Privacy Policy

Last updated: May 15, 2026

This policy describes how Kanekalon Jumbo Hair Shop di Valeria Finardi collects, uses, and protects the personal data of users who visit the website and use its services.

The processing of personal data occurs in compliance with EU Regulation 2016/679 ("GDPR") and applicable Italian legislation on personal data protection. (European Commission)

1. Data Controller

The Data Controller is:

Kanekalon Jumbo Hair Shop di Valeria Finardi
Email: info@kanekalonjumbohairshop.com
Address: via G. Alberghini 16, Ferrara (FE)

For any request regarding the processing of personal data, please contact the Controller at the email address provided above.

2. Types of Data Collected

The website may collect the following categories of personal data:

a) Data provided during purchase

  • First and last name

  • Email address

  • Billing and shipping address

  • Phone number, if provided during the order process

  • Data necessary for order and delivery management

b) Payment-related data

Payments are handled by external payment service providers.
Kanekalon Jumbo Hair Shop does not directly store full payment card details.

c) Data provided via contact forms or email

  • Name

  • Email address

  • Content of the message or request sent

d) Data provided for newsletter subscription

  • Email address

  • Any preferences or consents expressed by the user

e) Navigation and website usage data

During navigation, technical data and information related to website usage may be collected, including through cookies and similar technologies, as indicated in the section dedicated to Cookies.

3. Purposes of Processing

Personal data is processed for the following purposes:

a) Order and shipping management

To process purchases made on the website, manage payments, arrange product shipments, provide order updates, and fulfill obligations related to sales.

b) Request and contact management

To receive, handle, and respond to questions, support requests, or information sent via email or the contact form on the website.

c) Commercial communications and newsletters

To send newsletters, promotions, product updates, restocks, and commercial communications, exclusively with the user's explicit consent.

d) Tax, accounting, and legal compliance

To comply with obligations under applicable regulations, including tax, accounting, and administrative provisions.

e) Statistical analysis and website improvement

To monitor website usage, understand page functionality, improve the browsing experience, and optimize offered services, within the limits permitted by law and the user's expressed cookie preferences.

4. Legal Basis for Processing

The processing of personal data is based on the following legal grounds:

a) Performance of a contract or pre-contractual measures

Art. 6(1)(b) GDPR

For:

  • order management;

  • payments;

  • shipments;

  • communications related to purchases;

  • requests concerning products, orders, purchases, or customer support.

b) Consent of the data subject

Art. 6(1)(a) GDPR

For:

  • newsletter subscription;

  • sending promotional and commercial communications;

  • any processing based on non-technical cookies, where required.

Consent can be withdrawn at any time.

c) Legal obligation

Art. 6(1)(c) GDPR

For:

  • tax compliance;

  • accounting obligations;

  • any obligations imposed by competent authorities.

d) Legitimate interest of the Controller

Art. 6(1)(f) GDPR

For:

  • managing and responding to generic requests or communications spontaneously sent via email or contact form;

  • protecting the Controller's rights in case of disputes or documentary needs, within the limits permitted by law.

Identifying an appropriate legal basis is necessary for processing personal data lawfully. (edpb.europa.eu)

5. Processing Methods

Personal data is processed using electronic tools and, where necessary, with appropriate organizational and administrative methods.

Processing occurs according to principles of:

  • lawfulness;

  • fairness;

  • transparency;

  • data minimization;

  • storage limitation;

  • integrity and confidentiality. (European Commission)

6. Data Retention

Personal data will be stored for the time strictly necessary to achieve the purposes for which it was collected and, subsequently, for the periods prescribed by applicable law.

Specifically:

  • order-related data will be stored for the time necessary to manage the sale and for the terms required by tax and accounting regulations;

  • newsletter-related data will be stored until consent is withdrawn or subscription is canceled;

  • data transmitted via contact form or email will be stored for the time necessary to handle the request and, where useful, for a reasonable subsequent period for communication traceability and Controller protection;

  • data processed based on legal obligations will be stored for the period specified by applicable regulations.

The GDPR requires indicating the retention period or, when it is not possible to define it precisely, the criteria used to determine it. (European Commission)

7. Data Recipients

Personal data may be shared, strictly as necessary, with the following categories of entities:

  • couriers, shippers, and logistics operators, for product delivery;

  • payment service providers, for transaction management;

  • platforms and technology providers used for the operation of the e-commerce website, contact forms, email communications, and related digital services;

  • consultants, accountants, or other professionals, for tax, accounting, or legal compliance;

  • public authorities or authorized entities, as required by legal obligations.

Data will not be sold to third parties.

8. Data Transfer Outside the European Economic Area

Some technology service providers used by the website may process personal data outside the European Economic Area.

In such cases, the transfer will comply with applicable regulations, through adequate safeguards provided by the GDPR, such as adequacy decisions, standard contractual clauses, or other instruments recognized by current legislation. (European Commission)

9. Data Subject Rights

Users may exercise the following rights, in cases provided by Articles 15–22 of the GDPR:

  • obtain confirmation as to whether or not personal data concerning them is being processed;

  • access their personal data;

  • request the rectification of inaccurate or incomplete data;

  • request the erasure of data, within the limits provided by law;

  • request restriction of processing;

  • object to processing, where applicable;

  • receive data in a structured, commonly used, and machine-readable format, where applicable;

  • withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;

  • lodge a complaint with the Personal Data Protection Authority.

To exercise these rights, please write to:

info@kanekalonjumbohairshop.com

The Controller is obliged to facilitate the exercise of data subjects' rights and to handle received requests in accordance with the GDPR. (edpb.europa.eu)

10. Newsletter and Marketing Communications

Newsletter subscription is entirely voluntary.

Users who choose to subscribe may receive:

  • promotional communications;

  • product news;

  • information on restocks and new arrivals;

  • any exclusive offers.

Consent to marketing communications is optional and can be withdrawn at any time via the unsubscribe link in every email or by contacting:

info@kanekalonjumbohairshop.com

Requests sent via contact form or email do not automatically result in newsletter subscription, and data provided for support purposes will not be used for marketing without specific consent.

Consent for promotional purposes must be freely given, specific, and informed. (Garante Privacy)

11. Cookies

The website uses technical cookies and, with the user's consent when required, functional, analytical, or profiling cookies.

Cookies may be used to:

  • ensure the correct functioning of the website;

  • remember browsing preferences;

  • analyze website usage;

  • improve user experience;

  • support any advertising activities, where activated and permitted.

Users can manage or modify their preferences via the cookie banner or the tools provided on the website.

12. Data Security

The Controller adopts appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, accidental loss, or destruction.

However, no computer system can guarantee absolute security; the Controller is nevertheless committed to treating data with a level of protection adequate to the nature of the information collected.

13. Changes to the Privacy Policy

This Privacy Policy may be updated or amended at any time, including as a result of regulatory changes, modifications to offered services, or updates to data processing methods.

Any changes will be published on this page with the date of the last update indicated.