Privacy Policy

This privacy policy describes how Esteteam Srl (hereinafter the “Company,” “Data Controller,” or “Nimium®”) collects, uses, stores, and protects the personal data of users (hereinafter “Users” or “Data Subjects”) who visit and interact with the official website nimium.it (and related corporate domains).

1. DATA CONTROLLER

The Data Controller is Esteteam Srl, with registered office at Via Varesina 174, 20156, Milan (MI), Italy.

VAT Number: 12632430158
Contact email: info@esteteam.com / info@nimiumwellness.com
Certified Email (PEC): pec@pec.esteteam.com

2. TYPES OF DATA COLLECTED

Depending on the manner of interaction and the services requested on the website, the Company collects the following categories of personal data:

Browsing Data: The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, type of browser used, operating system, domain name, and addresses of websites from which access or exit occurred, time of the request, pages visited).
Data Voluntarily Provided via Contact Forms and B2B Forms: First name, last name, work email address, phone number, name of the company/SPA/organization, job title, and message notes.
Data for Requests for Catalogs, Technical Data Sheets, and Quotes: Identification, company, and contact information for sending informational materials or commercial quotes related to the Nimium® and Aquaceuticals Milano product lines.
Data for Newsletter Subscription: Email address and contact preferences for sending industry updates, product previews, and news regarding the brand’s presence at international trade shows and events.
Cookies and Tracking Technologies: For detailed information on the types of cookies used, their purposes, and how to manage your preferences, please consult our Cookie Policy.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

The personal data provided by users will be processed exclusively for the following purposes:

Handling contact requests, quotes, and catalog distribution: The processing of identification, company, and contact data is carried out for the performance of pre-contractual or contractual measures taken at the request of the data subject (Art. 6.1.b GDPR).
Website operation and security: The processing of browsing data and system logs is based on the Data Controller’s legitimate interest in ensuring the security and proper functioning of the platform (Art. 6.1.f GDPR).
Sending newsletters, promotional communications, and event invitations: The processing of the name and email address is carried out exclusively upon the data subject’s explicit consent (Art. 6.1.a GDPR).
Compliance with legal and tax obligations: The processing of tax and contractual data is carried out to comply with obligations established by law, regulation, or EU legislation (Art. 6.1.c GDPR).

4. METHODS AND RETENTION PERIODS FOR DATA

Personal data is processed using IT, telecommunications, and paper-based tools, ensuring the implementation of appropriate technical and organizational security measures in accordance with Art. 32 of the GDPR to prevent data loss, unlawful or improper use, and unauthorized access.

The data collected will be retained according to the following timeframes:

Contact information for quotes and inquiries: Retained for the time strictly necessary to manage and fulfill the request and for subsequent commercial follow-up activities (maximum 24 months from collection).
Contractual and administrative-accounting data: Retained for 10 years in accordance with the provisions of the Civil Code and applicable tax laws.
Data for sending the newsletter: Retained until the user revokes consent (by unsubscribing via the link provided at the bottom of each email).

5. DISCLOSURE AND SCOPE OF DATA SHARING

The User’s personal data will never be disclosed or sold to third parties. To fulfill the purposes described above, the data may be made accessible or disclosed to:

Authorized employees and collaborators of Esteteam Srl, who have received appropriate training on confidentiality and data protection.
Technical service providers, web hosting providers, website development and maintenance agencies, and corporate email and CRM management platforms, specifically designated as Data Processors pursuant to Article 28 of the GDPR.
The Data Controller’s accounting, tax, and legal advisors.
Judicial or supervisory authorities where required by mandatory legal provisions.

6. TRANSFER OF DATA OUTSIDE THE EU

Personal data is processed and stored on servers located within the European Union. If, for technical or operational reasons, it becomes necessary to use cloud services provided by vendors based in countries outside the European Economic Area (EEA), the transfer will take place exclusively in compliance with the appropriate safeguards provided for in Chapter V of the GDPR (e.g., to countries subject to adequacy decisions by the European Commission or through the signing of Standard Contractual Clauses).

7. RIGHTS OF THE DATA SUBJECT

As a data subject, pursuant to Articles 15–22 of Regulation (EU) 2016/679, the User has the right to exercise the following rights at any time:

Right of Access (Art. 15): To obtain confirmation as to whether or not personal data is being processed and to receive a copy thereof.
Right to Rectification (Art. 16): To request the updating or correction of inaccurate data or the completion of incomplete data.
Right to Erasure / Right to be Forgotten (Art. 17): To request the erasure of your data in the cases provided for by law.
Right to Restriction of Processing (Art. 18): To request the restriction of processing under specific circumstances.

Right to Data Portability (Art. 20): To receive the data provided to the Data Controller in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21): To object at any time to the processing of personal data based on legitimate interests or carried out for direct marketing purposes.
Right to Withdraw Consent (Art. 7.3): Withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent given prior to withdrawal.

To exercise any of the rights listed, the User may send a written request via email to the Data Controller at: info@esteteam.com.

The Data Subject also has the right to file a complaint with the competent Data Protection Authority (in Italy: Garante per la protezione dei dati personali, www.garanteprivacy.it).

8. CHANGES AND UPDATES TO THIS PRIVACY POLICY

The Data Controller reserves the right to modify, update, or supplement this Privacy Policy at any time, including as a result of any changes to applicable law. Changes will be posted on this page with the date of the last update. Users are encouraged to review this section periodically to stay informed about how personal data is handled.