PRIVACY POLICY

In compliance with the provisions of Regulation (EU) 679/2016 Most recent update: 01/08/2025

We have the pleasure and duty to provide the following information about the processing of personal data, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Type of personal data collected

The following personal data is collected and processed by Lacuna and its affiliated companies (hereinafter referred to as "Lacuna Affiliates"), for the purposes outlined below:

a) personal and identifying data like your name, surname, date of birth, proof of identity, images recorded during store visits (where CCTV is in place), voice recorded during calls to a Lacuna sales service, payment information in the event of purchases made online or in stores;

b) data from interactions including information collected during store visits, like use of the Wi-Fi system, while participating in events or making online purchases, when you sign up to loyalty programs (e.g., birthday, age group, dates of family events, profession, hobbies, purchases, use of particular social media or social media ID, phone number, email address, photograph, nationality, gender, language, favorite product categories, details of products purchased, sizes, prices, discounts, statistical spending levels, abandoned shopping carts, ways in which services are used), preferences and interests disclosed by the user over the course of your interactions with advisors in store (including preferences about our collections or other luxury brands, sizes, lifestyle, or basic information about your family circle), responses to contact activities, data which may also include health-related information regarding potential side effects of our cosmetic products;

c) data collected when browsing or using media applications, including information about the behavior of the user recorded using cookies or similar technology, as described in more detail in the Cookies Policy available online at https://www.atelierlacuna.com/cookies-policy, or data contained in your “Wish List”;

d) the personal data provided by you in order to report illegal conduct or violations of Lacuna’s Code of Conduct (so-called "whistleblowing"). The lawful basis for such processing is: a) the Controller's legitimate interest, pursuant to Art. 6, paragraph 1, sub-section f) of the GDPR, who, having been made aware of the report raised by you, intends to protect and preserve all company assets; b) where there is a regulatory requirement, the processing of personal data is connected to the need to adhere to legal requirements to which the Controller is subject; and c) the need to ascertain, exercise, or defend a right in court, should this need arise.

Should the personal data of the parties involved need to be communicated, the lawful basis is the consent of the interested party pursuant to Art. 6, paragraph 1, sub-section a) of GDPR.

Personal data is collected directly from the user (e.g., when creating an account on our websites/apps, making a purchase, or interacting with our in-store advisors or Client Services), collected passively (e.g., using tracking tools like browser cookies), or collected via third parties (e.g., social media platforms). If the user provides information relating to third parties, the user declares that they are authorized to provide such information and undertakes to share the contents of this policy with the interested parties.

2. Processing purpose

Lacuna processes the data provided by you for the following purposes:

a) The data referred to in points 1.a), 1.b), and 1.c) is processed by Lacuna and Lacuna Affiliates for contractual purposes (Article 6, paragraph 1, sub-section b of the GDPR), namely: (i) managing the sale of its products and providing sale and after-sale services (including, for example, fraud prevention, returns, product warranties, and customer support); (ii) in the context of Lacuna’s online activities, creating and maintaining your customer account and providing the services offered via its website, including clienteling services (which call for a personalized service from your trusted advisor); (iii) consulting the production chain of certain items purchased by you, registering or transferring ownership, as well as downloading—and later giving to third parties—possible NFTs associated with said product; and (iv) checking your information requests;

b) The data referred to in points 1.a) and 1.d) is processed by Lacuna and Lacuna Affiliates to fulfill legal obligations to which Lacuna is subject, including the performance of so-called “Know Your Customer” activities (Article 6, paragraph 1, sub-section c) of the GDPR);

c) The data referred to in points 1.a), 1.b), and 1.c) is processed by Lacuna and Lacuna Affiliates for marketing and profiling purposes, i.e., to send you, with your prior consent (Art. 6, paragraph 1, sub-section a)), marketing communications regarding Lacuna products, services, and exclusive activities via electronic means (such as email, SMS, MMS, mobile, social media, and chats) or in paper format (e.g., traditional post); offers for personalized sales services (including but not limited to personal shopping services, free assistance services, and courtesy services); satisfaction questionnaires for products and/or services offered, including by third parties; preferences and shopping habits at Lacuna to improve the service offered; use of virtual try-on features;

d) The data referred to in points 1.a), 1.b), 1.c), and 1.d) is processed for the pursuit of a Legitimate Interest of Lacuna and/or Lacuna Affiliates (Article 6, paragraph 1, sub-section f of the GDPR), namely to defend Lacuna’s rights in court or out of court.

3. Provision of data

The provision of personal data in relation to the purposes outlined in paragraph 2, sub-sections a) and b), is obligatory, and if it is not provided, Lacuna Affiliates cannot proceed with the contractual services requested. For the purposes detailed in paragraph 2, sub-section c), provision of data is free and optional, and the use of such data is subject to the consent of the interested party. Denial thereof would not allow Lacuna Affiliates to achieve the indicated purposes. Providing personal data for the purposes outlined in paragraph 2, sub-section d), is optional. However, failure to do so could compromise or limit the provision of the services offered by Lacuna or, in the case of processing related to whistleblowing, the investigation of the report: anonymous reports will only be taken into consideration if they are presented in adequate detail and provided with sufficient information to reveal facts and circumstances related to the specific contexts.

4. Conditions applicable to the consent of minors

Processing the personal data of minors is lawful provided they are at least 16 years of age. If a minor is younger than 16 years of age, processing this data is only lawful if, and where, consent is provided or authorized by the holder of parental responsibility. We do not knowingly collect personally identifiable information from minors without permission from a parent or guardian, unless permitted by law.

5. Processing method

Personal data will be processed using IT-based tools and/or processed manually for the length of time needed to achieve the purpose for which it was collected. In particular, personal data collected for the purposes outlined in paragraph 2 will also be processed with the help of automated tools, according to procedures and reasoning strictly related to the purposes specified above.

6. Entering of data in the CRM system

The entering of personal data in the CRM system is optional and only takes place if expressly requested by the Client, by filling out the appropriate form. Once in the CRM system, Lacuna employees across the world, tasked with data processing, will automatically be able to view, change, and revise the information. The data may be used for marketing and profiling purposes only upon receipt of the specific consent referred to in point 2.c).

7. Scope of communication, transfer abroad, and publication of data

We do not disclose or share the personal data we collect, except with Lacuna and its parent companies, subsidiary companies, associate companies, or companies under the same control (a complete list of which can be requested by emailing: clientcare@atelierlacuna.com), in order to offer users the same level of services worldwide. In this regard, it should be noted that the ‘Standard Contractual Clauses’ prepared by the European Commission for the transfer of personal data outside the European Economic Area or other conditions for transfer provided for in Articles 45 et seq. of the GDPR may be applied. Personal data is processed only by authorized personnel, who have access to the information and are tasked with or responsible for data processing.

The user's personal data may also be processed by companies performing services on our behalf (including companies that provide shipping/delivery services for catalogs and/or products; companies that deliver newsletters, marketing material, and promotional communications; companies that provide customer care services; companies that carry out analyses and market research; companies that maintain IT systems; companies that manage web session replay tools to ensure the best end-user experience). Goods will ship from the US or Europe.

Data collected may also be processed by third parties acting as independent data controllers, for example:

banks or other payment management companies through credit card and tax-free services;
individuals, companies, associations, or professional studios that provide assistance or consultancy services (lawyers, accountants, auditors);
when required to do so in order to comply with applicable law, to respond to a court order or—more generally—any request from a competent authority;
companies that assist in performing KYC procedures;
companies that manage the so-called Virtual Try-On experience.

A complete list of third parties responsible for processing personal data on behalf of Lacuna, or as independent third-party data controllers, can be requested by emailing: clientcare@atelierlacuna.com. The data will, under no circumstances, be published.

8. Data retention period

The user's personal data will not be stored in a way that allows them to be identified and it will be stored for no longer than is deemed reasonably necessary by Lacuna for achieving the purposes for which it was collected or processed, or as established by current legislation on data retention. Data collected for the reasons outlined in paragraph 2, sub-section a), will be stored by Lacuna and Lacuna Affiliates for the time period necessary for the performance of a contract, with legal and conventional guarantees provided for, or in accordance with legal requirements regarding data retention.

For the purposes stated above, data concerning Lacuna customers will be retained for 10 years from the date of the last interaction with the Company (e.g., a purchase, repair, or product assistance); and data concerning Prospects will be retained for 3 years from the date of registration or from the last interaction with the Company (e.g., a repair or assistance for a product purchased from third parties). Data collected for the purposes outlined in paragraph 2, sub-section c), will be stored until the client withdraws their consent to processing and, in any case, for no more than ten years. If consent is withdrawn or the retention period for the data collected for the purposes outlined in paragraph 2, sub-section c), expires early, this data will be automatically deleted or made permanently anonymous.

The personal data outlined in paragraph 2, sub-section d), will be stored for five (5) years starting from the notification date of the final outcome of the reporting process.

9. Rights of data subjects

Information may be requested at any time regarding the processing of your personal data and how it is carried out. It is also possible to correct or delete data, limit its processing, object to its processing, and/or request that the data be sent to another controller. Lacuna and its affiliates must respond to requests within deadlines provided for by applicable regulations; they must also correct incorrect data, ensure that incomplete data is completed, and update data that is no longer correct; and finally, if requested, they must delete data and limit and/or stop its processing, or ensure that it is, where technically possible, sent to another controller. To exercise their statutory rights stated above or to request further information, and/or to report any errors or issues, the data subject may proceed as follows in order to receive a prompt reply: send an email to clientcare@atelierlacuna.com; or fill in the online form available on the Website. If the data subject is not satisfied with the response they receive, they may address the data protection Supervisory Authority.

In relation to processing the personal data outlined in paragraph 1, sub-section d) above, the interested party can exercise all rights provided by current legislation, if the exercising of those rights does not result in any effective and concrete detriment to the confidentiality of the whistleblower’s identity.

10. Personal data protection

Lacuna is committed to protecting personal data and respecting current data protection legislation through the implementation of appropriate technical and organizational measures.

11. Data controllers and processors

The website www.atelierlacuna.com is managed by Lacuna, acting in their capacity as Data Controller for personal data in accordance with Regulation (EU) 679/2016 (GDPR).

The processing of personal data carried out as part of Customer Management activities is performed by Lacuna and Lacuna Affiliates, which act as Joint Controllers on the basis of the joint controller agreement entered into pursuant to Article 26 of the GDPR.

The joint controllers undertake to ensure that anyone acting under their authority has access to personal data and processes such data only after receiving instructions from the respective joint controller and in compliance with the company policies adopted.

For further details on joint data processing and the Lacuna Affiliates involved, as well as for the purposes of exercising their rights, data subjects may contact Lacuna using the contact details provided in paragraph 9.

In relation to the processing of personal data for the management of whistleblowing reports, the data controller is Lacuna.

A complete list of data processors designated by controllers may also be requested by sending an email to clientcare@atelierlacuna.com.