Privacy policy

Privacy Policy

Last updated: 26 October 2026

This Privacy Policy explains how CRW GLOBAL DI CARMINE ESPOSITO & C. S.A.S., operating under the CrownHair brand, collects, uses, stores and protects personal data relating to users who visit CrownHair websites, make purchases, request consultations or support, or otherwise interact with our services.

This Privacy Policy applies to CrownHair websites and e-commerce services.

Any standalone applications or digital services, including Phelo when made available, may be governed by a dedicated privacy notice specifically applicable to that service.

1. Data Controller

The Data Controller is:

CRW GLOBAL DI CARMINE ESPOSITO & C. S.A.S.

Registered Office:
Via Masi 129
San Bartolomeo in Bosco
44124 Ferrara (FE), Italy

VAT No.: IT02214570380
Tax Code: 02214570380
SDI Recipient Code: 5RUO82D
Certified Email (PEC): CRW.GLOBAL@arubapec.it
Email: info@crownhair.it

Customer & Salon Support: +39 320 293 7751
Consultations: +39 320 160 8596

2. Personal Data We Process

Depending on how you interact with CrownHair, we may process the following categories of personal data.

Identification and Contact Data

First and last name, billing and shipping address, email address, telephone number and other information required to manage the customer relationship.

Order Data

Products purchased, selected configurations and customisations, measurements, colour, density, product specifications, order history, returns, refunds and delivery information.

Payment Data

Information required to process and verify payments.

Where payments are processed through third-party payment service providers, full card or payment instrument details are processed directly by the relevant provider in accordance with its own terms and security measures. CrownHair does not necessarily receive or store the complete details of the payment instrument.

Account Data

Login credentials, identification details, history and other information associated with a customer account, where applicable.

Communications and Customer Support

Messages sent through email, WhatsApp, contact forms, chat or other support channels, including information required to respond to enquiries, consultations, returns, disputes and order-related issues.

Photographs and Materials Provided by Customers

Where necessary for a consultation, to identify product requirements or to provide services and customisations requested by the customer, we may receive photographs, images, measurements, visual references and other information voluntarily provided by the user.

Such materials are used solely for purposes connected with the customer's request and any related support requirements.

Possible Health-Related Data

CrownHair does not generally require health information in order to complete a purchase.

However, during consultations or support requests, users may voluntarily disclose information relating to their scalp, medical conditions or other information that may qualify as special-category personal data under the GDPR.

Such data will only be processed where necessary and to the extent permitted by applicable law, subject to the safeguards required by Article 9 GDPR and, where required, on the basis of the data subject's explicit consent.

Users are encouraged not to disclose health information that is not necessary for their request.

Technical and Browsing Data

We may collect IP address, device and browser type, operating system, technical identifiers, logs, pages visited, interactions with the website and other technical information required for website operation, security and, where consent is required, analysis of website use.

Marketing and Preference Data

Where the user provides consent, we may process email addresses, telephone numbers, preferences and information relating to interactions with CrownHair for promotional and marketing communications.

3. Sources of Personal Data

Personal data may be collected:

  • directly from the user when placing an order, registering, requesting a consultation or contacting support;

  • automatically when using the website through technical tools, logs, cookies or similar technologies;

  • through service providers involved in fulfilling an order or providing a service, where necessary;

  • from individuals who lawfully place an order or submit a request on behalf of another person.

4. Purposes and Legal Bases for Processing

Personal data are processed for the following purposes.

Orders and Contractual Relationship

To process orders, customisations, payments, deliveries, returns, refunds and purchase-related requests.

Legal basis: performance of a contract or steps taken at the data subject's request prior to entering into a contract.

Consultations and Customer Support

To respond to enquiries, provide consultations, verify orders and products, manage requests and provide after-sales support.

Legal basis: performance of a contract, pre-contractual steps and, where applicable, the Controller's legitimate interest in providing support and properly managing the customer relationship.

Administrative, Tax and Legal Obligations

To comply with tax, accounting, administrative, consumer-protection and other applicable legal obligations.

Legal basis: compliance with a legal obligation.

Security, Fraud Prevention and Protection of Rights

To prevent fraudulent use, abuse and unauthorised access, protect systems and accounts, and establish, exercise or defend legal claims.

Legal basis: legitimate interests of the Controller and, where applicable, compliance with legal obligations.

Marketing

To send newsletters, offers, promotions and commercial communications where requested or authorised by the user.

Legal basis: consent, where required by applicable law.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Analytics, Personalisation and Tracking Technologies

To analyse website use, measure campaign performance or personalise content and communications through cookies and technologies that are not strictly necessary.

Legal basis: consent, where required.

5. Requirement to Provide Personal Data

Providing data required to place an order, process a payment, arrange delivery or comply with legal obligations is necessary in order for CrownHair to provide the relevant service.

Failure to provide such data may prevent CrownHair from entering into or performing the contract.

Providing data for marketing purposes or non-essential tracking technologies is optional, and refusing such processing does not prevent users from making purchases.

6. Recipients and Service Providers

Personal data may be disclosed, to the extent necessary for the relevant purposes, to the following categories of recipients:

  • e-commerce platform providers, including Shopify;

  • hosting, IT infrastructure and security providers;

  • payment service providers;

  • couriers, shipping companies and logistics providers;

  • email, communications and customer support providers;

  • technical service providers and applications integrated with the website;

  • analytics, advertising and marketing providers, only where permitted and subject to consent where required;

  • accountants, consultants, lawyers and other appointed professionals;

  • public authorities, government bodies or other entities where disclosure is required by law.

Depending on the circumstances, these parties may act as processors, independent controllers or under other roles recognised by applicable data-protection law.

CrownHair does not sell its customers' personal data.

7. Shopify and the E-Commerce Platform

The CrownHair store uses Shopify as its e-commerce technology platform.

Shopify and entities involved in providing its services may process personal data required for the operation of the store, orders, security, payments and platform features, in accordance with their respective privacy roles and applicable terms.

8. Transfers Outside the European Economic Area

Some technology providers used by CrownHair may process or store personal data in countries outside the European Economic Area.

Where an international transfer is subject to the GDPR, it is carried out using mechanisms recognised under applicable data-protection law, including European Commission adequacy decisions, Standard Contractual Clauses or other safeguards permitted by the GDPR.

Further information about applicable safeguards may be requested using the contact details provided in this Privacy Policy.

9. Data Retention

Personal data are retained for as long as necessary for the purposes for which they were collected and in accordance with applicable legal requirements.

In particular:

  • order, invoice, administrative and accounting data: generally for 10 years, unless a longer period is required by law or necessary in connection with a dispute;

  • customer account data: for the lifetime of the account, without prejudice to data that must be retained to comply with legal obligations;

  • support requests, consultations and communications: for the time required to handle the request and subsequently for a reasonable period necessary to protect the parties and manage potential disputes;

  • photographs and materials relating to customisations or consultations: for the period necessary for the purpose for which they were provided and any related services or requests, unless further documented retention is necessary;

  • data used for marketing: until consent is withdrawn or until the processing is no longer necessary for the purpose for which consent was collected;

  • cookies and online identifiers: for the periods indicated in the relevant settings and notices.

At the end of the applicable retention periods, personal data are deleted, anonymised or otherwise rendered unavailable for further use, unless continued retention is required by law.

10. Cookies and Tracking Technologies

The website uses cookies and similar technologies that are necessary for its operation.

Any analytics, profiling, personalisation or marketing cookies or technologies that are not strictly necessary are used in accordance with the choices made by the user through the website's consent-management tools.

Users may change or withdraw their cookie preferences through the tools made available on the website.

Further information is provided in the relevant Cookie Policy and website consent settings.

11. Data Security

CrownHair implements technical and organisational measures appropriate to the level of risk to protect personal data against loss, unauthorised access, alteration, disclosure or destruction.

However, no information system can guarantee absolute security.

Service providers processing personal data are also selected and managed taking into account applicable security measures and obligations.

12. Automated Decision-Making and Profiling

As part of its ordinary e-commerce activities, CrownHair does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them.

Any analytics or personalisation activities based on cookies or tracking technologies are subject to the user's consent choices where required by applicable law.

13. Your Rights

Where provided by applicable law, data subjects may exercise the rights granted under Articles 15-22 GDPR, including:

  • the right to access personal data;

  • the right to rectify inaccurate data;

  • the right to erasure;

  • the right to restriction of processing;

  • the right to data portability;

  • the right to object to processing;

  • the right to object at any time to direct marketing;

  • the right to withdraw previously given consent;

  • applicable rights relating to automated decision-making.

The exercise of these rights is free of charge within the limits provided by law.

Requests may be sent to:

Email: info@crownhair.it
Certified Email (PEC): CRW.GLOBAL@arubapec.it

CrownHair may request information reasonably necessary to verify the identity of the person making the request.

14. Right to Lodge a Complaint

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or, where applicable, with the competent supervisory authority in the European Union Member State in which they reside, work or believe that an infringement has occurred.

This is without prejudice to any other remedies available under applicable law.

15. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes in applicable law, organisational or technical developments, or changes to the services offered.

The updated version will be published on this page together with the relevant update date.

Material changes will be communicated to data subjects where required by applicable law.

16. Contact Information

For information about this Privacy Policy or the processing of personal data:

CRW GLOBAL DI CARMINE ESPOSITO & C. S.A.S.

Via Masi 129
San Bartolomeo in Bosco
44124 Ferrara (FE), Italy

VAT No.: IT02214570380
Tax Code: 02214570380

Email: info@crownhair.it
Certified Email (PEC): CRW.GLOBAL@arubapec.it
Customer & Salon Support: +39 320 293 7751