Privacy Policy

Privacy Policy of GIUFRA S.R.L., owner of the "ASTRA MAKE UP" trademark

About Giufra

The website of Giufra S.r.l., including the e-commerce portal integrated therein (hereinafter jointly, the "Website"), is operated by Giufra S.r.l., with registered office at Via Veneto 152 – 06059, Zona Industriale Ponte Rio (PG), Italy, +39 075 898 76 91, Email: marketing@astramakeup.com, Tax Code and VAT No. IT 01837230547 (hereinafter, "Giufra" or "we").

Giufra is the exclusive owner of the Astra Make-Up trademark and of all "ASTRA" products featured on the Website.

Giufra s.r.l. collects certain Personal Data from its Users.

Data Controller

Giufra S.R.L. – Via Veneto 152 – 06059, Zona Industriale Ponte Rio (PG), Italy

VAT No.: 01837230547

Email address of the Controller: marketing@astramakeup.com

Types of Data Collected

Among the Personal Data collected by Giufra, independently or through third parties, are: first name; last name; date of birth; phone number; address; city; email; Cookies; Usage Data; geographic location; unique device identifiers for advertising (such as Google Advertiser ID or IDFA identifier); in-app purchases; username; country; data communicated while using the service; various types of Data; app launches; number of sessions; session duration; page-scrolling interactions; mouse movements; scroll position; keypress events; clicks; session statistics; page views; interaction events; page events; IP address; device information; app information; device logs; operating systems; browser information; language; street number; address; geographic region; approximate location; location information; postal code (ZIP/CAP); state/country; province; province; (city) latitude; (city) longitude; metropolitan area; billing address; shipping address; payment information; point-of-sale data; billing data; product interaction; purchase history; order ID; User ID; identity document; Tax Code; password.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by means of specific notices displayed prior to Data collection.

Personal Data may be freely provided by the User, or, in the case of Usage Data, collected automatically when using Giufra.

Unless otherwise specified, all Data requested by Giufra is mandatory. If the User refuses to provide such Data, it may be impossible for Giufra to provide the Service. In cases where Giufra indicates that certain Data is optional, Users are free to refrain from communicating such Data without any consequence for the availability or operability of the Service.

Users who are uncertain as to which Data is mandatory are encouraged to contact the Controller.

Any use of Cookies – or other tracking tools – by Giufra or by the providers of third-party services used by Giufra serves the purpose of providing the Service requested by the User, in addition to the further purposes described in this document and in the Cookie Policy.

The User assumes responsibility for third-party Personal Data obtained, published, or shared through Giufra.

Method and Place of Processing of the Data Collected

Method of Processing

The Controller adopts appropriate security measures designed to prevent unauthorized access, disclosure, modification, or destruction of Personal Data.

Processing is carried out using computerized and/or telematic tools, with organizational methods and logic strictly related to the stated purposes. In addition to the Controller, in some cases Data may be accessible to other parties involved in Giufra's organization (administrative, sales, marketing, and legal personnel, or system administrators) or to external parties (such as third-party technical service providers, couriers, hosting providers, IT companies, communication agencies) appointed, where necessary, as Data Processors by the Controller. The updated list of Processors may be requested from the Controller at any time.

Place

Data is processed at the Controller's operating offices and in any other location where the parties involved in the processing are located. For further information, please contact the Controller.

The User's Personal Data may be transferred to a country other than the one in which the User is located. For further information on the place of processing, the User may refer to the section dealing with the details on the processing of Personal Data.

Transfers of Personal Data to countries outside the European Economic Area (EEA), where carried out, take place in compliance with Chapter V of EU Regulation 2016/679. In particular: for transfers to organizations established in the United States of America adhering to the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023 (C(2023) 4745 final); for transfers to other third countries without an adequacy decision, the Controller adopts the Standard Contractual Clauses approved by the European Commission through Implementing Decision (EU) 2021/914. For transfers to Israel (AppsFlyer Ltd), the European Commission's adequacy decision of 31 January 2011 applies. Further information on the safeguards adopted for individual transfers may be requested from the Controller or the DPO.

Retention Period

Unless otherwise specified in this document, Personal Data is processed and retained for as long as required by the purpose for which it was collected and may be retained for a longer period due to any applicable legal obligations or on the basis of the User's consent. The maximum retention period, where the personal data is not used, is 24 months.

Purposes of Processing the Data Collected

The User's Data is collected to allow the Controller to provide the Service, comply with legal obligations, respond to requests or enforcement actions, protect its own rights and interests (or those of Users or third parties), detect any malicious or fraudulent activity, as well as for the following purposes: Contacting the User, Contact management and messaging, Payment processing, Tag management, Hosting and backend infrastructure, Location-based interactions, Registration and authentication, Remarketing and behavioral targeting, Advertising, Displaying content from external platforms, Analytics/Statistics, Infrastructure monitoring, Social features, Managing support and contact requests, Interaction with support and feedback platforms, Interaction with live chat platforms, Access to third-party accounts, Managing surveys and online data collection, Traffic optimization and distribution, Commercial affiliation, and Interaction with data collection platforms and other third parties.

For detailed information on the purposes of processing and the Personal Data processed for each purpose, the User may refer to the section "Details on the Processing of Personal Data".

Facebook Permissions Requested by Giufra

Giufra may request certain Facebook permissions that allow it to perform actions with the User's Facebook account and to collect information, including Personal Data, from it. This service enables Giufra to connect to the User's account on the Facebook social network, provided by Facebook Inc.

For further information on the permissions listed below, please refer to the Facebook permissions documentation and to Facebook's privacy policy.

The permissions requested are the following:

Basic Information

The basic information of the User registered on Facebook, which normally includes the following Data: id, name, picture, gender, and localization language, and, in certain cases, Facebook "Friends". If the User has made further Data publicly available, such Data will also be accessible.

Friends' "About Me"

Provides access to the "About Me" section of friends' profiles.

Access to Private Data

Allows access to private data of the User and of friends.

Access to Activities

Provides access to the User's list of activities.

Email

Provides access to the User's primary email address.

Details on the Processing of Personal Data

Personal Data is collected for the following purposes, using the following services:

Access to Third-Party Accounts

This type of service allows Giufra to retrieve Data from the User's accounts on third-party services and perform actions with them.

These services are not automatically activated but require the User's express authorization.

Facebook Account Access (Meta Platforms Ireland Limited)

This service enables Giufra to connect to the User's account on the Facebook social network, provided by Meta Platforms Ireland Limited.

Permissions requested: Friends' "About Me"; Access to private data; Access to activities; Email.

Place of processing: Ireland – Privacy Policy.

X Account Access (X Corp.)

This service enables Giufra to connect to the User's account on the X social network, provided by X Corp.

Personal Data processed: last name; data communicated while using the service; Usage Data; email; device information; first name; password; Tracking Tools; username.

Place of processing: United States – Privacy Policy. Transfer carried out under the EU-U.S. Data Privacy Framework.

Commercial Affiliation

This type of service enables Giufra to display advertisements for products or services offered by third parties. Advertisements may be displayed either as advertising links or as banners in various graphic formats.

Clicks on the icon or banner published on Giufra are tracked by the third-party services listed below and shared with Giufra.

To find out which data is collected, please refer to the privacy policy of each service.

Awin (AWIN AG)

Awin is a commercial affiliation service provided by AWIN AG.

Personal Data processed: Usage Data; Tracking Tools.

Place of processing: Germany – Privacy Policy.

Contacting the User

For questions or complaints regarding the processing of personal data by Giufra, please contact the Data Protection Officer at marketing@astramakeup.com. The User also has the right to lodge complaints regarding the processing of their personal data by Giufra with the competent authorities. We nevertheless invite Users to give Giufra the opportunity to address any concerns by contacting Giufra directly before contacting the competent authorities.

Full contact details:

Data Protection Officer (DPO) pursuant to Article 37 of EU Regulation 2016/679: Avv. Elio Viola – Studio Legale Standards – Email: viola@standardslegal.it

Mailing List or Newsletter (Giufra)

By registering for the mailing list or newsletter, the User's email address is automatically added to a contact list to which email messages containing information, including commercial and promotional information, relating to Giufra may be sent. The User's email address may also be added to this list as a result of registering with Giufra or after making a purchase.

Communications to existing customers (soft-spam): pursuant to Article 130, paragraph 4, of Legislative Decree 196/2003, Giufra may send commercial communications relating to products or services similar to those already purchased by a User who has previously made a purchase, without the need for prior consent. The User may object to such communications at any time by using the unsubscribe link included in every email or by writing to marketing@astramakeup.com.

Personal Data processed: email.

Social Features

Firebase Dynamic Links (Google Ireland Limited)

Firebase Dynamic Links is a social feature provided by Google Ireland Limited. Dynamic Links are tracked through Firebase or Google Analytics for Firebase and provide the Controller with details on the User's browsing path to and within Giufra.

Personal Data processed: various types of Data as specified in the service's privacy policy.

Place of processing: Ireland – Privacy Policy.

Contact Management and Messaging

This type of service enables the management of a database of email contacts, phone contacts, or contacts of any other kind, used to communicate with the User.

These services may also allow the collection of data regarding the date and time a message was viewed by the User, as well as the User's interaction with it, such as information on clicks on links included within the message.

Firebase Cloud Messaging (Google Ireland Limited)

Firebase Cloud Messaging is a messaging service provided by Google Ireland Limited. Firebase Cloud Messaging allows the Controller to send messages and notifications to Users on platforms such as Android, iOS, and the web. Messages may be sent to individual devices, groups of devices, or based on topics or specific User segments.

Personal Data processed: various types of Data as specified in the service's privacy policy.

Place of processing: Ireland – Privacy Policy.

Sendgrid (Sendgrid)

Sendgrid is an address management and email messaging service provided by Sendgrid Inc.

Personal Data processed: last name; Usage Data; email; address; first name.

Place of processing: United States – Privacy Policy.

Leanplum

Leanplum is an omnichannel customer engagement and retention platform that helps create personalized experiences and drive User engagement through intelligent, metrics-based marketing strategies.

Personal Data collected: various types of Data as specified in the service's privacy policy.

Place of processing: Privacy Policy: https://www.leanplum.com/privacy/

Payment Management

Payment management services enable Giufra to process payments by credit card, bank transfer, or other means. Data used for payment is collected directly by the manager of the requested payment service and is in no way processed by Giufra.

Some of these services may also allow the scheduled sending of messages to the User, such as emails containing invoices or notifications regarding payment.

PayPal (Paypal)

PayPal is a payment service provided by PayPal Inc., which allows the User to make online payments.

Personal Data processed: various types of Data as specified in the service's privacy policy.

Scalapay (Scalapay S.r.l.)

Scalapay is a payment service provided by Scalapay S.r.l. that allows customers to pay in installments.

Personal Data processed: in-app purchases; address; metropolitan area; postal code (ZIP/CAP); city; clicks; Tax Code; last name; purchase history; date of birth; billing data; Usage Data; point-of-sale data; identity document; session duration; email; interaction events; page events; keypress events; order ID; User ID; billing address; shipping address; physical address; payment information; location information; browser information; device information; app information; product interaction; page-scrolling interactions; IP address; app launches; (city) latitude; language; device logs; (city) longitude; mouse movements; country; first name; street number; number of sessions; phone number; page views; approximate location; geographic location; scroll position; province; geographic region; operating systems; session statistics; state/country.

Place of processing: Italy – Privacy Policy.

Tag Management

This type of service supports the centralized management of tags or scripts used on Giufra.

The use of such services entails the flow of User Data through them and, where applicable, its retention.

Google Tag Manager (Google LLC)

Google Tag Manager is a tag management service provided by Google LLC.

Personal Data processed: Cookies; Usage Data.

Place of processing: USA – Privacy Policy.

Managing Data Collection and Online Surveys

This type of service enables Giufra to manage the creation, implementation, administration, distribution, and analysis of online forms and surveys in order to collect, save, and reuse the Data of Users who respond.

The Personal Data collected depends on the information requested and provided by Users in the corresponding online form.

These services may be integrated with a wide range of third-party services to allow the Controller to take further action with the processed Data — for example, contact management, message sending, statistics, advertising, and payment processing.

For the purposes described above, we may collect data such as your age, gender, approximate geographic location, information on the use of our service, and preferences regarding third-party services and products. Such data is processed in a manner that does not directly identify any individual, but is intended to obtain useful information on an aggregate basis.

Aggregate data, which does not allow the personal identification of Users, may be shared with trusted, selected partners. Such sharing is intended to improve the products and services offered, as well as to support data-driven marketing initiatives. Specifically, data may be shared with:

Market analysis partners who help us understand industry trends.
Research organizations that conduct studies on the use of digital technologies.
Advertising partners for the development of targeted campaigns, without, however, sharing information that personally identifies you.

The processing of your data for these purposes is based on our legitimate interest in improving our services and offerings and in contributing to market research, always in compliance with your privacy.

Managing Support and Contact Requests

This type of service enables Giufra to manage support and contact requests received by email or through other tools, such as the contact form.

The Personal Data processed depends on the information provided by the User within the messages and on the tool used for communication (e.g., the email address).

Hosting and Backend Infrastructure

This type of service is intended to host Data and files that allow Giufra to function, enable its distribution, and provide a ready-to-use infrastructure for delivering specific Giufra features.

Some of these services operate through servers located in different geographic locations, making it difficult to determine the exact place where Personal Data is stored.

Brevo (formerly Sendinblue)

Personal data collected by Brevo relating to the identity and contact information of its Users is stored for a maximum period of two years following termination of the contractual relationship for customer-Users, or following its collection by the data processor or the last contact with a prospective User, for data relating to such prospects.

Shopify

Because we need your data to provide you with Shopify's services, we generally retain your personal data for as long as you use Shopify's products or services. If you close your store, stop paying subscription fees, or your account is deactivated, we retain your store data for two years before beginning the process of deleting or anonymizing personal data.

Tracking Pixel in Email Communications (Brevo)

Newsletter and commercial communications sent by Giufra through Brevo may include tracking pixels (web beacons), i.e., small images embedded in the body of the email that make it possible to detect whether the message was opened, the date and time it was read, and clicks on the links contained therein.

Personal Data processed: email address, date and time of opening, device type, interactions with links.

Legal basis: User consent pursuant to Article 122 of Legislative Decree 196/2003 and the Guidelines of the Italian Data Protection Authority ("Garante") No. 284 of 17 April 2026 (published in Official Gazette No. 98 of 29 April 2026). Consent is optional and may be withdrawn at any time.

Purpose: measuring the effectiveness of commercial communications and improving the content sent.

Withdrawal: the User may withdraw consent to pixel tracking alone — while remaining subscribed to the newsletter — through the "Preference Management" area accessible from the footer of every commercial email, or by writing to marketing@astramakeup.com.

Place of processing: France (Brevo, EEA headquarters) – Privacy Policy: https://www.brevo.com/it/legal/privacypolicy/

Interaction with Data Collection Platforms and Other Third Parties

This type of service allows Users to interact with data collection platforms or other services directly from Giufra's pages for the purpose of saving and reusing data.

Where one of these services is installed, it is possible that, even if Users do not use the service, it will collect Usage Data relating to the pages on which it is installed.

Market analysis partners who help us understand industry trends.
Research organizations that conduct studies on the use of digital technologies.
Advertising partners for the development of targeted campaigns, without, however, sharing information that personally identifies you.

Infrastructure Monitoring

This type of service enables Giufra to monitor the use and behavior of its components in order to improve performance and functionality, carry out maintenance, or resolve issues.

The Personal Data processed depends on the characteristics and manner of implementation of these services, which by their nature monitor Giufra's activity.

Firebase Performance Monitoring (Google Ireland Limited)

Firebase Performance Monitoring is a monitoring service provided by Google Ireland Limited.

Personal Data processed: various types of Data as specified in the service's privacy policy.

Place of processing: Ireland – Privacy Policy.

Traffic Optimization and Distribution

This type of service enables Giufra to distribute its content through servers located in various locations and to optimize its performance.

The Personal Data processed depends on the characteristics and manner of implementation of these services, which by their nature filter communications between Giufra and the User's browser.

Given the distributed nature of this system, it is difficult to determine the locations to which content — which may contain the User's Personal Data — is transferred.

Advertising

Some of the services listed below may use Tracking Tools to identify the User, or use behavioral retargeting techniques, i.e., displaying personalized advertisements based on the User's interests and behavior, or measuring advertisement performance. For further information, please check the privacy policies of the respective services. Services of this type generally offer the option to disable such tracking. In addition to any opt-out function provided by any of the services listed in this document, the User may read more on how to disable interest-based advertising in the section entitled "How to disable interest-based advertising" in this document.

Meta Ads Conversion Tracking (Meta Pixel) (Facebook, Inc.)

Meta Ads conversion tracking (Meta pixel) is a statistics service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Controller manages the processing of Data, which links data from the Meta advertising network with actions taken within Giufra. The Meta pixel tracks conversions that can be attributed to Facebook, Instagram, and Audience Network advertisements.

Personal Data processed: Usage Data; Tracking Tools.

Place of processing: USA – Privacy Policy.

Google Ads Conversion Tracking (Google Inc.)

Google Ads conversion tracking is a statistics service provided by Google LLC or by Google Ireland Limited, depending on how the Controller manages the processing of Data, which links data from the Google Ads advertising network with actions taken within Giufra.

Personal Data processed: Usage Data; Tracking Tools.

Place of processing: USA – Privacy Policy.

Facebook Audience Network (Facebook, Inc.)

Facebook Audience Network is an advertising service provided by Facebook, Inc. For an understanding of Facebook's use of data, please refer to Facebook's data policy.

To enable Facebook Audience Network to operate, Giufra may use certain identifiers for mobile devices (including Android Advertising ID or Advertising Identifier for iOS) or technologies similar to cookies. Among the methods used by Audience Network to present advertising messages to the User is the use of the User's advertising preferences. The User may control the sharing of their advertising preferences within Facebook's Ad settings.

The User may opt out of certain Audience Network targeting features through their device settings. For example, the User may modify the advertising settings available for mobile devices or follow the instructions applicable to Audience Network, if any, set out in this privacy policy.

Personal Data processed: Cookies; Usage Data; unique device identifiers for advertising (such as Google Advertiser ID or IDFA identifier).

Place of processing: United States – Privacy Policy – Opt-Out.

Facebook Lookalike Audience (Facebook, Inc.)

Facebook Lookalike Audience is an advertising and behavioral targeting service provided by Facebook, Inc. that uses Data collected through Facebook's Custom Audience service to display advertisements to Users with behaviors similar to those of Users already included in a Custom Audience list based on their prior use of Giufra or their interaction with relevant content through Facebook's applications and services.

Based on this Data, personalized advertisements will be displayed to Users suggested by Facebook's Lookalike Audience.

Users may choose not to use Facebook cookies for advertisement personalization by visiting this opt-out page.

Personal Data processed: Cookies; Usage Data.

Place of processing: United States – Privacy Policy – Opt-Out.

Google Ad Manager (Google Ireland Limited)

Google Ad Manager is an advertising service provided by Google Ireland Limited, with which the Controller may run advertising campaigns jointly with external advertising networks with which the Controller, unless otherwise specified in this document, has no direct relationship.

Users who do not wish to be tracked by the various advertising networks may use Youronlinechoices. For an understanding of Google's use of data, please refer to Google's partner policies.

This service uses the "DoubleClick" cookie, which tracks the use of Giufra and the User's behavior in relation to the advertisements, products, and services offered.

The User may decide at any time to disable all DoubleClick cookies by going to: Ads Settings.

Personal Data processed: Cookies; Usage Data.

Place of processing: Ireland – Privacy Policy.

Microsoft Advertising (Microsoft Corporation)

Microsoft Advertising is an advertising service provided by Microsoft Corporation.

Personal Data processed: Usage Data; Tracking Tool.

Place of processing: United States – Privacy Policy – Opt-Out. Transfer carried out under the EU-U.S. Data Privacy Framework.

Registration and Authentication

By registering or authenticating, the User allows the Application to identify them and grant them access to dedicated services.

Depending on what is indicated below, registration and authentication services may be provided with the assistance of third parties. Where this occurs, this application may access certain Data stored by the third-party service used for registration or identification.

Facebook Authentication (Facebook, Inc.)

Facebook Authentication is a registration and authentication service provided by Facebook, Inc. and linked to the Facebook social network.

Personal Data processed: various types of Data as specified in the service's privacy policy.

Place of processing: USA – Privacy Policy.

Facebook OAuth (Meta Platforms Ireland Limited)

Facebook OAuth is a registration and authentication service provided by Meta Platforms Ireland Limited and linked to the Facebook network.

Personal Data processed: Tracking Tools; various types of Data.

Place of processing: Ireland – Privacy Policy.

Sign in with Apple (Apple Inc.)

Sign in with Apple is a registration and authentication service provided by Apple Inc. Where the User is asked to provide their email address, Sign in with Apple may generate a private relay address on the User's behalf that automatically forwards messages to the User's verified personal email address — thereby concealing the User's email address from the Controller.

Personal Data processed: last name; date of birth; email; first name; phone number.

Place of processing: United States – Privacy Policy. Transfer carried out under the EU-U.S. Data Privacy Framework.

Remarketing and Behavioral Targeting

This type of service enables Giufra and its partners to communicate, optimize, and serve advertisements based on the User's past use of Giufra.

This activity is facilitated by tracking Usage Data and by the use of Tracking Tools to collect information that is then transferred to partners that manage remarketing and behavioral targeting activities.

Some services offer a remarketing option based on email address lists.

In addition to the opt-out features offered by the services listed below, the User may opt out by visiting the Network Advertising Initiative opt-out page.

Users may also choose not to participate in certain advertising features through the corresponding device configuration options, such as mobile device advertising configuration options or general advertising configuration.

Google Ads Remarketing (Google Inc.)

Google Ads Remarketing is a remarketing and behavioral targeting service provided by Google LLC or by Google Ireland Limited, depending on how the Controller manages the processing of Data, which links Giufra's activity with the Google Ads advertising network and the DoubleClick cookie.

Users may choose not to use Google cookies for advertisement personalization by visiting Google's Ads Settings.

Personal Data processed: Cookies; Usage Data.

Place of processing: USA – Privacy Policy – Opt-Out.

Facebook Custom Audience (Facebook, Inc.)

Facebook Custom Audience is a remarketing and behavioral targeting service provided by Facebook, Inc. that links Giufra's activity with the Facebook advertising network.

Personal Data processed: Cookies; email.

Place of processing: USA – Privacy Policy – Opt-Out.

Facebook Remarketing (Facebook, Inc.)

Facebook Remarketing is a remarketing and behavioral targeting service provided by Facebook, Inc. that links Giufra's activity with the Facebook advertising network.

Personal Data processed: Cookies; Usage Data.

Place of processing: USA – Privacy Policy – Opt-Out.

Remarketing with Google Analytics (Google Inc.)

Remarketing with Google Analytics is a remarketing and behavioral targeting service provided by Google LLC or by Google Ireland Limited, depending on how the Controller manages the processing of Data, which links the tracking activity carried out by Google Analytics and its cookies with the Google Ads advertising network and the DoubleClick cookie.

Personal Data processed: Cookies; Usage Data.

Place of processing: USA – Privacy Policy – Opt-Out.

Statistics

The services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to track User behavior.

Google Analytics for Firebase (Google Ireland Limited)

Google Analytics for Firebase, or Firebase Analytics, is an analytics service provided by Google Ireland Limited.

For an understanding of Google's use of data, please refer to Google's partner policies.

Firebase Analytics may share Data with other services provided by Firebase, including, for example, Crash Reporting, Authentication, Remote Config, or Notifications. The User may consult this privacy policy for a detailed description of the other tools used by the Controller.

To enable Firebase Analytics to operate, Giufra uses certain mobile device identifiers or technologies similar to cookies.

The User may opt out of certain Firebase features through their mobile device settings. For example, the User may modify the advertising settings available on their phone, or follow the instructions applicable to Firebase, if any, set out in this privacy policy.

Personal Data processed: in-app purchases.

Place of processing: Ireland – Privacy Policy.

Google Analytics (Universal Analytics) with Anonymized IP

Google Analytics (Universal Analytics) is a web analytics service provided by Google LLC or by Google Ireland Limited, depending on how the Controller manages the processing of Data ("Google"). Google uses the Personal Data collected to track and examine the use of Giufra, compile reports, and share them with other services developed by Google.

Google may use the Personal Data to contextualize and personalize the advertisements of its own advertising network.

This integration of Google Analytics anonymizes your IP address. Anonymization works by shortening Users' IP addresses within the boundaries of European Union member states or other countries party to the European Economic Area agreement. Only in exceptional cases will the IP address be sent to Google's servers and shortened within the United States.

For an understanding of Google's use of data, please refer to Google's partner policies.

Personal Data processed: Usage Data; Tracking Tool.

Place of processing: United States – Privacy Policy – Opt-Out; Ireland – Privacy Policy – Opt-Out.

Meta Events Manager (Meta Platforms Ireland Limited)

Meta Events Manager is a statistics service provided by Meta Platforms Ireland Limited. By integrating the Meta pixel, Meta Events Manager can provide the Controller with information on traffic and interactions on Giufra.

Personal Data processed: Usage Data; Tracking Tools.

Place of processing: Ireland – Privacy Policy.

Google Analytics 4 (Google Ireland Limited)

Google Analytics is a statistics service provided by Google Ireland Limited ("Google"). Google uses the Personal Data collected to track and examine the use of Giufra, compile reports, and share them with other services developed by Google.

Google may use the Personal Data to contextualize and personalize the advertisements of its own advertising network.

In Google Analytics 4, IP addresses are used at the time of collection and then deleted before the data is recorded in any data center or server. For further information, please refer to Google's official documentation.

For an understanding of Google's use of data, please refer to Google's partner policies.

Personal Data processed: Tracking Tools.

Place of processing: Ireland – Privacy Policy – Opt-Out.

AppsFlyer (AppsFlyer Ltd)

AppsFlyer is a statistics service provided by AppsFlyer Ltd.

Personal Data processed: Usage Data; Tracking Tools.

Place of processing: Israel – Privacy Policy – Opt-Out.

Display of Content from External Platforms

This type of service allows content hosted on external platforms to be viewed directly from Giufra's pages and interacted with.

Where a service of this type is installed, it is possible that, even if Users do not use the service, it will collect traffic data relating to the pages on which it is installed.

Google Fonts (Google Inc.)

Google Fonts is a font display service managed by Google LLC or by Google Ireland Limited, depending on how the Controller manages the processing of Data, which allows Giufra to integrate such content within its pages.

Personal Data processed: Usage Data; various types of Data as specified in the service's privacy policy.

Place of processing: USA – Privacy Policy.

Information on How to Disable Interest-Based Advertising

In addition to any opt-out function provided by any of the services listed in this document, Users may read more on how to disable interest-based advertising in the dedicated section of the Cookie Policy.

Further Information on the Processing of Personal Data

Push Notifications

Giufra may send push notifications to the User.

Online Sale of Goods and Services

The Personal Data collected is used to provide the Service to the User or for the sale of products, including payment and, where applicable, delivery. The Personal Data collected to complete payment may relate to the credit card, the bank account used for the transfer, or other payment instruments provided. The payment Data collected by Giufra depends on the payment system used.

Cookie Policy

Giufra uses Tracking Tools. To learn more, Users may consult the Cookie Policy.

Further Information for Users

Legal Basis of Processing

The Controller processes Personal Data relating to the User where one of the following conditions applies:

the User has given consent for one or more specific purposes;
processing is necessary for the performance of a contract with the User and/or for the performance of pre-contractual measures;
processing is necessary to comply with a legal obligation to which the Controller is subject;
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party.

It is nevertheless always possible to ask the Controller to clarify the specific legal basis of each processing activity, and in particular to specify whether the processing is based on law, provided for by a contract, or necessary to enter into a contract.

Further Information on Retention Period

Unless otherwise specified in this document, Personal Data is processed and retained for as long as required by the purpose for which it was collected and may be retained for a longer period due to any applicable legal obligations or on the basis of the User's consent. The period does not exceed 24 months in the event of non-use.

Accordingly:

Personal Data collected for purposes related to the performance of a contract between the Controller and the User will be retained until such contract has been fully performed.
Personal Data collected for purposes relating to the Controller's legitimate interest will be retained until such interest has been satisfied. The User may obtain further information regarding the legitimate interest pursued by the Controller in the relevant sections of this document or by contacting the Controller.

Where processing is based on the User's consent, the Controller may retain the Personal Data for a longer period until such consent is withdrawn. In addition, the Controller may be required to retain Personal Data for a longer period in order to comply with a legal obligation or a court/authority order.

Upon expiry of the retention period, Personal Data will be deleted. Accordingly, upon expiry of that period, the right of access, erasure, rectification, and the right to data portability may no longer be exercised.

User Rights under the General Data Protection Regulation (GDPR)

Users may exercise certain rights regarding Data processed by the Controller.

In particular, to the extent permitted by law, the User has the right to:

withdraw consent at any time. The User may withdraw consent previously given to the processing of their Personal Data.
object to the processing of their Data. The User may object to the processing of their Data where processing is carried out on a legal basis other than consent.
access their Data. The User has the right to obtain information regarding the Data processed by the Controller, certain aspects of the processing, and a copy of the Data processed.
verify and request rectification. The User may verify the accuracy of their Data and request that it be updated or corrected.
obtain restriction of processing. The User may request restriction of the processing of their Data. In such case, the Controller will not process the Data for any purpose other than storing it.
obtain erasure or removal of their Personal Data. The User may request that the Controller erase their Data.
receive their Data or have it transferred to another controller. The User has the right to receive their Data in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted, without hindrance, to another controller.
lodge a complaint. The User may lodge a complaint with the competent data protection supervisory authority or take legal action.

Users have the right to obtain information regarding the legal basis for the transfer of Data abroad, including to any international organization governed by international law or established by two or more countries, such as the United Nations, as well as regarding the security measures adopted by the Controller to protect their Data.

Details on the Right to Object

Where Personal Data is processed in the public interest, in the exercise of official authority vested in the Controller, or for the purposes of the legitimate interests pursued by the Controller, Users have the right to object to such processing on grounds relating to their particular situation.

Users are informed that, where their Data is processed for direct marketing purposes, they may object to such processing at any time, free of charge, and without providing any justification. Where Users object to processing for direct marketing purposes, their Personal Data will no longer be processed for such purposes. To find out whether the Controller processes Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to Exercise Rights

To exercise their rights, Users may direct a request to the Controller's contact details set out in this document. The request is free of charge and the Controller will respond as soon as possible, and in any case within one month, providing the User with all information required by law. Any rectification, erasure, or restriction of processing will be notified by the Controller to each recipient, if any, to whom the Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort. The Controller will inform the User of such recipients where the User so requests.

Further Information on Processing

Defense in Legal Proceedings

The User's Personal Data may be used by the Controller in court, or in the stages leading to potential legal proceedings, to defend against misuse of Giufra or of related Services by the User.

The User acknowledges that the Controller may be required to disclose Data pursuant to an order of a public authority.

Specific Notices

Upon the User's request, in addition to the information contained in this privacy policy, Giufra may provide the User with additional, contextual notices regarding specific Services, or the collection and processing of Personal Data.

System Logs and Maintenance

For operational and maintenance purposes, Giufra and any third-party services it uses may collect system logs, i.e., files that record interactions and that may also contain Personal Data, such as the User's IP address.

Information Not Contained in This Policy

Further information regarding the processing of Personal Data may be requested from the Data Controller at any time using the contact details provided.

Changes to This Privacy Policy

The Data Controller reserves the right to make changes to this privacy policy at any time by notifying Users on this page and, where possible, on Giufra, as well as, where technically and legally feasible, by sending a notice to Users through one of the contact details in its possession. Users are therefore invited to check this page frequently, referring to the date of last modification indicated at the bottom.

Where changes affect processing activities whose legal basis is consent, the Controller will collect the User's consent again, where necessary.

Definitions and Legal References

Personal Data (or Data)

Personal data means any information that, directly or indirectly, including by reference to any other information — including a personal identification number — makes a natural person identified or identifiable.

Usage Data

Usage Data is information collected automatically through Giufra (including from third-party applications integrated into Giufra), such as: the IP addresses or domain names of the computers used by the User connecting to Giufra, URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (successful outcome, error, etc.), the country of origin, the characteristics of the browser and operating system used by the visitor, the various time details of the visit (e.g., the time spent on each page), and details regarding the path followed within the Application, with particular reference to the sequence of pages consulted, parameters relating to the operating system, and the User's computing environment.

User

The individual using Giufra who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data relates.

Data Processor (or Processor)

The natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Controller)

The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data and the tools adopted, including the security measures relating to the operation and use of Giufra. The Data Controller, unless otherwise specified, is the owner of Giufra.

Giufra (or this Application)

The hardware or software tool by means of which Users' Personal Data is collected and processed.

Service

The Service provided by Giufra as defined in the relevant terms (if any) on this website/application.

European Union (or EU)

Unless otherwise specified, any reference to the European Union in this document is intended to extend to all current member states of the European Union and of the European Economic Area.

Cookies

Cookies are Tracking Tools consisting of small pieces of data stored within the User's browser.

Tracking Tool

A Tracking Tool means any technology — e.g., Cookies, unique identifiers, web beacons, embedded scripts, e-tags, and fingerprinting — that enables Users to be tracked, for example by collecting or storing information on the User's device.

Legal References

Unless otherwise specified, this privacy policy relates solely to Giufra.

Last updated: June 2026

Cart0 items

Privacy Policy

Privacy Policy of GIUFRA S.R.L., owner of the "ASTRA MAKE UP" trademark