Privacy notice
This notice explains how Oliviér Estetica Sartoriale processes your data when you visit the site, write to us, prepare a boutique request or go on to book.
This is a translation. The Italian text is the reference version.
Data controller
Oliviér Estetica Sartoriale, Via dell’Arancio 45, 00186 Rome, Italy, VAT no. 17909821005. For any request about your data, write to centrobenessereolivier@gmail.com or use the details on the Contact page.
What we do with your data, on what basis and for how long
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Answering requests from the contact form, dedicated pages and WhatsApp | Name, email, phone, area of interest, message | Pre-contractual steps you ask for, Art. 6(1)(b) GDPR | As long as needed to answer and to manage any relationship that follows |
| Handling an availability request from the boutique | First name, last name, email, phone, notes, products and quantities | Pre-contractual steps you ask for, Art. 6(1)(b) GDPR | As long as needed to answer and to manage any relationship that follows |
| Managing your appointment | The booking details we receive from Treatwell or that you give us directly | Performance of a contract, Art. 6(1)(b) GDPR | As long as needed to manage the relationship |
| Meeting legal obligations, for example accounting | The data the rule requires | Legal obligation, Art. 6(1)(c) GDPR | The period set by law |
| Running the site and limiting abuse | Technical browsing data and IP address | Legitimate interest in keeping the site running and avoiding automated form submissions, Art. 6(1)(f) GDPR | When the contact form sends email, the IP address counts towards the submission limit for 10 minutes: it stays only in the server’s memory and does not reach technical logs or emails. Technical data stay with the hosting provider for the period set by the service |
| Statistics on how the site is used | Pages viewed, clicks on phone, WhatsApp, email and booking, sending a request with the area chosen, device, approximate geographic area, online identifiers such as those saved in cookies | Consent, Art. 6(1)(a) GDPR | In Google Analytics, events are kept for 2 months and user-level data for 14 months, a period that restarts with each new activity. Aggregated reports do not follow these periods. Cookie durations are in the cookie policy |
| Measuring and personalising advertising campaigns | Online identifiers such as those saved in cookies, pages viewed, clicks, data about a click on an ad, sending a request without its content | Consent, Art. 6(1)(a) GDPR | Cookie durations are in the cookie policy. For event data, Meta states a maximum of 2 years |
| Showing the map on the Contact page | IP address and browsing data your browser sends to Google | Consent, Art. 6(1)(a) GDPR | Google processes them as controller, under its own notice |
Do you have to give us this data?
No. Without the details the forms ask for, though, we cannot answer you. Statistics, marketing and the map are optional: if you reject them, the site still works.
Health data
The forms do not ask for health data, and we ask you not to write it in the message or notes: if it matters, we will talk in person. If you write it anyway, we use it only to answer your request and do not keep it longer than needed. The message is not sent to statistics or marketing tools.
Who receives the data
| Who | What they receive and why |
|---|---|
| People authorised by the atelier | They read requests and manage appointments. |
| Suppliers working on the site and campaigns | They access data only when their work requires it, on our behalf. |
| Hosting provider | Delivers the site. It processes technical browsing data and form data while the site prepares the message. |
| Email delivery provider | It delivers form requests to the atelier, and the copy of a boutique request if you choose it. It keeps the messages it delivers for up to 30 days. |
| Provider of the atelier’s mailbox | Stores the emails we receive and send. |
| Google Ireland Limited | With your consent. For Google Analytics and Google Tag Manager, Google processes data on our behalf. For Google Ads and Google Maps, Google is an independent controller. |
| Vercel | With your consent to statistics, Vercel Web Analytics and Speed Insights receive data on visits and performance. |
| Meta Platforms Ireland Limited | With your consent to marketing and only when campaigns are running. Details are in the section below. |
| WhatsApp Ireland Limited | If you choose to open WhatsApp, the message passes through its service. The site prepares it, you send it. |
| Treatwell IT S.r.l. | If you use a button that leads to Treatwell, its site opens in a new tab. For its own service Treatwell is an independent controller. For your appointment with us we are the controller and Treatwell acts on our behalf. |
| Advisers and authorities | When needed for legal obligations or to defend a right. |
“Independent controller” means the provider decides alone how to use the data, under its own notice. “On our behalf” means it processes them only for what we ask.
We do not use form details to send you commercial offers. We do not sell your data.
Meta: who does what
This part applies when Meta campaigns are running and you accept marketing. The site then uses the Meta Pixel. For collecting this data on the site and transmitting it to Meta, Oliviér and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR): we answer for this together. We take care of informing you and asking for your consent. After transmission, Meta processes the data as an independent controller, under its own notice. To measure campaign results, Meta acts on our behalf. For your rights on collection and transmission you can write to us or to Meta.
Transfers outside the European Union
Some providers may also process data in the United States: Google, Meta, Vercel for analytics and performance, the hosting provider, the email delivery provider and the provider of the atelier’s mailbox. For these transfers we rely on decision (EU) 2023/1795 of 10 July 2023, in which the European Commission recognised as adequate the protection offered by companies that take part in the Data Privacy Framework. The official list is at dataprivacyframework.gov. If a company is not on the list, the safeguards in the provider’s contracts may apply, such as the standard contractual clauses approved by the Commission (Art. 46 GDPR). Write to us for a copy. The email delivery provider stores data in the United States: for this transfer, the standard contractual clauses included in its contract apply.
Automated decisions
We do not make decisions based solely on automated processing that have legal or similar effects on you. If you accept marketing, Google may use the data to build profiles and choose which ads to show you. The same applies to Meta when campaigns are running.
Your rights
You can ask for access to your data, rectification, erasure, restriction and portability, and you can object to processing based on legitimate interest. You can withdraw consent at any time from “Cookie preferences” at the bottom of the page: withdrawal does not affect what was done before.
Complaint to the supervisory authority
You can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of the EU State where you live or work.
How to exercise your rights
Write to centrobenessereolivier@gmail.com or use the details on the Contact page. We reply within one month of the request, except for the extensions allowed by Art. 12 GDPR.
Updates to this notice
We may update this notice to reflect legal, organizational or service changes. The most recent version is on this page.
Last update: 2 November 2026