Privacy policy

Last updated: October 7, 2026

Aurea Cosmetics operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a suitable shopping experience (the "Services"). The Services are powered by Shopify.

This Privacy Policy describes how we collect, use and disclose your personal data when you visit or use the Services, make a purchase, or communicate with us. In the event of a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails with respect to the collection, processing and disclosure of your personal data.

By using the Services, you confirm that you have read and understood this Privacy Policy.

1. Data controller

The data controller of your personal data is Giarrizzo Sales S.r.l.s. (trading as "Aurea Cosmetics"), Via Francicanava 12, 95030 Sant'Agata li Battiati (CT), Italy. Email: info@aureacosmetic.it.

2. Personal data we collect

Depending on how you interact with the Services, we may collect:

  • Contact details: name, billing and shipping address, telephone number, email address.
  • Financial data: payment card details and transaction details. Payments are processed by Shopify Payments and other payment providers; we do not store your full card number.
  • Account data: username, password, preferences and settings.
  • Transaction data: products viewed, added to cart or purchased, returns, exchanges and order history.
  • Communications: information you include in messages to us, for example customer support requests, and product reviews you submit.
  • Device information: browser type, IP address, device identifiers, operating system and network information.
  • Usage information: pages visited, time spent on pages, links clicked and how you arrived at the Services.

We do not ask for, and do not intentionally collect, information about your health. Please do not send us health information unless it is necessary for a specific customer support request.

3. Sources of personal data

  • Directly from you, when you place an order, create an account, subscribe to our communications, leave a review or contact us.
  • Automatically, through cookies, pixels and similar technologies (see Section 6).
  • From service providers, such as Shopify, payment processors and shipping carriers.
  • From advertising and marketing partners, such as Meta (Facebook and Instagram), for example information about how you interacted with our ads.

4. How we use your personal data and legal bases

Purpose Legal basis (GDPR)
Processing orders and payments, shipping, returns, exchanges and account management Performance of a contract (Art. 6(1)(b))
Customer support and communications about your orders Performance of a contract; legitimate interest (Art. 6(1)(f))
Sending marketing emails and SMS Consent (Art. 6(1)(a)); or, for existing customers and similar products, legitimate interest ("soft opt-in") where permitted by law
Personalised advertising, retargeting and ad measurement through cookies and pixels Consent (Art. 6(1)(a))
Website analytics and improving the Services Consent, where cookies are not strictly necessary
Security, fraud prevention and protection of our rights Legitimate interest (Art. 6(1)(f))
Accounting, tax and other legal obligations Legal obligation (Art. 6(1)(c))

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

5. How we disclose personal data

We may share your personal data with:

  • Shopify and other service providers acting on our behalf, including IT and hosting, payment processing, analytics, email and SMS marketing, customer support, review management and shipping carriers.
  • Advertising and marketing partners, including Meta Platforms, Inc. and Meta Platforms Ireland Ltd., to measure and personalise advertising (see Section 6).
  • Third parties you authorise, for example the carrier that delivers your order.
  • Parties involved in a business transaction, such as a merger, acquisition or sale of all or part of our business.
  • Public authorities, where required by law or to protect our rights or the rights of others.

6. Cookies, pixels and advertising

We use cookies, pixels and similar technologies, including the Meta Pixel and the Meta Conversions API, to:

  • make the Services work properly;
  • understand how you use the Services;
  • measure the effectiveness of our advertising;
  • show you relevant ads on other websites and platforms, such as Facebook and Instagram.

Third parties, including Meta, may use cookies, web beacons and other storage technologies to collect or receive information from our website and elsewhere on the internet. They use that information to provide measurement services and to target ads. When you take actions on our website, such as viewing a product, adding a product to your cart or completing a purchase, information about those actions may be sent to Meta. This information can include your IP address, device information and, in hashed (encrypted) form, your email address or telephone number. Meta may combine this information with other information it holds about you, in accordance with Meta's Privacy Policy (facebook.com/privacy/policy).

Your consent. For users in the European Economic Area, the United Kingdom and Switzerland, cookies and pixels that are not strictly necessary, including the Meta Pixel, are activated only after you give your consent through our cookie banner. You can change or withdraw your consent at any time using the "Cookie settings" link at the bottom of every page.

How to opt out of interest-based advertising:

  • Facebook and Instagram ad preferences: facebook.com/adpreferences
  • European Interactive Digital Advertising Alliance: www.youronlinechoices.eu
  • Digital Advertising Alliance (US): www.aboutads.info/choices
  • Your browser settings, which let you block or delete cookies.

If you opt out, you will still see ads, but they may be less relevant to you.

7. Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal data about your access to and use of the Services. For more information, see Shopify's Consumer Privacy Policy (shopify.com/legal/privacy/app-users) and Shopify's Privacy Portal (privacy.shopify.com/en).

8. International transfers

Some of our service providers, including Shopify and Meta, may process your personal data outside the European Economic Area, for example in the United States or Canada. When this happens, we rely on appropriate safeguards, such as the European Commission's adequacy decisions (including the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses.

9. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy:

  • Order and invoicing data: 10 years, as required by Italian tax and accounting law.
  • Account data: until you delete your account, or after [24] months of inactivity.
  • Marketing data: until you unsubscribe or withdraw your consent, or after [24] months without interaction.
  • Customer support communications: up to [24] months after the request is closed.
  • Cookie consent preferences: up to 12 months, after which we will ask for your consent again.

10. Data security

We use appropriate technical and organisational measures to protect your personal data. However, no security measure is perfect or impenetrable, and we cannot guarantee the absolute security of your information.

11. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you;
  • correct inaccurate data;
  • delete your data;
  • receive a copy of your data and have it transferred to another provider (portability);
  • object to processing based on our legitimate interests, including profiling for direct marketing;
  • restrict processing in certain circumstances;
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it;
  • unsubscribe from marketing emails or SMS at any time, using the link or instructions in each message.

To exercise your rights, write to info@aureacosmetic.it. We will respond within one month. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). If you live in another EEA country, you can contact your local authority (edpb.europa.eu/about-edpb/about-edpb/members).

12. Notice for U.S. residents

Residents of certain U.S. states, including California, Colorado, Connecticut, Virginia, Texas and Oregon, have additional rights under state privacy laws.

Categories of data. In the past 12 months we have collected the categories of personal data listed in Section 2, from the sources listed in Section 3, for the purposes listed in Section 4.

Sale and sharing for targeted advertising. We do not sell personal data for money. However, sharing personal data with advertising partners such as Meta for cross-context behavioural advertising may be considered a "sale" or "sharing" under some state laws. You can opt out by:

  • clicking "Do Not Sell or Share My Personal Information" at the bottom of our website; or
  • enabling the Global Privacy Control (GPC) signal in your browser, which we honour.

Your rights. You may have the right to know, access, correct and delete your personal data, to opt out of targeted advertising, and to appeal our decision on your request. To exercise these rights, write to info@aureacosmetic.it. You may use an authorised agent to submit a request on your behalf. We will not discriminate against you for exercising your rights.

Sensitive and consumer health data. We do not knowingly collect, use or share sensitive personal data or consumer health data for advertising purposes.

We do not knowingly sell or share the personal data of consumers under 16 years of age.

13. Children's data

The Services are not intended for people under 18, and we do not knowingly collect personal data from minors. If you are a parent or guardian and believe that a minor has provided us with personal data, please contact us and we will delete it.

14. Third-party websites

The Services may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites, and we encourage you to read their privacy policies.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, where the changes are significant, we will notify you by email or through the Services.

16. Contact

For questions about this Policy or to exercise your rights:

Giarrizzo Sales S.r.l.s. (trading as "Aurea Cosmetics")
Via Francicanava 12, 95030 Sant'Agata li Battiati (CT), Italy
Email: info@aureacosmetic.it