Privacy policy.

Privacy notice under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Decree 101/2018. Last updated: 26 October 2026.

1. Data controller

The data controller is BONS SRL, registered office at Corso Unione Sovietica 612/15/c, 10135 Torino (TO), Italy, VAT and tax code 11994670013. For any request about your data write to info@unlabels.co with "privacy" in the subject line, or by post to the registered office. No data protection officer (DPO) has been appointed, as the processing does not require one under Article 37 GDPR.

2. What data we process and where it comes from

We collect the data you give us directly and the data generated by your use of the site.

• Account. Name, email, password (stored only in encrypted form), company name, VAT number or tax code, billing and shipping addresses, phone number, date and time you accepted the terms.
• Orders and billing. Products ordered, quantities, amounts, payment method and status, delivery address, shipment tracking, invoices.
• Labels. The brand name, text, colours and any logos or images you upload in the Label studio. Where these contain a person's name, we treat it as personal data.
• Contact requests and ambassador applications. Name, salon or brand, email, phone, message, the site region you wrote from and which form you used.
• Ambassador programme. In addition to the application: your ambassador code, the details needed to pay commissions, invoices or receipts, and the list of orders placed by the brands you introduced (amount and date, not their owners' personal data beyond the brand name).
• Technical data. IP address, browser and device type, pages requested, date and time, in the hosting provider's logs and, for the contact forms, in a temporary per-IP counter that limits automated submissions.
• Cookies and local storage. See section 10.

We do not process special categories of data (Article 9 GDPR) and do not ask for them. The site is not directed at anyone under 18.

Data we do not receive from you. If you own a brand introduced by an ambassador, we receive from them the name of your salon or brand and, if they provide it, your name and a contact, for the sole purpose of linking your first order to their commission (Article 14 GDPR). We tell you this when we first get in touch.

3. Why we process data and on what legal basis

• To run your account, produce and ship your orders and provide support. Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR).
• To issue invoices, keep accounting records and meet tax obligations and those of the Cosmetics Regulation (EC) 1223/2009, including batch traceability and handling any product reports. Legal obligation (Article 6(1)(c)).
• To answer requests sent through the contact forms, on WhatsApp, by email or by phone. Pre-contractual steps at your request (Article 6(1)(b)) or, if you are not a customer, our legitimate interest in replying to people who write to us (Article 6(1)(f)).
• To run the ambassador programme: assess applications, attribute and pay commissions. Performance of the contract with the ambassador (Article 6(1)(b)) and tax obligations (Article 6(1)(c)).
• To keep the site secure, prevent abuse, fraud and automated submissions, and keep technical logs. Legitimate interest in the security of the service (Article 6(1)(f)).
• To send you marketing and product news by email. Only with your consent (Article 6(1)(a)), which you can withdraw at any time from the link at the bottom of every email or by writing to us. We may email customers about products similar to those purchased (Article 130(4) of the Italian Privacy Code), with the right to object at any time.
• To establish, exercise or defend legal claims. Legitimate interest (Article 6(1)(f)).

4. Whether you have to provide data

The data requested to create an account, place an order or apply as an ambassador is necessary: without it we cannot enter into the contract. The phone number in the contact forms and consent to marketing are optional, and not providing them has no effect on the service.

5. Who we share data with

Data is processed by our authorised staff and by suppliers acting as processors under Article 28 GDPR, bound by contract to process it only on our behalf:

• Supabase (database, authentication and file storage, including label images).
• Vercel (site hosting, content delivery network and technical logs).
• The email service provider through which we reply to you and, with your consent, send marketing.
• The payment service provider shown at checkout, which processes card data as an independent controller under its own notice: we neither see nor store it.
• The couriers handling delivery (for Italy and Europe, the carrier shown in your tracking), who receive the recipient's name, address and phone number.
• Accountants, advisers and, where needed, lawyers, bound by professional secrecy.

If you write to us on WhatsApp, messages pass through the systems of Meta Platforms, which processes them as an independent controller under its own notice.

We may disclose data to public authorities where the law requires it. We do not sell your data and do not pass it to third parties for their own marketing.

6. Transfers outside the European Union

Some suppliers (Supabase, Vercel, Meta) may process data on servers in the United States or other countries outside the European Economic Area. Such transfers rely on an adequacy decision of the European Commission (for the United States, to organisations certified under the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses (Article 46 GDPR), with any supplementary measures needed. You can ask for a copy of the safeguards applied by writing to info@unlabels.co.

7. How long we keep data

• Account: for as long as the account is active and for 12 months after a deletion request, to settle anything outstanding; then deleted or anonymised.
• Orders, invoices and accounting records: 10 years from the end of the financial year, as required by Article 2220 of the Italian Civil Code and tax law.
• Batch and distribution records for cosmetic products: for the period required by Regulation (EC) 1223/2009.
• Labels and uploaded images: for as long as the account or order they belong to exists, so they can be reordered; sooner on request.
• Contact requests: 24 months from the last exchange.
• Unsuccessful ambassador applications: 12 months. For active ambassadors, programme and commission data follows the accounting term (10 years).
• Technical logs and anti-abuse counters: for the technical time the security of the service requires; the per-IP submission counter resets within minutes.
• Marketing consent: until you withdraw it; we keep proof of consent and withdrawal for 24 months after withdrawal.

8. Your rights

Under Articles 15 to 22 GDPR you have the right to access your data, to have it rectified or erased, to restrict its processing, to receive the data you provided and that we process under a contract or with consent in a portable format, and to object to processing based on legitimate interest, at any time where it is for direct marketing. You can withdraw consent at any time without affecting the lawfulness of processing carried out before.

To exercise these rights write to info@unlabels.co or to the registered office. We reply within one month, extendable by two in complex cases, and may ask you to verify your identity.

If you believe the processing infringes the GDPR you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome; www.garanteprivacy.it) or with the supervisory authority of the country where you live or work, in addition to seeking a judicial remedy.

9. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Article 22 GDPR).

10. Cookies and local storage

The site uses only cookies and technologies strictly necessary for it to work, which do not require consent (Article 122 of the Italian Privacy Code and the Garante's guidelines of 10 June 2021). We use no profiling, analytics or third-party advertising cookies.

• unlabels-region (cookie, 12 months): your commercial region and therefore the price currency, set when you choose it.
• NEXT_LOCALE (cookie, 12 months): the language you chose, set when you switch language.
• sb-…-auth-token (session cookie, only if you sign in): your account session, managed by Supabase.
• Browser local storage (localStorage, until you clear it): the contents of your cart, the shipping country chosen in the cart and your draft label in the Label designer. This data stays on your device and is not sent to us until you order or contact us.

You can delete cookies and local storage from your browser settings; some features, such as the cart, will stop working.

11. Security

Data travels over encrypted connections (TLS), passwords are stored only as hashes, database access is governed by row-level access policies and staff access data only for the purposes described. In the event of a breach likely to result in a high risk to your rights, we will inform you as required by Article 34 GDPR.

12. Changes

This notice may be updated; the version in force is always published at this address with the date of its last update. We will notify registered customers by email of any material change.