Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA

(pursuant to Article 13 of EU Regulation 2016/679 -General Data Protection Regulation or GDPR)

Last updated: April 23, 2026

This Privacy Policy describes how the personal data of users who consult the website is managed

www.rougebunnyrouge.com

(hereinafter referred to as the "Site").

We are committed to protecting your privacy and processing your personal data in compliance with the principles of lawfulness, fairness and transparency provided for by Regulation (EU) 2016/679 (hereinafter "GDPR"). If you have any questions or requests regarding the processing of your data, you can contact us using the contact details below.

By using this Site and our services, you agree to the processing of your personal data as described in this policy.

1. Data Controller

The Data Controller of personal data is RBR COSMETICS S.R.L., with registered office at Piazza del Duomo no. 20, 20122, Milan, Italy (hereinafter "Data Controller" or "we"). You can contact the Data Controller at the following addresses:

• Email: privacy@rbrouge.com
• Phone: +39 05411419226

2. Data Protection Principles

We are committed to respecting the following principles, enshrined in art. 5 of the GDPR :

• Lawfulness, fairness and transparency: We process data in a lawful, fair and transparent manner towards you.
• Purpose limitation: We collect data for specific, explicit, and legitimate purposes.
• Data minimization: We only process data that is adequate, relevant and limited to what is necessary for the purposes pursued.
• Accuracy: We take reasonable steps to ensure that the data is accurate and, if necessary, up-to-date.
• Storage limitation: We store data for no longer than the purposes for which it is processed.
• Integrity and confidentiality: We guarantee adequate security of data, protecting it from unauthorized or unlawful processing and from accidental loss or destruction.

3. Rights of the Data Subject

As a data subject, you have the right to exercise the following rights at any time:

• Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, to obtain access to the data and all information provided for in Art. 15 GDPR, including the purposes of the processing, the categories of data,  the recipients and the retention period. The right includes the possibility of obtaining a first copy of your data free of charge.
• Right to rectification (Art. 16 GDPR): You have the right to obtain the rectification of inaccurate personal data concerning you or the completion of incomplete personal data.
• Right to erasure ("right to be forgotten") (Art. 17 GDPR): You can request the deletion of your personal data if it is no longer necessary in relation to the purposes, if you withdraw your consent, if you legitimately object to the processing or if the data has been unlawfully processed.
• Right to restriction of processing (Art. 18 GDPR): You have the right to obtain the restriction of processing if you contest the accuracy of the data, the processing is unlawful, or you have objected to the processing Cit. 24.
• Right to data portability (Art. 20 GDPR): You have the right to receive in a structured, commonly used and machine-readable format, the personal data you have provided to us and based on consent or a contract, and you have the right to transmit those data to another controller.
• Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on our legitimate interest. If your data is processed for direct marketing purposes, you have the right to object to such processing at any time.
• Right not to be subject to automated decision-making (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. The revocation does not affect the lawfulness of the processing based on consent before the revocation.
• Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority. For Italy, the authority is the Italian Data Protection Authority (Piazza Venezia n. 11, 00187 Rome - www.gpdp.it).

• To exercise your rights, you can contact us at the email address privacy@rbrouge.com

We will respond to your request without undue delay and, at the latest, within one month of receipt.

4. Detail of Personal Data Processing

Below we describe the purposes for which we process your data, the legal basis that legitimizes it and the related retention period.

 

5. Data Recipients and Transfer Abroad

Your personal data is not sold or traded. They may be communicated to third parties acting as Data Processors (pursuant to Article 28 of the GDPR) or independent data controllers, for the purposes described above.

In particular, we use:

• Technical and hosting service providers: for the management and maintenance of the web platform.
• Platforms for sending newsletters (e.g. Mailchimp, MailerLite).
• Consultants and professionals (e.g. lawyers) for assistance in case of need.
• Public authorities, where this is required by law.

Some of these entities (e.g., Google, Facebook, Mailchimp) may be based outside the European Economic Area (EEA). The transfer of data to these entities takes place in accordance with Chapter V of the GDPR, on the basis of:

• Adequacy decisions of the European Commission;
• Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by additional measures to ensure an adequate level of protection.

6. Data Security

We take appropriate technical and organizational measures to protect your personal data, such as the use of secure protocols (HTTPS) for communication and monitoring systems to prevent vulnerabilities and attacks.

In the event of a data breach that presents a high risk to your rights and freedoms, we will inform you without undue delay and notify the competent supervisory authority, as provided for in art. 33 and 34 of the GDPR.

7. Data of Minors

We do not knowingly collect personal data from children. Our services are intended for people aged 18 and over. In accordance with art. 8 of the GDPR and art. 2-quinquies of Legislative Decree 196/2003, for the direct offer of information society services, the processing of a minor's data is lawful if he or she is at least 14 years old. For children under 14 years of age, the consent of the person exercising parental responsibility is required. If we become aware that we have collected data from a child under the age of 14 without such consent, we will delete it immediately.

8. Cookie Policy

For detailed information on the use of cookies and other tracking technologies, please see our (https://www.rougebunnyrouge.com/cookies).

9. Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy. The updated version will always be available on this page, with an indication of the date of last modification.