Last updated: 1 October 2026
This notice explains how Etnacare S.r.l. processes personal data when users visit and use etnacare.com, purchase products, create an account, contact the company or subscribe to the newsletter. It also covers cookies and similar technologies.
1. Data controller
Etnacare S.r.l.
Via Mario Rapisardi 11/13, 95040 Motta Sant’Anastasia (CT), Italy
VAT and tax number 05441670873
Privacy contact: info@etnacare.com
2. Personal data we process
Depending on the services used, we may process:
- technical and browsing data, including IP address, request date and time, browser, device, operating system, visited pages, online identifiers, technical logs and security data;
- account data, including first and last name, email address, protected credentials and activity within the personal area;
- order, billing and delivery data, including contact details, addresses, purchased products, amounts, delivery preferences and other details required to fulfil an order;
- payment data processed by payment providers. Etnacare does not store full card details;
- communications, support requests and reviews submitted by users;
- newsletter data, such as email address, date of birth and selected interests, for example Beauty & Cosmetics or Supplements & Wellness;
- analytics and advertising data, collected only when consent is required and provided, including browsing events, product and campaign interactions, cookie identifiers and device information.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Displaying the website, cart and account features; security, abuse prevention and technical operation | Performance of the requested service and legitimate interest in website security and continuity |
| Managing orders, payments, deliveries, returns and pre- and post-sale support | Performance of a contract or steps requested before entering into a contract |
| Invoicing, accounting, tax obligations and responses to public authorities | Compliance with legal obligations |
| Handling requests and complaints and protecting Etnacare’s rights | Requested steps and legitimate interest in the establishment, exercise or defence of legal claims |
| Sending newsletters, offers and content tailored to selected interests | Consent, which may be withdrawn at any time |
| Measuring website use, analysing performance and advertising attribution | Consent to non-essential cookies or similar technologies |
4. Providing personal data
Data required to conclude and fulfil an order must be provided in order to purchase through the website. If it is not provided, the requested transaction cannot be completed. Providing data for newsletters, personalisation, analytics and advertising is optional, and refusing these activities does not prevent users from browsing or purchasing.
5. Processing and security
Personal data is processed electronically using organisational and technical measures designed to reduce the risk of loss, unauthorised access, alteration or disclosure. Access is restricted to people who need the data for the purposes described in this notice.
6. Recipients and service providers
Where necessary, data may be disclosed to authorised staff, advisers, delivery companies, technical, accounting and tax providers, public authorities and the following services:
- WordPress and WooCommerce, used for the website, catalogue, accounts and orders;
- the website hosting and infrastructure provider, for hosting, backups, security and website operation;
- Stripe and PayPal, for payment processing and fraud prevention;
- Brevo, for subscriptions, preferences and marketing communications;
- Google, for Analytics, Google Ads, Search Console and campaign measurement, subject to applicable consent choices;
- Meta, for the Pixel and Facebook and Instagram commerce and advertising features, subject to applicable consent choices;
- Wordfence/Defiant, for firewall, unauthorised-access prevention and security;
- CookieYes, used in free native mode to collect and store cookie preferences on the user’s device.
Depending on the service, providers act as processors or independent controllers. Their notices are available here: Google, Meta, Brevo, Stripe, PayPal, Wordfence and CookieYes.
7. International transfers
Some providers may process personal data outside the European Economic Area. Where this occurs, transfers rely on an adequacy decision, the EU-US Data Privacy Framework where applicable, European Commission standard contractual clauses or another safeguard recognised by the GDPR. Users may contact the Controller for information about the applicable safeguards.
8. Retention
- Accounting and order data is retained for the period required by civil and tax law, normally ten years.
- Account data is retained while the account remains active and afterwards for the time required to manage obligations, disputes and data-subject requests.
- Support requests are retained for the time needed to answer and protect the parties’ rights.
- Newsletter data is processed until consent is withdrawn or deletion is requested, except for the minimum data required to record the withdrawal.
- Technical and security logs are retained for limited periods unless they are required to investigate or defend against abuse.
- Cookies are retained for the periods listed below. CookieYes asks users to renew their preference within six months.
9. Cookies and similar technologies
Technical cookies are used without consent because they are required for the website to operate. Non-essential analytics, advertising or personalisation cookies are used only after the user makes a positive choice. Refusing non-essential cookies does not prevent access to the catalogue or purchases.
| Category and main examples | Provider and purpose | Indicative duration |
|---|---|---|
| Necessary cookieyes-consent | CookieYes: stores the user’s preference | 6 months |
| Necessary woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, wc_fragments_* | Etnacare/WooCommerce: cart, session and checkout | Session or approximately 2 days |
| Necessary wordpress_test_cookie, wordpress_logged_in_*, wordpress_sec_*, wp-settings-* | WordPress: login, security and authenticated-user preferences | Session; up to 14 days for remembered login; up to 1 year for preferences |
| Necessary payments __stripe_mid, __stripe_sid and equivalent technical identifiers | Stripe: security, fraud prevention and payment processing | Approximately 30 minutes or up to 1 year depending on the cookie |
| Necessary payments ts, ts_c, x-pp-s, nsid and equivalent identifiers | PayPal: security and payment completion | Session or the period set by PayPal |
| Analytics _ga, _ga_*, _gid, _gat* | Google Analytics: website usage statistics | From 1 minute to 2 years |
| Advertising _gcl_au and equivalent Google Ads identifiers | Google Ads: campaign measurement and attribution | Usually up to 3 months |
| Advertising _fbp, fr and equivalent Meta identifiers | Meta: conversion measurement and advertising personalisation | Usually up to 3 months |
| Marketing sib_cuid and equivalent Brevo identifiers | Brevo: campaign attribution and communication management | Up to 6 months or as configured by the service |
The list may change when providers update their services. The banner preference centre shows the active categories and allows users to change or withdraw consent at any time using the permanent “Review consent” button. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
10. Data-subject rights
Where provided by Articles 15-22 GDPR, data subjects may request access, rectification, erasure, restriction, portability and object to processing. They may also withdraw consent at any time and lodge a complaint with the Italian Data Protection Authority.
Requests may be sent to info@etnacare.com. The Controller may request the information necessary to verify the requester’s identity.
11. Children
Payment services may impose their own age restrictions. Where consent must be given by a child, the requirements of Italian law and the terms of the relevant service apply.
12. Changes to this notice
This notice may be updated to reflect legal, technical or service changes. The latest update date is shown at the beginning of the page.