Privacy policy

Privacy Policy — gianpiocappucci.it

This policy explains how we process your personal data under EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

Who sells the products on this website
Products under the Cappucci Hairstyle & Beauty trademark are sold by M.H.P. S.R.L., which uses the trademark under licence from Gianpio Cappucci. The purchase contract is concluded with M.H.P. S.R.L.

1. Joint controllers
Your data is processed jointly, under art. 26 GDPR, by:
– M.H.P. S.R.L., Piazza Giacomo Matteotti 4, 80053 Castellammare di Stabia (NA), Italy, tax code and VAT no. 11009711216, PEC mhp_srl@pec.it;
– Gianpio Cappucci, Via Marina 1, 20121 Milan (MI), Italy, VAT no. 11452790154, email info@gianpiocappucci.it, tel. +39 02 76317894.

The joint controllers have defined their respective responsibilities in an internal agreement. In short: M.H.P. S.R.L. manages orders, shipping, customer service, consultations, invoicing and the website's commercial communications; Gianpio Cappucci uses the data for promotional activities related to the trademark and for the common purposes. You can exercise your rights against either of them; the single point of contact is shop@gianpiocappucci.it.

2. Data we collect
– Contact and order data: first name, last name, email, phone, shipping and billing addresses, purchase history.
– Payment data: processed directly by the payment service providers; we do not see or store your card details.
– Photos and information for the consultation: the images of your hair and the description of the result you want, which you send us voluntarily to receive a consultation.
– Browsing data and cookies.
– Content of the communications you send us (emails, forms, messages on WhatsApp and social networks).
– Reports of undesirable effects of the products, if you send them to us.

For the consultation we do not ask for information about your health: please do not send us any. The only health information we process is that contained in reports of undesirable effects, as described in section 3.

3. Purposes and legal bases

4. Whether providing data is mandatory
The data needed for the order is mandatory: without it we cannot process the purchase. Sending photos for the consultation is optional, but without them we cannot offer you the consultation. Consent to marketing is optional and refusing it has no consequences on your purchase.

5. Retention
– Tax documents: 10 years.
– Order data: for the duration of the relationship and the subsequent limitation periods.
– Consultation photos: used only for the consultation and automatically deleted from our mailbox 30 days after receipt.
– Cosmetovigilance reports: for the periods required by cosmetics legislation.
– Data processed on the basis of consent: until consent is withdrawn and in any case no longer than 24 months after the last interaction.

6. Recipients
Data may be disclosed to parties that process it on behalf of the joint controllers as data processors:
– e-commerce platform, newsletter service and website chat (Shopify International Ltd);
– email provider (Aruba S.p.A.);
– logistics and warehouse service: Feronia Italia S.r.l.s.;
– couriers: GLS Italy S.p.A., BRT S.p.A., Poste Italiane S.p.A., United Parcel Service Italia S.r.l., G3 Worldwide Mail (Italy) S.r.l. (Spring GDS), which for international shipments relies on the postal operators and couriers of the destination country;
– payment providers (Shopify Payments, PayPal);
– advertising and analytics platforms (Google);
– tax and legal advisers.

If you contact us via WhatsApp, Instagram or Facebook, your messages are also processed by Meta Platforms Ireland Ltd, which acts as an independent controller under its own privacy policy.

Data may also be disclosed to the Responsible Person for the cosmetics, Laboratorio Cosmetico Artigianale S.a.s. di Massimo Desiderio, for product safety obligations; to customs authorities, for shipments outside the European Union; and to other public authorities where required by law.

7. Transfers outside the EU
Some providers (e.g. Shopify, Google) may process data outside the EU. The transfer takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission. For shipments to countries outside the EU, the data needed for delivery is disclosed to the couriers, postal operators and customs authorities of the destination country, because the transfer is necessary for the performance of the contract (art. 49(1)(b) GDPR).

8. Your rights
You can exercise the rights provided for by articles 15–22 GDPR at any time: access, rectification, erasure, restriction, objection and portability. You can withdraw your consent without affecting processing already carried out, and object to commercial communications using the link in every email. To exercise your rights, write to shop@gianpiocappucci.it, or to either of the joint controllers. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

9. Automated decision-making
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly affect you. The courier is chosen automatically based on weight, destination and the service requested; this choice does not affect your rights. Consultations are carried out personally.

10. Minors
The website is not intended for children under 14. We do not knowingly collect data from minors.

11. Cookies
We use technical cookies and, only with your consent, analytics and marketing cookies. Details are in the Cookie Policy.

12. Updates
This policy may be updated; the version in force is the one published on the website.

Last updated: 14/10/2026