Privacy Policy

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

This Privacy Policy describes how the personal data of users who browse and use the website www.horomia.it (hereinafter, the “Website”), purchase products, create an account, subscribe to the newsletter or use other services made available through the Website are processed.

1. Data Controller

The Data Controller is:

DEOLAB SRL UNIPERSONALE
subject to the direction and coordination of EULAN HOLDING SRL
Via Enrico Fermi 12
24050 Grassobbio (BG) – Italy
Tax Code: 04316860164
REA BG – 453476
E-mail: info@horomia.it
Certified e-mail (PEC): deolabsrl@pec.deolabsrl.it

For any request concerning the processing of personal data or the exercise of rights provided for by the GDPR, users may contact the Data Controller using the contact details provided above.

2. Categories of personal data processed

The following categories of personal data may be collected and processed through the Website.

2.1 Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain data whose transmission is inherent in the use of Internet communication protocols.

This category may include:

  • IP address;
  • browser type;
  • operating system and device used;
  • technical information relating to the connection;
  • pages visited;
  • date and time of the visit;
  • source of the visit;
  • information relating to interactions with the Website.

Such data may be processed to ensure the proper operation and security of the Website, obtain statistical information on its use and prevent or detect fraudulent or unlawful activities.

2.2 Account data

When a user creates an account on the Website, the following data may be collected:

  • first name;
  • last name;
  • e-mail address;
  • login credentials;
  • date of birth, where voluntarily provided;
  • newsletter subscription preference;
  • any other information associated with the user's profile.

Passwords are managed using appropriate security measures and are not stored in plain text.

2.3 Order and purchase data

When a user makes a purchase, the following data may be processed:

  • first and last name;
  • e-mail address;
  • telephone number;
  • shipping address;
  • billing address;
  • tax code and/or VAT number, where required;
  • products purchased;
  • quantities and amounts;
  • order number and status;
  • shipping information;
  • information relating to the payment method used;
  • information necessary to manage returns, refunds and after-sales support.

2.4 Data provided through forms and contact requests

Depending on the service used, the following data may be collected through forms available on the Website:

  • company name;
  • first and last name of the contact person;
  • e-mail address;
  • telephone number;
  • VAT number;
  • city, postal code and country;
  • subject and content of the request;
  • any additional information voluntarily provided by the user.

Such data may be collected, for example, through contact forms, requests relating to points of sale or requests to become a Horomia retailer.

2.5 Newsletter data

When subscribing to the newsletter, the following data may be processed:

  • e-mail address;
  • first and last name, where available;
  • information relating to the date and method of subscription;
  • preferences and segments that may be associated with the contact;
  • information relating to the delivery of and interaction with communications sent, to the extent permitted by applicable law.

3. Purposes, legal bases and data retention

3.1 Account registration and management

Data are processed to enable the creation of a personal account, user authentication and access to services reserved for registered users.

Legal basis: performance of a contract or steps taken at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR.

Data are retained for the period necessary to manage the account and subsequently, where necessary, to comply with legal obligations and protect the rights of the Data Controller.

3.2 Order and purchase management

Data are processed in order to:

  • receive and manage orders;
  • process payments;
  • arrange shipping;
  • communicate with customers regarding their orders;
  • manage returns, refunds, complaints and customer support;
  • comply with administrative, accounting and tax obligations.

Legal basis: performance of the sales contract pursuant to Article 6(1)(b) GDPR and compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

Purchase-related data are retained for the period required by applicable civil, tax and accounting legislation and, where necessary, for the protection of the Data Controller's rights.

3.3 Management of contact requests

Data provided through forms, by e-mail or through other contact channels are used to respond to requests submitted by the data subject.

Legal basis: steps taken at the request of the data subject prior to entering into a contract and/or the legitimate interest of the Data Controller in managing requests received, depending on the nature of the request.

Data are retained for the time necessary to handle the request and any subsequent relationship.

3.4 Requests to become a retailer and business relationships

Data submitted through forms dedicated to retailers are used to assess the request, contact the interested party and manage the possible establishment of a business relationship.

Legal basis: steps taken at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR.

3.5 Newsletter and marketing communications

Subject to the data subject's consent, the e-mail address and any other associated data may be used to send newsletters, information about Horomia products, promotions, offers and other marketing communications.

Legal basis: consent of the data subject pursuant to Article 6(1)(a) GDPR.

Users may withdraw their consent at any time by using the unsubscribe link included in the communications received or by contacting the Data Controller.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

3.6 Birthday-related initiatives

Where users choose to provide their date of birth, such data may be used to enable participation in Horomia initiatives offered on the user's birthday, including the possible generation and delivery of dedicated promotions, gifts or discount codes.

Providing a date of birth is not necessary to make a purchase or create an account, unless otherwise indicated in the relevant form.

Processing is carried out as part of the service voluntarily requested by the user and on the legal basis applicable to the relevant initiative.

3.7 Security and fraud prevention

Certain data may be processed to ensure the security of the Website and transactions and to prevent misuse, unauthorised access, fraud and other unlawful activities.

Legal basis: legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f) GDPR and, where applicable, compliance with legal obligations.

4. Processing methods and security

Personal data are processed using IT, electronic and, where necessary, paper-based tools.

The Data Controller adopts technical and organisational measures appropriate to the level of risk in order to protect personal data against loss, destruction, alteration, unauthorised access, disclosure or unlawful use.

Data are processed exclusively by authorised personnel or by external parties involved in providing the services necessary for the operation of the Website and the Data Controller's business.

5. Recipients of personal data

For the purposes set out in this Privacy Policy, personal data may be disclosed to parties providing services necessary for the Data Controller's activities, including:

  • hosting and IT infrastructure providers;
  • Website and IT system providers and maintenance providers;
  • e-mail and newsletter service providers;
  • payment service providers;
  • couriers and logistics operators;
  • administrative, accounting, tax and legal advisers;
  • analytics and measurement service providers;
  • advertising and marketing service providers;
  • technology platforms used to manage the e-commerce service;
  • public authorities and other parties to whom disclosure is required by law.

Depending on the circumstances, such parties may act as Data Processors pursuant to Article 28 GDPR or as independent Data Controllers.

An up-to-date list of Data Processors may be requested from the Data Controller.

6. Payments – Stripe and PayPal

The Website offers different electronic payment methods, including services provided through Stripe and PayPal.

6.1 Stripe

For card payments and other payment methods supported by its platform, the Website uses services provided by Stripe.

Stripe may process:

  • identification and contact data;
  • order information;
  • transaction amount;
  • technical information;
  • data necessary to manage the payment method;
  • information used for fraud prevention.

Complete payment card details are managed through systems provided by the payment service provider and are not stored directly by the Website, except for limited transaction information necessary to manage the order, payment and any refunds or disputes.

Purposes: payment processing, transaction management, fraud prevention, refunds and dispute management.

Legal basis: performance of the purchase contract and, where applicable, compliance with legal obligations and legitimate interests in ensuring transaction security and preventing fraud.

6.2 PayPal

The Website also allows users to make payments via PayPal.

When a user chooses PayPal, the data necessary for the transaction are processed by the relevant provider.

PayPal may process identification and contact data, information relating to the user's PayPal account, transaction information and other data necessary to authorise the payment, prevent fraud and manage any disputes.

The Data Controller receives the information necessary to verify the outcome of the payment and manage the order, without having access to the user's PayPal account credentials.

Purposes: payment processing, transaction verification, management of refunds and disputes, and fraud prevention.

Legal basis: performance of the purchase contract and, where applicable, compliance with legal obligations and legitimate interests in transaction security.

Stripe and PayPal also process data in accordance with their respective privacy policies, which users are encouraged to review.

7. Newsletter – Mailchimp

The Data Controller uses Mailchimp, a service provided by the Intuit group, to manage and send newsletters.

When using the service, the following data may be processed:

  • e-mail address;
  • first and last name, where available;
  • information relating to subscription and unsubscription;
  • preferences and segments that may be associated with the contact;
  • technical information relating to the delivery of communications;
  • information relating to interactions with communications sent, to the extent permitted by applicable law.

Purpose: management of newsletter subscriptions and sending promotional and marketing communications requested by the user.

Legal basis: consent of the data subject pursuant to Article 6(1)(a) GDPR.

Users may withdraw their consent at any time using the unsubscribe link included in the e-mails received or by contacting the Data Controller.

Data are retained for the period necessary to manage the subscription and, in any event, until consent is withdrawn, without prejudice to data that must be retained in order to document the consent previously given and its subsequent withdrawal.

The use of Mailchimp may involve the processing of personal data outside the European Economic Area in accordance with the conditions and safeguards provided for by applicable legislation.

8. Google Analytics 4

The Website uses Google Analytics 4 (GA4), a service provided by Google, to collect statistical information on the use of the Website and understand how users browse and interact with it.

Google Analytics may process information such as:

  • device and browser information;
  • IP address and technical connection data;
  • pages visited;
  • source of the visit;
  • date and duration of the session;
  • interactions with the Website;
  • events relating to the use of the e-commerce service;
  • information relating to purchases and conversions, where configured.

Purpose: statistical analysis of Website usage, performance measurement and service improvement.

Legal basis: consent of the data subject pursuant to Article 6(1)(a) GDPR, where required.

Google Analytics is activated in accordance with the preferences expressed by the user through the consent management system adopted by the Website.

Users may refuse or withdraw their consent at any time through the cookie preference management panel.

9. Google Tag Manager

The Website uses Google Tag Manager, a tool provided by Google that enables the technical management of tags and tools integrated into the Website.

Google Tag Manager is used to facilitate the management and activation of measurement and marketing tools available on the Website.

Any collection of personal data through individual tools loaded via Google Tag Manager depends on the characteristics and settings of each service, as described in the relevant sections of this Privacy Policy and in the Cookie Policy.

10. Meta Pixel and Meta Conversions API

The Website uses tools provided by Meta Platforms, including Meta Pixel and Meta Conversions API (CAPI), to measure the effectiveness of advertising campaigns and attribute certain actions and conversions to campaigns carried out on Meta platforms, such as Facebook and Instagram.

10.1 Meta Pixel

Meta Pixel is implemented on the Website and operates on the browser side.

Depending on the configuration adopted, Meta may receive information relating to:

  • pages and products viewed;
  • interactions carried out on the Website;
  • the browser and device used;
  • IP address;
  • identifiers and parameters used to measure and attribute advertising campaigns;
  • events and conversions configured on the Website.

Meta Pixel is activated in accordance with the preferences expressed by the user through the consent management system.

10.2 Meta Conversions API (CAPI)

The Website also uses Meta Conversions API, through which certain information relating to purchases may be transmitted directly from the Website's server systems to Meta.

In particular, upon completion of a purchase and where the information required for campaign attribution is available, the system may transmit a “Purchase” event to Meta.

The information transmitted may include:

  • the purchaser's e-mail address, transmitted using SHA-256 hashing;
  • date and time of the event;
  • order identifier;
  • total purchase value;
  • currency;
  • number of products purchased;
  • product codes;
  • quantities;
  • product prices;
  • parameter relating to the Meta advertising campaign, where available.

The server-side event is associated with the same measurement environment used by Meta Pixel, enabling measurement and attribution of the conversion resulting from the purchase.

Purpose: conversion measurement, attribution of purchases to Meta advertising campaigns and analysis of campaign performance.

Legal basis: consent of the data subject pursuant to Article 6(1)(a) GDPR, where required by applicable law.

Users may modify or withdraw their preferences at any time through the consent management system available on the Website.

Meta also processes the data received in accordance with its own terms and privacy policies.

11. CookieFirst and consent management

The Website uses CookieFirst, a service provided by Digital Data Solutions B.V., to collect, manage and document users' preferences regarding the use of cookies and similar technologies.

When users access the Website, a connection is established with CookieFirst in order to display the consent management panel, record the preferences expressed and enable technologies according to the choices made.

As part of the service, information may be processed relating to:

  • consent status or withdrawal of consent;
  • anonymised IP address;
  • browser;
  • device;
  • date and time of the visit;
  • page from which preferences were recorded or updated;
  • approximate geographical information;
  • a technical identifier associated with the recording of preferences.

Purpose: collection, management and documentation of preferences relating to cookies and tracking technologies.

Legal basis: compliance with legal obligations to which the Data Controller is subject pursuant to Article 6(1)(c) GDPR.

Users may change their preferences at any time using the consent management panel available on the Website.

12. Cookies and similar technologies

The Website uses cookies and similar technologies.

Certain cookies are necessary for the operation of the Website and for the provision of services requested by the user.

Other cookies and technologies may be used, subject to consent where required, to:

  • perform statistical analysis;
  • measure Website performance;
  • measure conversions;
  • analyse the effectiveness of advertising campaigns;
  • carry out marketing and remarketing activities.

Detailed information on the individual cookies and technologies used, their providers, purposes and duration is available in the Cookie Policy and in the consent management panel.

Users may change or withdraw their preferences at any time.

13. Transfers of data outside the EEA

Some providers used by the Data Controller, including providers of technology, analytics, marketing, newsletter and payment services, may involve the processing or transfer of personal data to countries outside the European Economic Area.

Where this occurs, transfers are carried out in compliance with Articles 44 et seq. GDPR and on the basis of the mechanisms provided for by applicable legislation, including, where applicable:

  • adequacy decisions adopted by the European Commission;
  • the EU-U.S. Data Privacy Framework for organisations participating in the framework;
  • Standard Contractual Clauses approved by the European Commission;
  • other safeguards provided for by applicable legislation.

Further information regarding international data transfers and the applicable safeguards may be requested from the Data Controller.

14. Nature of the provision of data

The provision of data marked as mandatory is necessary in order to use the relevant services.

Failure to provide such data may make it impossible, depending on the circumstances, to:

  • create or use an account;
  • complete an order;
  • arrange delivery;
  • receive a response to a request;
  • establish a business relationship;
  • use other requested services.

Providing data for marketing purposes is optional.

Failure to consent to marketing communications or marketing technologies does not prevent users from making purchases or using the essential functions of the Website.

15. Rights of the data subject

Pursuant to Articles 15-22 GDPR, where provided for by applicable law, the data subject has the right to:

  • obtain confirmation as to whether or not personal data concerning them are being processed;
  • access their personal data;
  • obtain the rectification of inaccurate data and completion of incomplete data;
  • request the erasure of their personal data;
  • request restriction of processing;
  • object to processing where applicable;
  • receive their data in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller;
  • withdraw consent previously given at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise these rights, users may contact:

DEOLAB SRL UNIPERSONALE
E-mail: info@horomia.it
Certified e-mail (PEC): deolabsrl@pec.deolabsrl.it

The Data Controller may request the information necessary to verify the identity of the applicant.

16. Right to lodge a complaint with a Supervisory Authority

Data subjects who believe that the processing of their personal data infringes the GDPR have the right to lodge a complaint with the competent Supervisory Authority.

In Italy, the competent authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority).

This is without prejudice to the data subject's right to seek any other administrative or judicial remedy provided for by applicable law.

17. Children's data

The products and services available through the Website are not specifically intended for children.

The Data Controller therefore asks minors not to provide personal data through the Website without the involvement of a person exercising parental responsibility, where required by applicable law.

18. Links to third-party websites and services

The Website may contain links to websites, social networks, platforms or services operated by third parties.

The Data Controller does not control how such third parties process users' personal data.

When accessing an external service, users are therefore encouraged to review the relevant privacy policy.

19. Changes to this Privacy Policy

The Data Controller may periodically amend or update this Privacy Policy, including as a result of regulatory changes, technological updates, the introduction of new services or changes to the tools used by the Website.

The updated version will be published on this page.

In the event of material changes, the Data Controller may adopt appropriate measures to inform data subjects.

Last updated: 21 September 2026

PAGE UP
Carrello
Wish List
My account