Our Privacy Policy
KIKO S.p.A.,with registered office in Bergamo, via Giorgio e Guido Paglia n. 1/D, 24122, VAT No. 02817030162, Tax Code 12132110151 (hereinafter, the "Company" or "KIKO").
Email address: dpo.kiko@kikocosmetics.com
During the creation of an online account, you will be asked to enter the mandatory Data and a password, which will serve as authentication and access credentials for your account. Before filling in the registration form to create an account, the system will ask you to enter your email and the OTP code received at the email address provided, in order to validate the existence of the email address. Once you have entered the OTP code, you may proceed to fill in the form.
Furthermore, the term "Data" also includes browsing data; this category consists of the source IP address, the URL address, the type of "agent" (e.g. Chrome, Firefox, Safari) and the time of access. This information, acquired by the computer systems and software procedures used to operate the website in the course of their normal activity, is not collected in order to be associated with identified data subjects but, through processing and association with data held by third parties, it could potentially allow the user to be identified.
Regarding the use of cookies and other tracking tools, please refer to the cookie policy available on the website footer.
B) Contractual purposes: booking of beauty services, purchase of products and/or services, payment and delivery of the Data Controller's products.
C) KIKO ME loyalty program (for persons over 18 years of age): joining the loyalty program involves (i) the creation and management of a personal KIKO account, (ii) loyalty membership, i.e. the possibility of accumulating points for every purchase made online by logging in, and of being assigned one of the loyalty levels provided for, of receiving exclusive rewards and related benefits such as, by way of example but not limited to, the granting of discounts reserved for KIKO ME members, the redemption of rewards, participation in any events, promotions, previews of collections or the launch of new products dedicated according to one's loyalty level; (iii) receiving transactional communications relating to KIKO ME (e.g. welcome communications, birthday communications, communications on reaching a new loyalty level, reaching rewards or exclusive benefits, expiry of points or of the program) via email; (iv) support through the Customer Care service of the Data Controller in the event of requests for information/assistance or complaints.
D) Compliance with legal obligations: compliance with administrative/accounting obligations established by applicable law.
E) Legal actions or defence: to bring an action, exercise and/or defend the rights of the Data Controller in legal proceedings.
F) Soft spam: sending of communications limited to existing customers, with the aim of directly promoting and/or selling products or services similar to those already purchased/used by the customer, using the email addresses provided for such purposes, without prejudice to the right to object at any time in the manner indicated at the bottom of the communication and at the contact details indicated below, in order to exercise your rights under Art. 15 et seq. of GDPR.
G) Profiling: by giving consent to this purpose, you agree to receive personalised commercial communications based on your preferences, purchasing habits, related behaviour and/or interests by means of automated contact methods (email) or advertising material, newsletters, promotional and commercial communications relating to the Data Controller's products and/or events, as well as any market research and statistical analysis conducted. Furthermore, by giving your consent to this purpose, your encrypted email address will be disclosed to certain third party social and paid media platforms (e.g. Google, Meta, Amazon, Snapchat) in order to offer you, through interactions and information processed via advertising platforms, more targeted advertising based on your interests, behaviour and purchases.
H) Direct marketing purposes: sending by means of automated contact methods (email) of advertising material, newsletters, promotional and commercial communications relating to the Data Controller's products and/or events, as well as carrying out market research and statistical analysis.
You can consent to direct marketing by providing your email address and eventually your telephone number ticking the checkbox for direct marketing.
I) Collection and display of individual users’ reviews and their disclosure to the public: your data, such as name, email address, browser-generated information, location data, IP addresses, information on recent purchases, order numbers, as well as photos and videos of the products purchased, may be collected in order to ask you by email to leave a review of your purchase and to publish it.
B) Contractual purposes: performance of a contract (or pre-contractual measures). Art. 6(1)(b) of the GDPR.
C) KIKO ME loyalty program (for persons over 18 years of age): performance of a contract (or of pre-contractual measures). Art. 6(1)(b) of the GDPR.
D) Compliance with legal obligations: compliance with a legal obligation. Art. 6(1)(c) of the GDPR.
E) Legal actions or defence: legitimate interest of the Data Controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail. Art. 6(1)(f) of the GDPR.
F) Soft spam: Legitimate interest of the Data Controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail. (Recitals 47-50). Art. 6(1)(f) of the GDPR.
G) Profiling: Consent (optional and revocable at any time), given by persons who have reached the age of 18. Art. 6(1)(a) of the GDPR.
H) Direct marketing purposes: Consent (optional and revocable at any time), given by persons who have reached the age of 18. Art. 6(1)(a) of the GDPR.
I) Collection and display of individual users’ reviews and their disclosure to the public: Legitimate interest of the Data Controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail. Art. 6(1)(f) of the GDPR.
Please refer to the cookie policy available on the website footer.
B) Contractual purposes + D) Fulfilment of legal obligations: For the entire duration of the contract and, upon expiry, for the ordinary period of 10 years.
C) KIKO ME loyalty program (for persons over 18 years of age): the Data will be stored for the entire duration of membership in the loyalty program. In the event of a deletion request of the account in accordance with the procedures indicated in the paragraph “Your rights as a data subject – complaint to the competent Authority – automated processing”, the Data processed exclusively for the management of the loyalty program will be deleted or anonymised within 30 days from the request and, in any event, within the technical time necessary to fulfil the request. This is without prejudice to data whose further retention is necessary to comply with legal obligations or to protect the rights of the Data Controller (for example, data relating to purchases), which will be retained for the period provided for by applicable law and, following termination, for 10 years, unless different retention periods are provided for by law or by specific regulations.
E) Legal actions or defence: in the event of a legal dispute, for the entire duration of the dispute and in any case until the expiration of the deadline for filling appeals.
F) Soft spam: 36 months from the last purchase or until objection to the processing, if earlier. You can object at any time to the processing using the direct link within each communication.
G) Profiling: your purchases will be examined to analyse your preferences, habits and related behaviours with the aim of sending to you personalised communications – including through interactions with social networks and paid media platforms – with a historical depth not exceeding 36 months from the last "enabling interaction". "Enabling interaction" means the receipt and acknowledgment of the receipt of an email confirming that the processing of personal data for this purpose will be renewed for a further 36 months, without prejudice to the right to opt out in accordance with the procedures set out in the section "Your rights as a data subject – complaint to the competent Authority – automated processing" of this privacy policy.
H) Direct marketing purposes: 36 months from the Data Subject's last "enabling interaction" with the Data Controller and, in any case, until consent is withdrawn. "Enabling interaction" means the receipt and acknowledgment of the receipt of an email confirming that the processing of personal data for this purpose will be renewed for a further 36 months, without prejudice to the right to opt out in accordance with the procedures set out in the section "Your rights as a data subject – complaint to the competent Authority – automated processing" of this privacy policy.
I) Collection and display of individual users’ reviews and their disclosure to the public: 36 months from the collection and publication of your review. You can object to the processing at any time using the direct link within each communication or in accordance with the procedures indicated in the paragraph “Your rights as a data subject – complaint to the competent Authority – automated processing”of this information notice.
Upon expiry of the aforementioned ùdata retention periods, personal data will be destroyed, deleted or anonymised in accordance with the Data Controller's technical deletion and backup procedures.
For purposes B), C) and D) the provision of Data is mandatory. Any refusal to provide Data will therefore make it impossible to complete you from purchase of products and/or making use of the Data Controller's services, as well as to create a KIKO account by joining the KIKO ME loyalty program, and to comply with the related legal obligations.
The provision of Data for purposes G), and H) is optional. Refusal to give consent for purposes G) and H) will not affect the possibility of browsing the website and purchasing the Data Controller's products and/or services. Refusal to give consents for purposes G) and H) will prevent you from receiving automated communications (email), newsletters on Data Controller's events and promotions, as well as personalised communications, including through interactions on social networks and paid media platforms, based on your purchasing habits, preferences and related behaviour.
The Data may also be processed on behalf of the Data Controller by external parties appointed as data processors pursuant to Art. 28 of the GDPR, who are provided with adequate operating instructions for the correct processing of Data. These parties essentially fall into the following categories, by way of example: companies providing email sending services, companies providing website maintenance and development services, social media channels, companies providing support for market research studies, companies providing after-sales customer support and assistance, shipping and transportation companies, companies providing postal services and other marketing activities, companies of KIKO Group providing intra-group services.
The Data may be processed by employees of the Data Controller's business units responsible for pursuing the purposes indicated above, who are expressly authorised to process the Data and who have received adequate operating instructions pursuant to Art. 29 of the GDPR.
Your Data may be processed by employees of the Data Controller's business units responsible for pursuing the aforementioned purposes, who have been expressly authorized to process the Data and have received appropriate operational instructions in accordance with Article 29 of the GDPR.
In any case, it is understood that the transfer of Data to third countries located outside the EEA (including the USA) will take place in accordance with Articles 44 et seq. of the GDPR, implementing safeguarding measures to ensure an adequate level of data protection during the transfer of your Data, including:
adequacy decisions adopted by the European Commission regarding third countries that guarantee an adequate level of protection;
data transfer agreements incorporating the European Commission's Standard Contractual Clauses;
additional measures required by applicable regulations and/or orders of the competent authorities
or other measures applicable as derogations for specific situations.
For further information on the purposes and means of Data processing carried out by social networks, please refer to their privacy policies:
Instagram: https://privacycenter.instagram.com/policy;
Facebook: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0;
Twitter: https://twitter.com/en/privacy;
YouTube: https://www.youtube.com/intl/en_us/howyoutubeworks/our-commitments/protecting-user-data/;
TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en.
With regard to the processing relating to profiling, including when conducted by means of customer audience and social advertising channels, please refer to the privacy policies of the following third parties:
Amazon ads: https://advertising.amazon.com/it-it/legal/privacy-notice
Google ads: https://safety.google/intl/it_it/privacy/ads-and-data/
Snapchat ads https://values.snap.com/privacy/ads-privacy
Meta: the Data Controller and Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4 Ireland (“Meta Ireland”), act as joint controllers, on the basis of a specific joint controllership agreement. For further information on how Meta Ireland processes personal data, please refer to the privacy policy available at this link
https://www.facebook.com/legal/terms/businesstools and the data processing appendix available here
TikTok: the Data Controller and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, act as joint data controllers, on the basis of a specific joint controllership agreement. For further information on how TikTok Technology Limited processes personal data, please refer to the privacy policy available at this link
https://www.tiktok.com/legal/page/global/partner-privacy-policy/en and TikTok Business Products' (Data) Terms & Conditions here https://ads.tiktok.com/i18n/official/policy/business-products-terms.
Furthermore, in the event of registration, recognition is provided by means of an e-mail address and password using an "Identity provider" service provided by Google.
Regarding the transfer and processing of your IP and email address by Google, please refer to the relevant privacy policy:
[TEXTSTART] By contacting the Data Controller at the email address dpo.kiko@kikocosmetics.com, you have the right to access the Data (Art. 15 GDPR), to request rectification or completion of incomplete Data (Art. 16 GDPR), the deletion of Data in cases provided for by law (Art. 17 GDPR) or restriction of processing (Art. 18 GDPR).
Furthermore, pursuant to Art. 20 GDPR, with reference to processing based on the contract or consent performed by automated means, you have the right to receive your Data in a structured, commonly used and machine-readable format, as well as the right to obtain the direct transmission of the Data by the Data Controller to another data controller, if technically feasible.
Pursuant to Art. 21 GDPR, you also have the right to object at any time to the processing of your Data based on legitimate interests, where applicable.
You have the right to withdraw your consent for marketing and/or profiling purposes at any time by logging into your account on the Website (and going to "Privacy Settings" section) or by writing an email to dpo.kiko@kikocosmetics.com. In addition, you have the right to request the deletion of your KIKO account and, therefore, your membership to KIKO ME loyalty program at any time by writing to the email address dpo.kiko@kikocosmetics.com. Withdrawal of consent does not in any way affect the lawfulness of the processing based on your consent prior to withdrawal.
Finally, you have the right to lodge a complaint with the competent Supervisory Authority in the Member State where you live, work or habitually reside, or where the alleged infringement occurred.
Furthermore, the Data Controller informs you that no automated decision-making processing exists.
Last updated: August 28, 2026.
