In order, after verifying that you/your company/business is a supplier of Sens.ùs products, to register your company/business in the locator and then publish the details of your business on the website https://www.ilovesensus.it, locator section, so that users can also use your business for purchasing Sens.ùs products. The legal basis for processing is consent; we inform you that by registering, you will then also be able to access the other restricted sections of the sensus app.
   • In order for the Company to be able to send marketing communications about its products/services/initiatives, all by the Company to the email address indicated by you or to other contact details including telephone and postal address (note that e-mails and SMS/MMS messages, messages via messaging apps, may also be sent electronically through automated tools); the legal basis of the processing is consent;

     You are informed that you can also indicate your preference to be subject to the activities only through e-mail, or only through telephone or postal communications, by writing to privacygep@cosmetics.com

     Communications may also be sent via push messages if you activate app notifications on your mobile phone (in which case by activating notifications you consent to processing)

   • In order to comply with an obligation imposed by laws, regulations or EU legislation (the legal basis is compliance with a legal obligation);
   • For legitimate interests such as to exercise or defend a legal claim of G&P (the legal basis of the data processing is the pursuit of legitimate interests). In considering these legitimate interests, it has been analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest was assessed on the basis of a Triple Test available by contacting the Company).

    

3. Compulsory provision of data 
   
   PURPOSE OF POINT 2, letter A
   You may or may not disclose your personal data/those of the company/business you represent to us for the purposes set forth in point 2 (A) of the policy, just as you may or may not provide your consent and the lack of provision of data marked by an asterisk and the lack of consent will mean that you will not be able to register to the locator and thus be published on the website and access the other areas of the sensus app with the same username and password. Furthermore, if you consent to the processing of your personal data for the purposes set forth in point 2 (A) of this privacy policy, you may always freely withdraw your consent without motivation and request removal from the locator by contacting the Company at the contact details indicated in point 6

   PURPOSE OF POINT 2, letter B
   You may or may not disclose your personal data/those of the company you represent to us for the purposes set forth in point 2 (B) of the policy just as you may or may not provide your consent. Failure to provide your consent will therefore have no consequence other than not being subject to the activities set forth in the point by G&P (there are therefore no consequences on the other purposes). Furthermore, should you consent to the processing of your personal data for the purposes set forth in point 2 (B) of this privacy policy, you may always withdraw your consent freely and without motivation (and thus object to the activities in question) by contacting the Company using the contact details provided in point 6

   PURPOSE OF POINT 2, letters C and D
   The provision of data for the purposes indicated in point 2 (C) and 2 (D) of this privacy policy is necessary and any failure to provide such data will make it impossible for G&P to carry out the activities set forth in the preceding points.

    

4. Categories of recipients of the data 
   For the purposes indicated in point 2 (A), the business data may be disseminated via the website https://www.ilovesensus.it. 

   For the purposes indicated in point 2 (B) above, the data will not be disclosed to third parties.

   For the purposes indicated in point 2 (C) of this policy, the data may be disclosed by G&P to public bodies, judicial bodies and police forces.

   For the purposes indicated in point 2 (D) of this policy, the data may be communicated by G&P to lawyers-legal consultants, public bodies, judicial bodies and police forces and to the post office (which may see the address for sending any written communications).

   G&P will only disclose data that are necessary to pursue the individual purposes indicated in this policy.

   On behalf of G&P, all persons delegated by the Company may come to know of the data, each in relation to their role. These include public and customer relations officers, even external to the Company, information systems officers, even external to the Company, who may at times perform the duties of system administrators and are in those cases appointed as such, consultants, even external to the Company - such as, for example, computer technicians who may at times perform the duties of system administrators and are, in those cases, appointed as such, legal advisors - interns, website management staff, even external to the Company, marketing staff, even external to the Company, legal staff, collaborators of the data processors and the data processors appointed by G&P (e.g. marketing consultants, IT outsourcers, companies in charge of sending newsletters or communications, companies which provide assistance in corporate management such as the parent company). The list of data processors may be accessed at any time by contacting the Company using the contact details indicated in point 6. The Data Processors shall only process the data necessary to perform the tasks assigned to them.

    

5. Data Storage
   The data will be stored for as long as is necessary to pursue the purposes contained in this policy. The data storage period is as follows:
   

    

   • for the purpose of complying with legal obligations, regulations and EU legislation, for so long as envisaged by those laws;
   • for the purposes indicated in point 2(A), until the withdrawal of consent and/or the request for erasure, without prejudice to storage for the purposes indicated in points 2(C) and 2(D);
   • for the purposes indicated in point 2(B), until the withdrawal of content and/or the request for erasure, without prejudice to storage for the purposes indicated in points 2(C) and 2(D); every 24 months from the issuance of consent, you will be reminded, by a specific communication, of the possibility of indicating that you no longer have an interest in being subject to the activities identified in this point and, in that case, the data will no longer be stored for that purpose (2B), without prejudice to storage for the purposes indicated in points 2(C) and 2(D);
   • in any case, all data may be stored for a period necessary to exercise or defend a legal claim of the Company, in accordance with Italian civil and criminal law, and therefore for a maximum period of 10 years from the termination of the relationship, except in cases of litigation or disputes that require an extended storage period and without prejudice to any further storage as required by applicable local regulations concerning data subjects.
6. Data Controller and Data Processor
   The Data Controller is: G&P COSMETICS SRL, with registered office in Via L. Mascheroni no. 27 - 20145 Milan (Italy), Tax Code, VAT number and Padua Companies Register no. 04778640963, Economic & Administrative Index no. MI 1771789, fully paid-up share capital of €62,500.00, company subject to management and coordination by AGF88 Holding S.r.l., Tel. 0575 720 682, Fax 0575 749 923, privacygep@cosmetics.com.
   Currently, the Company is not legally required to have an internal Data Protection Officer. If such a function becomes necessary, the identity of the relevant person will be made known via the Company’s website www.g&pcosmetics.it, which you are encouraged to visit periodically, also for any updates to this privacy policy.
   

    

7. Rights
   We hereby inform you that the GDPR allows Users to request from the Company (using the contact details provided above) full access to their personal data and the rectification of such data, the erasure of the data, the restriction of data processing, and the right to data portability; Users may also object to the processing of their data, again by contacting the Company, and exercise the other rights set forth in Chapter 3, Section 1 of the GDPR, including that of withdrawing consent, where envisaged: withdrawal of consent shall not however affect the lawfulness of processing based on the consent given prior to the withdrawal.

    

8. Complaints
   If you believe that your data are being processed in breach of the GDPR, you have the right to lodge a complaint with the Italian Supervisory Authority (whose details can be found at the website www.garanteprivacy.it), as envisaged by Art. 77 of the GDPR, or to take appropriate legal action (Art. 79 of the GDPR). Furthermore, you may also contact the Supervisory Authority of the state in which you habitually reside or work. The list of Supervisory Authorities can be found at the link www.garanteprivacy.it/home/footer/link).

    

9. Processing methods
   The data will be processed on the basis of computerised and paper/manual instruments, and suitable protection systems will be adopted to safeguard confidentiality. All data will be stored and processed in a manner that fully protects confidentiality in compliance with all regulations in force (and thus also in accordance with the principles of fairness, lawfulness and transparency and protection of confidentiality and rights) and strictly to pursue the purposes set out in this privacy policy. Only operations necessary to pursue the purposes set out in this privacy policy will be carried out on the data. The data will be stored, as far as the Company is concerned, at its headquarters or server farm and as far as the data processors are concerned, at their headquarters or server farms. Any data disclosed to third parties will be stored and processed by them independently. The data will also be arranged in databases, including computerised databases.
   

Privacy policy updated as of 20/03/2024.
Previous versions of the privacy policy can be obtained by contacting the Company using the contact details provided in point 6.