Privacy Policy

Last updated: September 4, 2026

This privacy policy describes how personal data of users who browse and make purchases on the teaologyskincare.com website (hereinafter, the "Site") is processed.

Data Controller

CGS SB S.r.l., with registered office in Via B. Zucchi 29, 20900 Monza (MB), Italy, VAT number and Tax Code 07233860969 (hereinafter, "Teaology" or the "Controller").

For any request related to the processing of personal data, the user can write to hello@teaologyskincare.com.

What type of data we collect

Depending on how you use the Site, we may collect the following categories of personal data:

• Identification and contact data: name, surname, email address, telephone number, billing and shipping address.
• Order data: products purchased, purchase history, amounts, payment method used (not full card details, managed directly by payment providers).
• Account data: if you create an account, username, password (in encrypted form) and preferences.
• Browsing and usage data: pages visited, products viewed, clicks, time spent, device and browser used, IP address.
• Voluntarily provided data: answers to the Skin Test, product reviews, messages sent via the contact form or by email, newsletter subscription.

Unless otherwise indicated, the data requested during the purchase phase are necessary for the execution of the contract: without them, it is not possible to complete the order.

How we collect data

• Directly from you, when you create an account, complete an order, subscribe to the newsletter, complete the Skin Test or contact us.
• Automatically, through cookies and similar technologies while browsing the Site (see the Cookie Policy).
• From our service providers, when they process data on our behalf (e.g., confirmation of a successful payment).

Purposes and legal bases of processing

We process your data for the following purposes:

• Order management: processing of purchases, payment, shipping, management of returns and refunds, customer support. Legal basis: execution of the sales contract.
• Tax, accounting and legal compliance: invoicing, document retention, response to requests from authorities. Legal basis: legal obligation.
• Account and loyalty program management: creation and management of customer accounts, loyalty program points and benefits (Smile.io). Legal basis: execution of the contract.
• Direct marketing (newsletter, promotional emails and SMS, advertising remarketing on Meta and Google): sending commercial communications, offers, personalized content. Legal basis: consent, revocable at any time via the unsubscribe link in each email or by writing to hello@teaologyskincare.com.
• Statistics and service improvement: analysis of traffic and browsing behavior in aggregated form (Google Analytics 4, Microsoft Clarity). Legal basis: consent for non-technically necessary tools, legitimate interest for aggregated statistics essential for the functioning of the Site.
• Product reviews and "Tealover" program: collection and publication of reviews (Judge.me), management of feedback and testimonials (Trustpilot). Legal basis: consent and execution of the contract.
• Security and fraud prevention: identification of fraudulent or abusive activities in the use of the Site. Legal basis: legitimate interest of the Controller.

To whom we communicate your data

Your data may be communicated, to the strictly necessary extent, to the following suppliers and categories of recipients, who act as autonomous controllers or as data processors on behalf of Teaology:

• Shopify Inc. (Canada): e-commerce platform, hosting, order and customer account management.
• Payment providers: Shopify Payments, PayPal, Apple Pay, Google Pay and the Visa, Mastercard, Maestro, UnionPay circuits, as well as Bancontact, BLIK, iDEAL, MobilePay for their respective markets.
• Klaviyo Inc. (United States): sending marketing emails and SMS.
• Meta Platforms, Inc. (United States): management of advertising campaigns and the tracking pixel on Facebook and Instagram.
• Google Ireland Limited (Ireland) and Google LLC (United States): Google Analytics 4, Google Tag Manager, Google Ads and related remarketing tools.
• Microsoft Corporation (United States): Microsoft Clarity, for analyzing browsing behavior (heatmaps and anonymized session recordings).
• Judge.me Ltd (United Kingdom): collection and publication of product reviews.
• Trustpilot A/S (Denmark): collection of reviews and feedback.
• Smile.io: loyalty program management.
• Alia: management of the entrance discount popup.
• Globo Back in Stock: product availability notifications.
• Instafeed: display of social content on the Site.
• Cozy Country Redirect and Translate & Adapt: geographical redirection and linguistic localization of the Site.
• Cloudflare, Inc. (United States): website protection, content delivery, and security.
• Couriers and shippers responsible for order delivery (e.g., GLS).
• Tax, legal, and administrative consultants, public authorities when required by law.

Some of these providers are located outside the European Union, particularly in the United States. In these cases, the transfer takes place on the basis of the European Commission's Standard Contractual Clauses or another transfer mechanism recognized as adequate by applicable law. You can request more information by writing to hello@teaologyskincare.com.

Retention period

We retain order-related data for the period required by tax and civil law (usually 10 years from the conclusion of the contract for accounting records). Data processed based on consent (e.g., for marketing purposes) are retained until consent is revoked. Account data remains until its cancellation, at the user's request or due to prolonged inactivity.

Your rights

As a data subject, you have the right to:

• access your personal data and obtain a copy thereof;
• request their rectification if inaccurate or incomplete;
• request their erasure, within the limits provided by law;
• request restriction of processing;
• object to processing based on legitimate interest, including direct marketing, at any time and free of charge;
• receive your data in a structured format and transfer them to another controller (portability);
• withdraw the consent given, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, write to hello@teaologyskincare.com. We will respond within one month of the request. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of your country of residence.

Minors

The Site is not directed at children under 18 and we do not knowingly collect data from minors. If a parent or guardian believes that a minor has provided us with their data, they can contact us to request its deletion.

Data security

We adopt appropriate technical and organizational measures to protect your data from unauthorized access, loss, or disclosure. However, no system is 100% secure: we ask you not to share your login credentials with third parties.

Cookies

The Site uses cookies and similar technologies. For details on types, purposes, and how to manage preferences, please consult our Cookie Policy.

Changes to this policy

We reserve the right to update this policy to reflect regulatory changes or changes in our practices. The "last updated" date at the top of the document indicates the most recent version. In the event of substantial changes, we will notify you through a notice on the Site or via email.

Contacts

CGS SB S.r.l. — Via B. Zucchi 29, 20900 Monza (MB), Italy — hello@teaologyskincare.com