Privacy Policy

Who this policy applies to

This policy describes how Colony Italia Srl processes the personal data of users who visit the site magicskin.club and of those who make purchases through it. Please read it carefully before providing any personal data.

Art. 1 — Data Controller

The Data Controller for personal data collected through magicskin.club is:

Art. 2 — Data collected and purposes

Colony Italia Srl collects the following personal data for the purposes indicated:

2.1 Data provided by the user during browsing and purchase

• First and last name
• Email address
• Phone number
• Billing and shipping address
• Order-related data

Purpose: execution of the sales contract, order management, communications relating to shipping and after-sales support.
Legal basis: performance of a contract (Art. 6.1.b GDPR).

2.2 Payment data

Payments made by credit card, debit card or other electronic instruments are processed exclusively by Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA. Colony Italia Srl does not access or store complete payment card data. Transmission takes place securely and in encrypted form directly to Stripe’s servers.

Bank transfer payments are handled directly by the customer’s bank. The customer’s banking details are not retained by Colony Italia Srl beyond what is necessary for accounting reconciliation.

2.3 Browsing data

• IP address
• Browser type and device used
• Pages visited and duration of visit
• Date and time of access

Purpose: site security, prevention of fraudulent activity, improvement of the user experience.
Legal basis: legitimate interest of the Controller (Art. 6.1.f GDPR).

2.4 Marketing communications (newsletter)

Where the user gives explicit consent, contact data may be used to send promotional communications and newsletters relating to products and offers from magicskin.club.

Legal basis: consent of the data subject (Art. 6.1.a GDPR). Consent may be withdrawn at any time by sending an email to roberto@robertograndis.com or via the unsubscribe link in any communication.

Art. 3 — Recipients of data

The personal data collected may be shared with the following categories of recipients, strictly limited to the purposes indicated:

• GLS Italy S.p.A. — courier for managing shipments within Italy and Europe
• FedEx International — courier for managing international shipments
• Stripe Inc. — electronic payment processor (independent data controller for payment data)
• Hosting and site infrastructure service provider
• Transactional email service provider (order confirmations, shipping updates)
• Professional and business consultants (accountant, legal adviser), limited to tax and legal obligations
• Public authorities, where required by applicable law

Data is not sold or transferred to third parties for their own commercial purposes.

Art. 4 — Transfer of data to third countries

Stripe Inc. is based in the United States. The transfer of data to Stripe takes place in compliance with the safeguards required by the GDPR, as Stripe adheres to the EU-US Data Privacy Framework and has adopted the Standard Contractual Clauses approved by the European Commission. For more information: stripe.com/privacy

Where other providers process data in countries outside the European Economic Area, we ensure that adequate safeguards under Arts. 46–49 of the GDPR are in place.

Art. 5 — Data retention

• Order and billing data: 10 years, in compliance with Italian tax obligations
• Browsing data and technical logs: maximum 12 months
• Marketing communication data: until consent is withdrawn, and in any case no longer than 24 months from the last interaction
• Complaints and returns data: 3 years from the conclusion of the matter

Art. 6 — Your rights

You have the right to exercise, at any time, the following rights against Colony Italia Srl:

• Right of access to your personal data (Art. 15 GDPR)
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Right to erasure (“right to be forgotten”) (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise your rights, please write to: roberto@robertograndis.com.
Colony Italia Srl will respond within 30 days of receiving the request.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), reachable at www.gpdp.it.

Art. 7 — Cookies

The site magicskin.club uses technical cookies necessary for its operation. For the use of analytical or profiling cookies, prior consent will be requested via a dedicated banner. For detailed information, please refer to the Cookie Policy available on the site.

Art. 8 — Changes to this policy

Colony Italia Srl reserves the right to update this policy at any time. The date at the bottom of the page indicates the last revision. We recommend checking it periodically.