Personal data protection
Dermacol, a.s. | PERSONAL DATA PROCESSING AND PROTECTION POLICY AND COOKIE POLICY
PART I. PERSONAL DATA PROCESSING AND PROTECTION POLICY
1. Why we have this Policy
We want you to know how we handle your personal data. This Policy explains what we do with the data we obtain when you visit our website, communicate with us, register a User Account, purchase Goods through the E-shop or in the Store, use the Subscription, the Loyalty Programme and the Membership Programme, register on the Waiting List, subscribe to Commercial Communications, complete a contact form, participate in a competition, and otherwise use the services of the Fragrini Platform.
We only use the data we need for the relevant purpose. We protect it, do not disclose it to anyone unnecessarily, and retain it only for as long as we have a reason to do so. This Policy applies in particular to the website fragrini.com, web forms, registration and ordering interfaces, member sections, payment services (in particular Comgate), email communications, marketing communications, website analytics, marketing campaigns, social media and other online environments operated or used by the Provider. The terms for the sale of Goods, the provision of services and other performance are set out in the General Terms and Conditions of the Fragrini Platform (the "Terms and Conditions"), available on the website fragrini.com. This Policy and the Terms and Conditions are complementary to one another. Terms used in this Policy that are not defined herein shall have the meaning given to them in the Terms and Conditions. The term "website" as used in this Policy corresponds to the term "Website" within the meaning of the Terms and Conditions. In this Policy, "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). The processing of personal data is further governed by Act No. 110/2019 Coll., on the Processing of Personal Data, as amended. The sending of Commercial Communications is governed by Act No. 480/2004 Coll., on Certain Information Society Services, as amended.
2. Who is the data controller
The controller of personal data is Dermacol, a.s., Company ID No.: 247 66 298, with its registered office at Praha 6, Výtvarná 1023/4, Postcode 161 00, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. B 16659 (the "Controller" or the "Provider").
For all matters relating to the protection of personal data, you may write to us at [INSERT] or at our contact address [INSERT]. Telephone contact: [INSERT].
No data protection officer has been appointed. For all matters relating to the protection of personal data, please contact the above contact email address.
3. What data we process, why, and on what basis
The scope of the data depends on the situation in which you come into contact with us. An ordinary visit to the website looks different from a purchase of Goods, registration of a User Account, use of the Subscription, participation in the Loyalty Programme or the Membership Programme, subscription to Commercial Communications, participation in a competition, and an ongoing contractual relationship. Below we set out the main situations, categories of data, purposes and legal bases. In a specific case, we may not process all of the data listed. It always depends on what is necessary for the given purpose.
| Situation | What data we may process | Why we process it | Legal basis (purpose) |
|---|---|---|---|
| Ordinary visit to the Website | IP address, device type, browser, date and time of visit, technical data on website traffic. | To ensure the website functions properly, securely and reliably. | Legitimate interest in operating a secure and functional website. |
| Purchase of Goods (conclusion and performance of the Contract), including purchases in the Store | Name, surname, email address, telephone number, delivery and billing address, payment details, Order details, specification of the ordered Goods, chosen method of delivery and payment, Company ID No. (if provided), and, where applicable, details for registration in the Loyalty Programme or the Membership Programme. | To process the Order, conclude the Contract, deliver the Goods, process payment, communicate with the Customer, handle any Complaint, and perform related obligations. | Performance of the Contract; steps taken prior to entering into the Contract; compliance with legal obligations (in particular accounting and tax obligations). |
| Registration and administration of the User Account | Name, surname, email address, telephone number, date of birth, password (in encrypted form), perfume preferences, jewellery preferences, and other data provided by the Customer upon registration or within the User Account. | To establish and administer the User Account, enable management of Orders, the Subscription, participation in the Loyalty Programme and the Membership Programme, personalise content, and communicate with the Customer. | Performance of the Contract; legitimate interest in the proper operation of the Platform and personalisation of services. |
| Subscription (6 pcs / 12 pcs of Perfume Cartridges) | Data from the User Account, details of the chosen type of Subscription, payment details for Subscription payments, delivery address, delivery preferences, and other data necessary for administering the Subscription. | To process and administer the Subscription, ensure regular delivery of the Goods, process recurring payments, and communicate with the Customer regarding the status of the Subscription. | Performance of the Contract. |
| Loyalty Programme and Membership Programme | Data from the User Account, purchase history, points balance, benefits used, membership type, and other data necessary for administering participation in the programme. | To administer the Customer's participation in the Loyalty Programme and the Membership Programme, allocate points and benefits, record the use of discounts, and communicate about the programme. | Performance of the Contract; legitimate interest in operating the programme. |
| Waiting List (registration prior to the Launch Date) | Email address and, where applicable, other data provided upon registration on the Waiting List. | To keep records of interested parties, inform them of the Platform's launch, and send updates. | Consent; legitimate interest in communicating with interested parties. |
| Commercial Communications and marketing (newsletter, email, SMS, WhatsApp, push notifications) | Email address, telephone number, and, where applicable, name, surname, and information on how you engage with our communications. | To send you updates, information about Goods, promotions, the Subscription, the Loyalty Programme, the Membership Programme, and other activities of the Provider. | Consent; for existing Customers, also legitimate interest under the regime for sending commercial communications relating to similar goods and services, provided the Customer has not objected to receiving them. |
| Marketing campaigns, ad targeting, and automated communication | Data on website visits, responses to advertising, clicks, campaign source, advertising identifiers, conversion data, data from interaction via social media and communication tools, and similar online data. | To evaluate campaigns, measure conversions, carry out remarketing, display more relevant content or advertising, and communicate with interested parties through automated tools. | Consent. |
| Remarketing, personalised offers, and profiling | Data on purchase history, perfume and jewellery preferences, behaviour on the website, data from the User Account, and other online data. | To recommend relevant Goods, personalise offers, evaluate marketing campaigns, and carry out remarketing. | Consent; legitimate interest where permitted by law. |
| Competitions | Name, surname, email address, telephone number, date of birth, home address, purchase data, and other data required in connection with the specific competition. | To organise the competition, evaluate the results, contact the winners, and perform related obligations. | Consent; performance of the Contract (competition rules). |
| Complaints, claims arising from defective performance, and withdrawal from the Contract | Name, surname, contact details, data on the Goods complained of, description of the defect, proof of purchase, Order details, data on the returned Goods, and payment details for refunds. | To accept and handle the Complaint, assess whether the claim is justified, process withdrawal from the Contract, accept the returned Goods, refund payment, and communicate with the Customer. | Compliance with legal obligations; performance of the Contract. |
| Contact form and communication | Name, surname, email address, telephone number, message content, and other data you provide to us. | To respond to you, handle your enquiry, and ensure follow-up communication. | Steps taken prior to entering into the Contract; legitimate interest in handling the enquiry. |
| Website analytics | Data on website visits, pages visited, source of the visit, time spent on the pages, device type, approximate location, and similar online data. | To understand how the website is used, what is useful to visitors, and what we should improve. | Consent. |
| Compliance with statutory obligations and protection of rights and legitimate interests | Identification data, billing and accounting data, data needed for tax obligations and record-keeping, and data needed to evidence communications, contractual arrangements, payments, performance provided, and any claims. | To comply with accounting, tax, and other legal requirements and to protect our rights or the rights of third parties, and to resolve any disputes, Complaints, or grievances. | Compliance with a legal obligation; legitimate interest; establishment, exercise, or defence of legal claims. |
| References and reviews | Name, surname, rating, review, quote, or general description of the experience with the Goods, provided such processing is proportionate and we have an appropriate legal basis for it. | To present Customers' experiences and references on the Platform in a reasonable manner. | As a rule, consent, in particular where an identifiable reference, name, or quote is involved; exceptionally, another legal basis where permitted by law. |
| Suppliers and business partners | Identification, contact, contractual, accounting, and payment data of suppliers, business partners, and their contact persons. | To enter into and perform contracts, receive services, pay invoices, and comply with accounting and tax obligations. | Performance of the contract; compliance with legal obligations; legitimate interest in the Provider's business activities. |
If you provide us with details about a company or business, we may also process the company name, Company ID No., Tax ID No., registered office, or other identification data. In the case of a legal entity, this is not always personal data, but it may be personal data, for example, where it relates to a sole trader or where the data is linked to a specific contact person. We may, to a reasonable extent, verify the data you provide against public registers, records, or other publicly available sources, where necessary for the performance of the Contract or the protection of rights.
4. Where we obtain personal data from
We obtain most data directly from you, in particular upon registration of the User Account, upon purchase of Goods, upon registration on the Waiting List, upon completing the contact form, upon subscribing to Commercial Communications, upon participation in a competition, upon communication, or in the course of the contractual relationship. We obtain some data automatically when you visit the website through cookies and similar technologies (see Part II of this Policy). Depending on the nature of the matter, we may also obtain data from public registers, public records, or other publicly available sources.
5. Third-party data
When communicating with us or using the services of the Platform, you may also provide us with data about other persons. This may include, for example, the recipient of the Goods if different from the Customer, or another person to whom the matter relates. We use such data only to the extent necessary to handle the enquiry, perform the Contract, comply with legal obligations, or protect rights. Where appropriate and possible given the nature of the matter, please inform such persons that you are providing their data to us.
In certain situations, informing a third party would not be possible or appropriate, or could jeopardise the purpose of the processing or a legal claim. In such cases, we proceed in accordance with the GDPR and the applicable legal regulations.
6. Special categories of data
We do not, as a standard practice, request or systematically process special categories of personal data (for example, data concerning health, biometric data, data concerning racial or ethnic origin, political opinions, religious beliefs, trade union membership, or data concerning sex life or sexual orientation). If, in an exceptional case, a data subject voluntarily discloses such data to us (for example, information about an allergy to certain perfume ingredients or jewellery materials) and processing it is necessary for a specific purpose, we will process it only to the extent corresponding to that purpose and only on the relevant legal basis under Art. 9 GDPR or other applicable legislation. Unless another lawful ground applies, we will process such data only on the basis of explicit consent.
7. Processing based on consent
We process certain data only if you grant us consent to do so. This typically applies to analytical and marketing cookies and similar technologies, the sending of Commercial Communications (where no other legal basis applies), personalised marketing communications, participation in a competition, and, where required by law, other processing. Consent is voluntary and you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. We may retain a record of the granting, amendment, or withdrawal of consent, an objection, an unsubscribe from Commercial Communications, or the setting of cookie preferences for as long as necessary to demonstrate compliance with our legal obligations and to protect our rights. You may unsubscribe from Commercial Communications via the link included in each email or by writing to us at [INSERT]. For cookies, you may change or withdraw consent in the cookie settings on our website.
8. Marketing, profiling, and automated decision-making
For marketing purposes, we may evaluate how visitors use our website, where they come from, and how they respond to our communications or campaigns. Within our marketing platforms, contacts may undergo basic segmentation, for example, according to interest shown in a particular type of Goods, Subscription, programme, content, campaign, or communication channel, in particular for the purpose of sending more relevant content and evaluating marketing performance. Commercial Communications may be sent by email (using the Targito or Ecomail service), SMS, the WhatsApp application, or push notifications.
The Platform may carry out profiling and personalisation, in particular for the purpose of recommending Goods and tailoring marketing communications based on the Customer's purchase history and preferences. Automated processing may consist of evaluating data on purchase history, perfume and jewellery preferences, behaviour on the website, and other data from the User Account, for the purpose of displaying relevant offers and Goods recommendations. This processing does not produce legal effects for the Customer, nor does it similarly significantly affect the Customer, within the meaning of Art. 22 GDPR. Where we use segmentation, personalisation, or remarketing, we do so to the extent corresponding to the legal basis applied, generally on the basis of consent for cookies and similar technologies, or on the basis of legitimate interest where permitted by law.
9. To whom we may disclose data
We do not transfer your data to anyone unnecessarily. Access to it is limited to persons and suppliers who need it for a specific purpose and to the necessary extent. This may include, in particular, our employees and collaborators, administrative support staff, accountants, tax advisers, providers of hosting, IT, cloud and email services, website administrators, payment service providers, providers of tools for newsletters, analytics, marketing, advertising, social media, conversion measurement, consent management, and security, as well as the following categories of recipients:
Emorfiq s.r.o., as the provider of services relating to the operation of the E-shop and administration of the Platform; Zásilkovna s.r.o. and PPL CZ s.r.o., as the Carriers arranging delivery of the Goods; Comgate, a.s., as the operator of the Comgate Payment Gateway for processing online payments; the operator of the NG client database system; Meta Platforms, Inc. (or Meta Platforms Ireland Limited, as applicable), as the provider of the WhatsApp Business service, through which Commercial Communications and marketing communications may be sent, and further as the provider of marketing and remarketing tools (Facebook Pixel, Conversions API, Instagram), through which conversion measurement, remarketing, and ad targeting may take place, whereby the use of these tools involves the transfer of personal data (in particular the telephone number, the content of communications, online identifiers, data on website behaviour, and advertising identifiers) to this provider; [INSERT: provider of SMS gateway services for sending Commercial Communications via SMS]; [INSERT: provider of push notification services — e.g. Firebase/Google, OneSignal, or another]; the provider of email marketing services — Targito, or alternatively Ecomail; the provider of the Helios Nephrite ERP system; providers of analytical and marketing tools — Google Analytics and Power BI; [INSERT: any further processors of personal data]; providers of accounting, tax, legal, and other professional services; and public authorities in cases stipulated by law.
Emorfiq s.r.o. acts as our processor within the meaning of Art. 28 GDPR. Comgate, a.s. acts as an independent controller of personal data when processing payment transactions and processes data in accordance with its own privacy policy. Meta Platforms, Inc. (or Meta Platforms Ireland Limited, as applicable) generally acts as an independent controller of personal data when providing the WhatsApp Business service in respect of sending Commercial Communications and marketing communications, unless a different status follows from the specific contractual arrangement or the nature of the service; details of Meta's data processing are available at facebook.com/privacy/policy. For other providers, the specific role may vary depending on the nature of the service and the manner of processing; some act as our processors, others as independent controllers, and in limited cases there may be a joint controller relationship, depending on the nature of the specific tool or service. We always endeavour to use only suppliers that provide adequate safeguards for the protection of personal data and are adequately secured by contract or by law. In cases stipulated by law, we may be required to disclose certain data to public authorities or other authorised bodies.
10. Transfers of data outside the European Union
Some of the service providers we use, in particular providers of analytical, advertising, marketing, communication, or cloud tools, may process personal data also outside the European Union or the European Economic Area, in particular in the USA — for example, Google Analytics, Meta Platforms (Facebook, Instagram), and Power BI. Data may also be transferred outside the EU/EEA in connection with the use of the WhatsApp Business service (Meta Platforms, Inc.), through which Commercial Communications may be sent, and, where applicable, in connection with other communication tools, such as SMS gateway or push notification services, where their providers are established or process data outside the EU/EEA. Where such a transfer takes place, it is carried out only under the conditions laid down by law, in particular on the basis of a European Commission adequacy decision, standard contractual clauses, supplementary safeguards, or other appropriate safeguards under the GDPR. The specific transfer mechanism may vary between individual providers and may change over time depending on regulatory developments. We provide up-to-date information on specific recipients, categories of tools, and any transfers outside the EU/EEA in this Policy, in the cookie settings on our website, or in the information provided by the relevant providers, where appropriate given the nature of the tool.
11. How long we retain data
We retain personal data only for as long as we need it for the given purpose, or for as long as required by law. Unless stated otherwise below, we set the retention period appropriately according to the nature of the processing, the purpose, and any potential legal claims.
| Category of data | Retention period |
|---|---|
| Technical data from website operation | For as long as necessary to ensure the functioning, security, and routine administration of the website; generally only for a limited period depending on hosting and security settings. |
| Purchase of Goods (contractual relationship) | For the duration of the contractual relationship and thereafter for the period following from statutory, accounting, and tax obligations and the protection of legal claims; generally 5 to 10 years depending on the type of document. |
| User Account | For the duration of the User Account. After the account is cancelled, for a reasonable period necessary to protect rights and comply with legal obligations. |
| Subscription, Loyalty Programme, and Membership Programme | For the duration of the Subscription or participation in the programme and thereafter for a reasonable period necessary to protect rights, comply with legal obligations, and comply with accounting and tax obligations. |
| Waiting List | For the duration of the consent or until it is withdrawn; a basic record of registration for as long as necessary to demonstrate compliance with legal obligations. |
| Commercial Communications and marketing | For the duration of the consent or until unsubscribing; for existing Customers, for the duration of the contractual relationship and a reasonable period thereafter, provided the Customer has not objected to receiving communications. A basic record of consent, unsubscribing, or objection for as long as necessary to demonstrate compliance with legal obligations. |
| Analytical and marketing cookies | For the period specified in the cookie settings on the website, or until consent is withdrawn. |
| Competitions | For the duration of the competition and thereafter for 5 years from the end of the competition; longer only where there is a legal ground for doing so. |
| Contact enquiries and communication | For as long as necessary to handle the enquiry and follow-up communication; if the enquiry does not give rise to a contractual relationship, generally no longer than 3 years from the last communication. |
| Accounting, tax, and billing data | For the period set out in accounting and tax regulations, generally 5 to 10 years depending on the type of document. |
| References and reviews | For the duration of the consent or until it is withdrawn; to a reasonable extent, also for as long as necessary to demonstrate the lawfulness of publishing or the withdrawal of a reference. |
| Complaints, withdrawal from the Contract, and protection of legal claims | For as long as necessary to handle the Complaint or withdrawal, and thereafter for the duration of the relevant limitation, preclusion, supervisory, or procedural periods and for the duration of any proceedings. |
12. Is the provision of data mandatory
Visiting our website is voluntary. If you wish to purchase Goods, register a User Account, or use the services of the Platform, we need at least such data from you as will allow us to process your request. Without it, we may not be able to process the Order, conclude the Contract, or provide the service. If you become our Customer, we need certain data to conclude and perform the Contract. We are required by law to process certain data, for example for accounting or tax purposes. Without such data, we may not be able to provide or continue providing the services. Consent to Commercial Communications, analytical cookies, marketing cookies, or participation in a competition is voluntary. If you do not grant it, this does not affect your ability to purchase Goods or the functionality of the website, except where a particular optional feature is based on consent.
13. What rights you have
You have the right to know what personal data we process about you. You may ask us for access to your data, its rectification, erasure, or restriction of processing. In certain cases, you may object to processing, in particular where we process data on the basis of legitimate interest. If we process data for direct marketing purposes, you may object to such processing at any time. If processing is based on your consent, you may withdraw your consent at any time. If we process data by automated means on the basis of consent or the Contract and you have provided the data to us, you may in certain cases also request its portability. You also have the right to lodge a complaint with the Office for Personal Data Protection.
In connection with the processing of personal data, you have, in particular, the following specific rights:
| Right of access to your personal data (Art. 15 GDPR) | You have the right to obtain confirmation from the Controller as to whether your personal data is being processed, and, if so, the right to obtain access to that data and to information about its processing, including a free copy of the personal data being processed. |
| Right to rectification (Art. 16 GDPR) | You have the right to have the Controller rectify, without undue delay, inaccurate personal data concerning you, and to have incomplete personal data completed. |
| Right to erasure (Art. 17 GDPR) | You have the right to have the Controller erase, without undue delay, personal data concerning you, provided the conditions set out in the GDPR are met. |
| Right to restriction of processing (Art. 18 GDPR) | You may request restriction of processing under the conditions set out in the GDPR. |
| Right to data portability (Art. 20 GDPR) | You have the right to receive the personal data that you have provided to the Controller and that is processed by automated means on the basis of consent or the Contract, in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. |
| Right to object (Art. 21 GDPR) | You have the right to object at any time to the processing of personal data concerning you, where the processing is based on the Controller's legitimate interest, and, in particular, you have the right to object at any time to processing for direct marketing purposes, including profiling. |
| Right to withdraw consent | Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal. |
| Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) | You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. The supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.cz. Alternatively, you may lodge a complaint with the supervisory authority of the EU/EEA member state of your habitual residence, place of work, or the place of the alleged infringement. A list of the supervisory authorities of the EU/EEA member states, with links to their websites, is available at the website of the European Data Protection Board (edpb.europa.eu). |
The exercise of certain rights may be limited where necessary, for example, to protect the rights of others, to comply with legal obligations, or to protect legal claims. If a request is repetitive or manifestly unfounded, we are entitled to charge a reasonable fee for exercising the right in question, or to refuse to act on it. We will inform you of the relevant procedure.
14. How to exercise your rights and who to contact
If you have any questions or requests relating to the protection of personal data, please write to us at [INSERT]. We will respond to your request without undue delay, generally no later than within one month. In justified cases, we may extend this period in accordance with the GDPR. To protect your data, we may verify your identity by reasonable means. If you feel that we are not handling your data properly, you may also contact the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, website www.uoou.cz, or, where applicable, the supervisory authority in your own country of habitual residence, place of work, or the place of the alleged infringement. A list of the supervisory authorities of the EU/EEA member states, with links to their websites, is available at the website of the European Data Protection Board (edpb.europa.eu).
15. Confidentiality
We treat as confidential the information you provide to us in connection with the purchase of Goods, registration, use of the Platform's services, or other communications, and we handle it in accordance with this Policy and the applicable legal regulations. We undertake to protect the confidentiality of the information you provide to us and not to disclose it to third parties beyond the scope set out in this Policy, unless required to do so by law or unless we have your consent. The duty of confidentiality may also affect the exercise of certain rights under the GDPR, where exercising them would interfere with the rights of other persons or with the confidentiality of the information provided.
16. Technology and security
In operating the Platform, we use modern technologies and online tools, including payment services, communication tools, and analytical solutions. We always pay attention to the confidentiality and security of data. Where we rely on technology suppliers, we select them with regard to security, confidentiality, and adequate contractual safeguards.
17. Effective date and updates
This Policy is effective from 25 July 2026. We may update this Policy to a reasonable extent, in particular if the website, the tools used, applicable law, our services, or the manner in which we process personal data change. The current version can always be found on the website fragrini.cz.
PART II. COOKIE POLICY
1. What are cookies
On the website fragrini.cz, we use cookies and similar technologies, in particular pixels, tags, SDKs, local storage, and other online identifiers. These technologies are stored on your device or work with information stored on it, and help ensure the functioning of the website, its security, analytics, performance measurement, and marketing. Necessary technologies allow us to operate the website and provide its basic functions. With your consent, we may also use analytical and marketing technologies that help us understand how the website is used, evaluate campaigns, measure conversions, carry out remarketing, and display more relevant content or advertising.
2. What cookies we use
We use cookies and similar technologies to the extent necessary to operate the website, or to the extent you have permitted through your consent settings. We distinguish in particular necessary, analytical, and marketing technologies. Where a tool serves multiple functions, its activation is governed by the category and the settings in the consent management tool.
| Type of cookie | What it is used for | Is consent required? |
|---|---|---|
| Necessary cookies | Ensure the basic functioning, security, and correct display of the website. Without them, the website may not function properly. | No. We use them because they are necessary for the operation and security of the website. |
| Analytical cookies | Help us find out how visitors use the website, which pages are visited, where visitors come from, and what we should improve. These cookies do not collect information capable of identifying you. | Yes. We use them only with your consent. |
| Marketing cookies | Help us evaluate advertising and marketing campaigns, measure conversions, carry out remarketing, and display more relevant content or advertising. | Yes. We use them only with your consent. |
3. Analytics and marketing campaigns
If you grant us consent, we may use third-party analytical and marketing tools. This may include, in particular, tools for measuring website traffic, analysing user behaviour, managing advertising campaigns, remarketing, measuring conversions, automated marketing communication, consent management, or evaluating the performance of content and campaigns. These tools may work with online identifiers, information about your device, browser, website visit, source of the visit, on-page behaviour, clicks, conversions, advertising identifiers, or similar data. Depending on the nature of the tool, information may be stored on or read from your device, or events may be transmitted server-side. The specific scope of the technologies used may change over time depending on the technical solution of the website and the marketing tools. The current categories, specific technologies, and their activation are governed by the settings in the consent management tool, which is available on your first visit to the website and subsequently also via the link for changing cookie preferences.
Specific list of tools and cookies we use:
| Tool | What it is used for | Further detail |
|---|---|---|
| Google Analytics | Used to generate reports and statistics on the performance of our website and to present content tailored to your interests. | We use it for web analytics, traffic statistics, and evaluating the performance of the website and content. It is activated only on the basis of consent, unless another lawful regime applies to the specific configuration. Details of data processing by Google Analytics are available at policies.google.com/privacy. |
| Meta / Facebook / Instagram | Tools enabling advertisements to be displayed to website users when visiting the Facebook / Instagram social network, or possibly other websites that also use these tools. | We use it for marketing, remarketing, conversion measurement, and management of advertising audiences and campaigns. Activation is subject to consent, unless otherwise provided by law. Details of data processing by Meta are available at facebook.com/privacy/policy. |
| Helios Nephrite | Corporate information system for managing business processes, orders, inventory management, and other internal agendas of the Provider. Helios Nephrite is not deployed as a web analytics or marketing tool and does not store cookies on the website. | Helios Nephrite is operated as an internal system of the Provider. Customers' personal data may be processed in this system to the extent necessary for the performance of the Contract and statutory obligations. Helios Nephrite does not store cookies on the Provider's website. |
| Power BI | Tool for internal analysis, data visualisation, and reporting. Power BI is used to evaluate the Provider's business data and is not deployed as a web analytics tool that would store cookies on the website. | Power BI is operated as an internal tool of the Provider for data analysis and visualisation. Customers' personal data may be processed in this system in aggregated or anonymised form. Power BI does not store cookies on the Provider's website. The service provider is Microsoft; data may be transferred outside the EU/EEA. |
| Cookie Consent Management Tool – Cookie Script | Tool for managing cookie consents on the website. Allows visitors to choose which categories of cookies to permit and retains records of consents granted. | We use it to record and manage consents, refusals, and changes to preferences. This tool may store a record of the visitor's choice and related technical data for the purpose of demonstrating compliance with the law. |
| email marketing tool – Targito, or alternatively Ecomail | Tool for sending Commercial Communications, newsletters, and marketing communications via email, or possibly SMS. It may process the email address, name, open and click history, and other data relating to marketing communications. | Activation is subject to consent or another legal basis. Details of data processing are available on the provider's website. |
| WhatsApp Business (Meta Platforms, Inc.) | Communication tool for sending Commercial Communications and marketing communications via the WhatsApp application. Sending messages involves the transfer of personal data (in particular the telephone number and communication metadata) to Meta Platforms, Inc. | We use it for sending Commercial Communications and marketing communications via WhatsApp. Activation is subject to consent or another legal basis. Meta Platforms, Inc. generally acts as an independent controller of personal data. Data may be transferred outside the EU/EEA. Details of data processing are available at facebook.com/privacy/policy. |
| [INSERT — push notification provider, e.g. Firebase/Google, OneSignal, or another] | Communication tool for sending push notifications containing Commercial Communications and marketing communications. Sending push notifications may involve the transfer of personal data (in particular device identifiers) to the service provider. | [INSERT — Activation is subject to consent or another legal basis. Details of data processing and the provider's processing role will be confirmed following confirmation from IT.] |
| [INSERT — SMS gateway provider] | Communication tool for sending Commercial Communications and marketing communications via SMS. Sending messages involves the transfer of personal data (in particular the telephone number) to the SMS gateway provider. | [INSERT — Activation is subject to consent or another legal basis. Details of data processing and the provider's processing role will be confirmed following confirmation from IT.] |
| Comgate Payment Gateway | The payment gateway processes data necessary for carrying out payment transactions, in particular payment details, identification data, IP address, and device data. In connection with the payment process, Comgate may store its own cookies or similar technologies for the purpose of securing transactions, preventing fraud, and complying with regulatory obligations. Comgate acts as an independent controller of personal data when processing payments. | Details of data processing by Comgate are available on the provider's website. |
| [INSERT — any further analytical, marketing, or operational tools deployed on the website] | [INSERT — description of the tool's purpose and function] | [INSERT — details of data processing and a link to the provider's policy] |
If the technical configuration of the website changes, we will also update this list.
4. How you can set your cookie preferences
On your first visit to the website, you can use the cookie banner or a similar interface to select which categories of cookies and similar technologies you consent to. The settings must allow a free, specific, informed, and unambiguous expression of your choice. You may accept all optional categories, reject all optional categories and retain only necessary technologies, or configure individual categories separately, where the tool used allows this. Analytical and marketing technologies are not active until you grant consent to them, unless the law provides otherwise for a specific technical solution. Refusing or withdrawing consent must be as easy as giving it. You may change or withdraw consent at any time in the cookie settings on the website. The link or interface for changing cookie preferences should remain available to visitors even after their initial choice, for example in the website footer or through a permanently available control. If you reject analytical or marketing cookies, the website will continue to work for you. We will simply have less information about how the website is used and will not be able to tailor marketing content to you.
5. Cookie settings in your browser
You can also restrict or block cookies in your internet browser. Most browsers allow you to delete cookies, block them, or set rules for individual websites. However, if you also block necessary cookies, some parts of the website may not function properly.
6. Social media and third-party services
We may use links or elements of social media and other third-party services on the website. If you click on or interact with such an element, data may be transferred to the relevant provider. Further processing is then governed by the rules of that social network or provider.
7. Transfers of data outside the European Union
Some providers of analytical, marketing, or communication tools may process data also outside the European Union or the European Economic Area, in particular in the USA. Where such a transfer takes place, it is carried out only under the conditions laid down by law, in particular on the basis of a European Commission adequacy decision, standard contractual clauses, or other appropriate safeguards. Details may vary depending on the specific tool and provider.
8. How long we retain cookies
The storage period for cookies varies depending on their type and the specific tool. Some cookies are deleted when the browser is closed, while others remain stored for longer. We provide the specific storage period for individual cookies in the cookie settings on the website.
9. Changes to the use of cookies
The cookies, similar technologies, and related tools used may change over time as the website, services, campaigns, and technical solutions evolve. If a material change occurs in the categories or purposes, this change will be reflected in the consent settings and, where applicable, in this Policy. The current categories, the specific list of technologies used, and their storage or activation periods can always be found in the cookie settings on the website.
10. Recommended wording of the cookie banner
We use necessary cookies and similar technologies to ensure our website functions properly, is secure, and displays correctly. With your consent, we also use analytical and marketing technologies that help us measure traffic, evaluate campaigns, improve the website, and display more relevant content or advertising. You can change your settings or withdraw consent at any time. Recommended buttons: Accept all; Reject all except necessary; Set preferences.
This Cookie Policy is effective from 25 July 2026.
fragrini.com