PRIVACY POLICY

INFORMATION ON THE PROCESSING OF PERSONAL DATA

 

Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”)

 

Last updated: 10/05/2026

 

This Privacy Policy explains how personal data is collected and processed when Users browse or use www.styleincapsule.com and its related services.

 

This Policy applies only to this Website and does not apply to third-party websites.

 

 

1. DATA CONTROLLER

 

Simona Rizinska
Style in Capsule
Via Giosuè Carducci 61
23100 Sondrio (SO) – Italy
Tax Code: RZNSMN89R50Z148K
VAT Number: IT01010080149
Email: [email protected]

 

 

2. PERSONAL DATA COLLECTED

 

The Website may collect the following data:

 

  • identification data (name, surname)

  • contact data (email, billing address)

  • account credentials

  • order and purchase data

  • payment-related data (processed externally)

  • newsletter data

  • customer support messages

  • quiz and questionnaire responses

  • photographs submitted for personalised services (Color Analysis)

  • course access and progress data

  • technical and usage data

  • cookies and similar technologies used for website functionality, security (including fraud prevention), and analytics

  • communication and marketing interaction data, including email engagement data (ActiveCampaign) and messaging automation data (ManyChat)

 

Photographs and questionnaire data are collected only when voluntarily submitted by the User.

 

 

3. PURPOSES AND LEGAL BASIS OF PROCESSING

 

3.1 Website Operation and Security

 

  • ensure website functionality

  • prevent fraud and abuse

  • maintain system security

  • generate aggregated statistics

 

Legal basis: legitimate interest

 

3.2 Contact and Support

 

  • respond to requests

  • provide assistance

  • manage pre-contractual communication

 

Legal basis: pre-contractual measures + legitimate interest

 

3.3 Purchases and Order Management (WooCommerce System)

 

The Website uses WooCommerce to manage the online store, checkout process, and order management.

 

Through WooCommerce, the following operations are carried out:

 

  • cart and checkout management

  • order processing

  • customer account creation and management

  • invoice and accounting data handling

  • order communication and support

 

Legal basis:

  • performance of a contract

  • legal obligations

 

WooCommerce acts as the ecommerce system enabling these functions.

 

3.4 Payment Processing (PayPal and Stripe Payments)

 

Payments are processed through third-party providers integrated into WooCommerce, including:

  • PayPal

  • Stripe

 

Payment data (such as credit card details) is processed directly by the payment provider and is not stored by the Data Controller.

PayPal and Stripe act as independent data controllers for payment processing.

Users are encouraged to consult PayPal’s and Stripe’s Privacy Policies.


https://www.paypal.com/privacy

https://stripe.com/en-it/privacy

 

3.5 Newsletter and Marketing Communications

 

  • newsletters

  • promotional emails

  • free resources

  • automated marketing flows

 

Legal basis: consent

Consent may be withdrawn at any time.

 

3.6 Personalised Services (Color Analysis)

 

Users may submit photographs and personal information to receive personalised services.

Purpose:

  • color analysis

  • styling recommendations

  • personalised reports

 

Legal basis:

 

  • contract performance

  • explicit consent 

 

Photographs

 

Photographs are:

  • used exclusively to provide the requested service

  • not shared publicly without additional consent

  • stored securely with restricted access

  • deleted after service delivery unless legally required

 

3.7 Online Courses

 

  • course access

  • progress tracking

  • user management

 

Legal basis: contract + legitimate interest

 

 

4. ANALYTICS, FRAUD PREVENTION AND SECURITY

 

4.1 Independent Analytics

 

The Website uses Independent Analytics, a privacy-friendly and cookie-less analytics tool used to understand website performance and usage trends.

 

This tool does not use cookies and does not store personal identifiers.

 

Data may include:

  • anonymised IP data

  • browser and device information

  • page interactions

  • session-based usage data

 

Legal basis:

 

  • legitimate interest and/or consent

 

4.2 Google reCAPTCHA (Fraud Prevention)

 

The Website uses Google reCAPTCHA to protect the WooCommerce checkout process from spam, automated abuse, and fraudulent activity.

 

Google reCAPTCHA is integrated within the WooCommerce checkout system.

 

reCAPTCHA may collect:

  • IP address

  • device and browser information

  • user interaction behaviour (mouse movements, scrolling, timing)

  • cookies and technical identifiers

 

Purpose:

  • fraud prevention

  • protection of checkout processes

  • security of the Website

 

Legal basis:

  • legitimate interest of the Data Controller (website security and fraud prevention)

 

Google may act as an independent data controller for this processing.

 

 

 

5. WEBSITE TECHNOLOGIES AND SERVICE PROVIDERS

 

The Website uses:

  • WordPress (content management system)

  • WooCommerce (e-commerce system)

  • Elementor Pro (website design and page builder)

  • SiteGround (hosting and infrastructure provider)

 

SiteGround Privacy Policy:
https://www.siteground.com/privacy.htm

 

6. NEWSLETTER SERVICE (ACTIVECAMPAIGN)

 

The Website uses ActiveCampaign for email marketing and automation.

Data processed:

  • name

  • email address

  • interaction data (opens, clicks)

  • segmentation data

Purpose:

  • newsletters

  • marketing emails

  • automated communication flows

  • delivery of free resources

 

Legal basis: consent

 

 

7. MANYCHAT (SOCIAL MEDIA AUTOMATION)

 

Used for automated communication via social media platforms (Instagram, Messenger).

Data processed:

  • usernames

  • messages

  • voluntarily provided contact data

 

 

 

8. DESIGN TOOL (CANVA)

 

Canva is used to create, design, and manage visual content for the delivery of services, including personalised color analysis and styling reports provided to clients.

 

It may also be used to process and organise images voluntarily submitted by Users for personalised services such as colour analysis and styling consultations.

 

Data processed may include:

  • uploaded images (including client photographs for personalised services)

  • design content, including personalised reports and visual deliverables

  • technical usage data

 

Legal basis:

 

  • performance of a contract

  • legitimate interest

  • consent where required

 

 

9. COOKIES

 

Cookies and similar technologies are used for:

 

  • essential website functionality

  • security and fraud prevention (including checkout protection)

  • analytics (website usage statistics and performance measurement)

  • user preferences (such as cookie consent and basic site functionality)

 

Cookie consent is managed via CookieYes.

 

More information is available in the Cookie Policy.

 

 

10. SOCIAL MEDIA

 

The Website may include links to social media platforms such as Instagram, Facebook, Pinterest, TikTok, and LinkedIn.

 

Any interaction with these platforms (including external links or embedded content) is subject to the respective privacy policies of those platforms.

 

 

11. DATA RETENTION

Personal data is retained only for as long as necessary for the purposes for which it was collected, in accordance with applicable legal, contractual, and accounting obligations

 

Retention periods are determined based on the type of data and the purpose of processing, as outlined below.

 

11.1 Customer Accounts

Inactive customer accounts are retained for a limited period to allow account recovery, customer support, and potential future purchases. After this period, accounts are deleted or anonymised unless retention is required for legal or administrative purposes.

 

11.2 Orders and Transactions

Personal data related to orders is retained for the duration of the contractual relationship and, depending on the order status, for different retention periods necessary for operational, legal, and accounting purposes:

 

  • pending orders are retained for a short period to allow payment completion

  • failed orders are retained for a limited period for fraud prevention and payment troubleshooting

  • cancelled orders are retained for a limited period for administrative and dispute management purposes

  • refunded orders are retained for the period required for accounting, tax compliance, and financial record-keeping

  • completed orders are retained for up to 10 years in accordance with Italian tax and accounting obligations

 

11.3 Accounting and Legal Obligations

Data related to invoices, payments, and accounting records is retained for up to 10 years, as required by applicable Italian tax and civil law.

 

11.4 Payment Processing Data

Payment-related data is processed through third-party payment providers, including PayPal and Stripe.

 

The Data Controller does not store full payment card details. Transaction records may be retained for accounting and reconciliation purposes in accordance with legal obligations.

 

11.5 Customer Support Communications

Customer support messages and communications are retained only for the time necessary to handle the request, ensure proper follow-up, and manage potential disputes or legal claims.

 

11.6 Marketing Data

Marketing data is retained until the User withdraws consent. Upon withdrawal, data is removed or anonymised in accordance with applicable law.

 

11.7 Photographs and Personalised Services

Photographs and materials submitted by Users for personalised services (such as colour analysis and styling consultations) are retained only for the time necessary to deliver the requested service and provide limited post-service support.

 

After completion, data is deleted or anonymised unless retention is required for legal obligations or dispute resolution.

 

11.8 General Principle

In all cases, personal data is not retained longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or necessary to establish, exercise, or defend legal claims.

 

 

12. INTERNATIONAL DATA TRANSFERS

 

Some of the third-party service providers used by the Website may transfer personal data outside the European Economic Area (EEA), including to countries that may not offer the same level of data protection.

 

These transfers may occur through the use of services such as:

  • payment processing (e.g. PayPal and Stripe)

  • email marketing services (e.g. ActiveCampaign)

  • messaging automation tools (e.g. ManyChat)

  • hosting and infrastructure providers (e.g. SiteGround)

  • design and content tools (e.g. Canva)

 

Where such transfers occur, they are carried out in compliance with the GDPR and are based on appropriate safeguards, including:

 

  • adequacy decisions issued by the European Commission

  • Standard Contractual Clauses approved by the European Commission

  • additional technical and organisational safeguards where applicable

 

Users may request further information regarding international data transfers and the safeguards applied by contacting the Data Controller.

 

13. DATA SECURITY

The Data Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or unlawful processing.

However, no method of internet transmission or electronic storage can guarantee absolute security.

 

14. USERS’ RIGHTS

Under Articles 15–22 of the GDPR, Users have the right to:

  • obtain confirmation as to whether their personal data is being processed and access such data

  • request the rectification of inaccurate or incomplete data

  • request the erasure of personal data where applicable

  • request the restriction of processing in certain circumstances

  • object to the processing of personal data where applicable

  • receive personal data in a structured, commonly used, and machine-readable format (data portability)

  • withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal

  • lodge a complaint with a supervisory authority

 

In Italy, the competent supervisory authority is:

Garante per la Protezione dei Dati Personali
https://www.garanteprivacy.it

 

Users may exercise their rights or request further information by contacting:

 

15. MINORS

The Website is not intended for use by minors below the legal age of consent under applicable law. The Data Controller does not knowingly collect personal data from minors. If such data is identified, it will be deleted without delay.

 

16. CHANGES TO THIS POLICY

This Privacy Policy may be updated or modified from time to time. Any changes will be published on this page, and Users are encouraged to review it periodically.

 

17. CONTACT

Data Controller:
Simona Rizinska – Style in Capsule
Email: [email protected]

For any questions regarding this Privacy Policy or the processing of personal data, Users may contact the Data Controller at the above email address.

Instagram Pinterest Linkedin Facebook Tiktok