Privacy Policy
Information on the processing of personal data pursuant to Art. 13 GDPR.
This notice explains how we process personal data collected through www.kalikanuovaestetica.it. It covers data collected online only: data collected at the salon is handled separately and is covered by its own notice.
1. Data controller
- Data controller
- Kalika Nuovaestetica di Carretta Sabina
- Registered and operating office
- Via C. Battisti 26, int. 1 — 33080 Prata di Pordenone (PN), Italia
- VAT number
- 01660710938
- Tax code
- CRRSBN74H59Z133E
- Certified email (PEC)
- kalikanuovaestetica@legalmail.it
No Data Protection Officer has been appointed, as the conditions set out in Art. 37 GDPR do not apply.
2. What we collect and why
The website collects personal data only when you provide it voluntarily. We use no analytics tools, no profiling cookies, no advertising pixels and no third-party tracking systems.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Buyer's first name, last name and email; recipient's first and last name; optional personal message | Issuing, delivering and managing the purchased Gift Card | Performance of a contract to which you are party (Art. 6.1.b GDPR) | For the validity period of the Gift Card and thereafter for 10 years, for tax and accounting obligations (Art. 2220 Italian Civil Code) |
| Order data: amount, selected treatment, serial code, payment session identifier | Managing the purchase, customer support, accounting obligations | Performance of the contract (Art. 6.1.b) and legal obligation (Art. 6.1.c GDPR) | 10 years from issue |
| IP address, date and time of request, browser type (server technical logs) | Delivering the website, security and troubleshooting | Legitimate interest in infrastructure security (Art. 6.1.f GDPR) | Maximum 30 days, unless needed to investigate unlawful activity |
| Phone number and the content of messages sent via WhatsApp, phone or email | Responding to support or treatment information requests | Performance of pre-contractual measures at your request, or legitimate interest in providing assistance (Art. 6.1.b and 6.1.f GDPR) | For as long as needed to handle the request |
The WhatsApp button on the website opens a direct conversation with our number: the service is provided by WhatsApp Ireland Limited (Meta), which processes messages as an independent controller under its own notice, available at whatsapp.com/legal/privacy-policy. We process the content of the messages you send us solely to reply to you.
3. Payment data
Payments are handled entirely by Stripe. At checkout you are redirected to a secure Stripe page: your card details are entered there and never pass through our systems, nor are they seen or stored by us. From Stripe we receive only the payment confirmation, the amount and a transaction identifier.
Stripe processes payment data as an independent controller; see its notice at stripe.com/privacy.
4. Who we share data with
Data is never disclosed publicly, sold or transferred to third parties for marketing purposes. It is accessible only to the controller and to the technical providers that enable the service — website hosting, payment processing, transactional email delivery and content distribution — to the extent necessary to provide those services.
Data may also be shared with our accountant for bookkeeping obligations and with judicial authorities where required by law.
5. Transfers outside the European Union
Some of the providers listed above are based in the United States. Transfers are carried out on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) and, where applicable, adherence to the EU-U.S. Data Privacy Framework, which ensure an adequate level of protection. You may request a copy of the safeguards in place by writing to the addresses in section 1.
6. Is providing data mandatory?
Providing the data required to purchase a Gift Card is optional but necessary: without it we cannot issue or send the Gift Card.
7. Your rights
You may exercise the rights set out in Arts. 15-22 GDPR at any time:
- Access: find out what data we process and obtain a copy
- Rectification: correct inaccurate or incomplete data
- Erasure: have your data removed, within the limits of statutory retention obligations
- Restriction: ask us to suspend processing
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interest
To exercise them write to info@kalikanuovaestetica.it or kalikanuovaestetica@legalmail.it. We will reply within 30 days.
If you believe the processing infringes data protection law, you have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (garanteprivacy.it), or to bring proceedings before a court.
8. No profiling
We carry out no profiling and no automated decision-making producing legal effects concerning you (Art. 22 GDPR). We do not send marketing communications to anyone who has not expressly requested them.
9. Scope of this notice
This notice covers only data collected through the website. Data collected at the salon is handled separately, with its own records and privacy notice, provided directly at the centre.
10. Security and changes
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including traffic encryption (HTTPS) and access restricted to authorised persons only.
We may update this notice. The version in force is always published on this page, together with the date it was last updated.
Last updated: 2026