Privacy policy
Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679.
Last updated: 14 October 2026
1. Data controller
ANGELONE ESTER BEAUTY CONSULTANT of Ester Angelone
Sole proprietorship · Registered tax address: Via Portone 75, 04020 Monte San Biagio (LT), Italia
VAT number: 03261090595
Email: info@esterangelone.it · Phone: +39 328 188 1553
No Data Protection Officer has been appointed, as it is not mandatory for this business. For any request: info@esterangelone.it.
2. What data we process and why
We only process the data needed to provide our service. Third-party analytics and marketing tools are used only with your consent and only when active: their current status is shown in the Cookie policy.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering requests via WhatsApp, email, phone or form | Name, contact details, message content | Pre-contractual steps at your request (Art. 6.1.b) | 12 months after last contact if no booking follows |
| Managing bookings and treatments, service messages, reminders | Name, email, phone, address, postcode, date and time, treatments, notes | Performance of the contract (Art. 6.1.b) | Duration of the relationship, then 10 years for data in accounting records |
| Online payments, guarantee card, fees, refunds | Payment data processed by Stripe; we only see card brand, last 4 digits and expiry | Performance of the contract (Art. 6.1.b) | Guarantee card removed within 90 days after the appointment, unless a fee is still to be collected or a dispute is pending |
| Receiving and acknowledging withdrawal or cancellation statements (Art. 54-bis Italian Consumer Code) | Name, email, booking details, statement text, date and time | Legal obligation (Art. 6.1.c) | 10 years, as evidence in case of disputes |
| Tax and accounting obligations (invoices, receipts) | Identification and tax data, amounts | Legal obligation (Art. 6.1.c) | 10 years (Art. 2220 Italian Civil Code) |
| Health information needed for treatment safety (allergies, contraindications) | Health data, collected in person, not through the website | Explicit consent (Art. 9.2.a) | Until consent is withdrawn or 24 months after the last treatment |
| Client area: registration and sign-in with a one-time email code (no password), viewing and managing bookings, gift cards and preferences | Email, temporary access code, bookings, preferences | Performance of the contract (Art. 6.1.b) | Until account deletion or after 24 months of inactivity (accounting data kept 10 years) |
| Automatic service emails: confirmation, reminders 48 and 24 hours before, aftercare tips, receipts | Name, email, booking details | Performance of the contract (Art. 6.1.b) | Same as booking data |
| One single email inviting a review, with no incentive | Name, email | Consent (Art. 6.1.a), optional and revocable from your account | Until withdrawn |
| Internal client management: treatment history, service preferences, Ester's notes (never health data) | History, preferences, notes | Legitimate interest in offering a personalised service (Art. 6.1.f) | 24 months after the last treatment |
| Website analytics (Google Analytics 4), only if active | Pseudonymous browsing data, anonymised IP | Consent via banner (Art. 6.1.a and Art. 122 Italian Privacy Code) | 14 months |
| Marketing (Google Ads, Meta Pixel): conversion measurement and relevant advertising, only if active | Online identifiers, site events (visit, booking, contact) | Consent via banner (Art. 6.1.a and Art. 122 Italian Privacy Code) | Up to 90 days (cookies); for data held by Google and Meta, per their policies |
| Reminders for your next treatment and emails about services similar to those already received | Name, email, treatments received | Legitimate interest (Art. 6.1.f) and Art. 130(4) Italian Privacy Code: you can object at any time, including via the link in every email | 24 months after the last treatment or until you object |
| Protecting forms and sign-in from abuse and automated submissions: limits on the number of requests and, if active, Cloudflare Turnstile anti-bot check | IP address and email only in irreversibly encrypted form (hash), request counter; for Turnstile, technical browser signals | Legitimate interest in the security of the service (Art. 6.1.f) | Counters deleted automatically within 48 hours |
| Defending rights in case of disputes, website security | Booking and payment data, server technical logs | Legitimate interest (Art. 6.1.f) | As long as necessary; technical logs per the provider's retention (indicatively up to 30 days) |
3. Health data
Some treatments (e.g. lash lift, henna, waxing) require knowing whether you have allergies, are pregnant or have skin conditions. Please do not enter this information in the website form: we collect it in person, with a short client card and your explicit consent, solely to perform the treatment safely. You can withdraw consent at any time; some treatments may then not be possible.
4. Providing data
Fields marked as required are necessary to book: without them we cannot manage the appointment. The notes field is optional.
5. Payments
Payments take place on Stripe's secure pages (PCI-DSS Level 1). Full card details never pass through or are stored on our systems. If you choose to pay on the day, your card is stored by Stripe only as a guarantee and can be charged solely in the cases set out in the Terms and conditions, with prior written notice.
6. Recipients
- Stripe Payments Europe, Ltd. (Ireland), for payments and the guarantee card. Stripe acts as an independent controller for some processing (fraud prevention, legal obligations) and as a processor for other processing: Stripe privacy policy.
- Vercel Inc. (USA), website hosting and booking functions, as processor.
- Supabase, Inc., database and client-area sign-in, with servers in the European Union (Frankfurt), as processor.
- Google Ireland Ltd. (Google Analytics 4, Google Ads, Search Console), only if active and with your consent: Google privacy policy.
- Meta Platforms Ireland Ltd. (Meta Pixel), only if active and with your consent, joint controller only for collection and transmission via the pixel (Art. 26 GDPR): Meta privacy policy.
- WhatsApp Ireland Ltd. / Meta, if you choose to contact us on WhatsApp: WhatsApp privacy policy.
- Register S.p.A. (Italy, team.blue group), for the domain, the mailbox and sending service emails, as processor.
- Cloudflare, Inc. (USA), if enabled, for the Turnstile anti-bot check on forms and sign-in, as processor: Turnstile privacy notice.
- Accountant and advisers, bound by confidentiality, for tax compliance and legal protection.
- Public authorities, where required by law.
Data is never sold or shared with third parties for marketing.
7. Transfers outside the EU
Vercel, Cloudflare, Supabase (a US company, with data stored in the EU), Google and Meta may process data in the United States. Transfers rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Decision (EU) 2023/1795) for certified companies and, in any case, on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).
8. How data is handled
Data is processed electronically and, for the client card only, on paper kept securely. We use appropriate measures: encrypted HTTPS connection, password-free sign-in with an expiring one-time code and a session that ends when you close the tab, limits on attempts, a database accessible only from our server, a Content Security Policy against unauthorised scripts, data minimisation, no automated decision-making or profiling. Our emails contain no tracking pixels or tracked links: we do not record opens or clicks (Italian DPA decision no. 284 of 17 April 2026).
9. Your rights
At any time you may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), object to processing based on legitimate interest (Art. 21) and withdraw any consent given, without affecting prior lawful processing. Write to info@esterangelone.it: we reply within 30 days. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the authority of your EU country of residence (Art. 77 GDPR). We never send promotional messages via WhatsApp, SMS or phone without your explicit consent.
10. Minors
Our services are intended for adults. Treatments on minors are carried out only on request and in the presence of a parent or guardian, who provides the necessary data.
11. Cookies
For cookies and similar technologies see the Cookie policy.
12. Changes
This notice may be updated, for example for new services or legal changes. The date of the last update is shown at the top of the page; material changes are notified to clients by email.