Stores
THE KIKO SALE - Reduceride până la 40%
Free Shipping over $50 | Shop Now
Help
KIKO ROMANIA
0

Privacy policy

Privacy Policy - KIKO Milano
www.kikocosmetics.ro (the "Website")

Data controller
SLF ROMBEAUTY S.R.L., with registered office at Str. Tipografilor no. 29, Sector 1, Bucharest, Romania, Trade Register No.: J2021012903408, CUI: 44649361 (hereinafter the Company or KIKO).

Data Protection Officer (DPO)
Email address: CustomerService@kikocosmetics.ro

Personal data processed
"Personal data" or "Data" means any information relating to an identified or identifiable natural person (the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

When you browse the Website, when you make a purchase and pay for products and/or services offered by the Company through the Website, when you register and create a KIKO account, when you subscribe to receive commercial messages ("newsletters"), when you contact us to request information or for any other purpose, our Company will process certain Data which may include: first name, last name, date of birth, email address, delivery address (in the case of purchases with home delivery), phone number, bank account number, purchasing preferences and habits, username, password, etc.

The term "Data" also includes browsing information on the Website. This category includes, without limitation, the source IP address, the URL of pages visited, the type and version of the "browser" used (e.g. Chrome, Firefox, Safari), the type of device used, the date and time of access, as well as other information collected through the technologies mentioned in the Cookie Policy. This information is collected automatically by the IT systems and software applications used to operate the website and is not normally processed for the direct identification of users. However, by its nature and through association and cross-referencing with other data held by third parties, it could allow user identification.

Purpose of the processing

A) Browsing the website:
Source IP addresses and the other types of browsing data mentioned above are used to ensure a smooth connection and browsing experience, to provide users with full and functional access to all website features, and to assess the security and stability of the system. Regarding the use of cookies and similar technology (non-essential technical cookies), please refer to the cookie policy available in the website footer.

B) Performance of the contract and order administration:
We process your personal data for the purpose of concluding and performing the distance sales contract entered into through our website. In this context, the data may be used to receive, validate, process, and manage orders placed, confirm them, process payments, prepare and deliver ordered products, communicate with you regarding your order, issue documents related to the transaction, and manage requests concerning the modification, cancellation, return, or replacement of products.

Your data may also be processed to manage the contractual relationship with you, including providing assistance and support regarding ordered products, resolving complaints and reports, managing commercial and legal warranties, processing refunds related to returns or order cancellations, and any other activities necessary to exercise the rights and obligations arising from the contract concluded between you and the Company.

Depending on the circumstances, the categories of data processed for this purpose may include identification and contact details, information about orders and purchased products, delivery and billing data, payment-related information, order history, correspondence with the Company, and any other information necessary for the performance and administration of the contract.

Processing this personal data is necessary for the performance of the contract arising from placing orders. Any refusal to provide this data will therefore prevent the purchase of products and/or the use of the Company's services.

C) Fulfilment of legal obligations:
Your data will be processed for the purpose of fulfilling the legal obligations incumbent upon us as a merchant and data controller, including obligations under tax, accounting, financial, and consumer protection legislation, as well as any other applicable regulations governing our activity.

In this context, your data may be used to issue and retain tax and accounting documents, fulfil reporting obligations to the competent authorities, manage inspections and audits carried out by authorities, resolve requests made by public institutions as permitted by law, and fulfil any other legal obligations relevant to the Company's activity.

The categories of data processed for this purpose may include identification and contact details, information about orders and transactions carried out, billing and payment data, and any other information whose processing is required or permitted by applicable law.

When you select PayPal, Netopia, or another online payment provider available at the time of placing your order, you will be redirected to that provider's payment platform. The personal data and information required to process the payment, provided on that platform, are collected and processed directly by that provider, acting as an independent data controller. In this context, our company does not determine the purposes and means of processing this data and does not have access to the complete details of the payment instrument used. We receive from the payment provider only the information necessary to confirm payment and fulfil the order (for example, the payer's name, the email address associated with their account, the transaction identifier, the amount paid, and the payment status). For details on how the payment processor handles user data, we recommend reading their privacy policy here: https://www.paypal.com/us/privacy-center/home or https://netopia-payments.com/politica-de-confidentialitate/

If you choose Klarna as your payment method, certain personal data necessary for payment processing and fraud prevention (such as name, contact details, order details, and order value) will be transmitted to Klarna. Klarna will process this data as an independent data controller, in accordance with its own privacy policy and its legal obligations as a payment services provider, which can be found here [...]

D) Legal proceedings:
Initiating court proceedings, exercising and/or defending the Company's rights in legal proceedings, in the event of any disputes.

E) Subsequent commercial communications
Sending limited communications to existing customers, for the purpose of directly promoting and/or selling products or services similar to those already purchased/used by the customer, using the email addresses provided when purchasing a product or service, with the option to object at any time by following the instructions in the communication and using the contact details indicated below, in order to exercise the rights set out in Article 15 et seq. of the General Data Protection Regulation (GDPR).

F) Profiling:
By consenting to the processing of data for profiling purposes, you agree that the Company may analyze and use information about your interactions with our website and applications, your order and purchase history, products viewed or added to cart, stated preferences, responses to our marketing campaigns, and other information about your use of our services, in order to assess your commercial interests and preferences.

Based on this information, we will create marketing profiles that allow us to personalize the content displayed, the products and services recommended, and the commercial offers and promotional campaigns communicated to you. Profiling does not produce legal effects on you and does not lead to decisions based solely on automated processing that would significantly affect you.

Based on this consent, we may send you personalized commercial communications through automated contact means (email, SMS, and push notifications), tailored to interests and preferences estimated from your marketing profile, or advertising materials, newsletters, promotional and commercial communications regarding the Company's products and/or events, as well as any market research and statistical analysis carried out.

Also, based on your consent, you may agree that your encrypted (hashed/pseudonymized) email address may be shared with certain third-party social media and paid media platforms (e.g. Google, Meta, Amazon, Snapchat, and/or other digital advertising partners used by the Company), for the purpose of identifying matches with existing accounts on those platforms and displaying personalized ads regarding our products and services.

These platforms may combine information received from us with information they already hold about you, in accordance with their own privacy policies and terms of use. For more information on how each platform processes personal data, please refer to their privacy policies.

Data used for profiling purposes may include, as applicable: identification and contact details, information about orders and purchases made, history of interactions with our website and applications, preferences and interests inferred from browsing behavior, and information regarding responses to our communications and marketing campaigns.

You may withdraw your consent to profiling and personalized marketing at any time, without affecting the lawfulness of processing carried out before withdrawal. Consent may be withdrawn via [PREFERENCE CENTER LINK], by using the unsubscribe option available in each electronic communication, or by contacting us using the contact details mentioned in this policy.

Where we use providers or platforms located outside the European Economic Area, international data transfers will be carried out only in compliance with the safeguards set out in Regulation (EU) 2016/679, including, as applicable, an adequacy decision or the standard contractual clauses approved by the European Commission.

G) Direct marketing purposes:
Sending, by automated means of contact (email, SMS, and push notifications), advertising materials, newsletters, promotional and commercial communications regarding the Company's products and/or events, and conducting market research and statistical analysis. You may give your consent for direct marketing by providing your email address, checking the checkbox, or clicking "subscribe" in the "Newsletter" form on the website.

H) Collection and publication of individual user reviews:
Following a purchase, the Company may process the name, email address, information about the purchased product, purchase date, and order number, for the purpose of sending an invitation to review the product or purchasing experience and to publish the review submitted by you.

If you decide to submit a review, we may process its content, as well as any photos, videos, or other information you choose to voluntarily provide to us. Reviews may be published on our website and/or other channels used by the Company, together with your name, surname, initials, or chosen pseudonym, as applicable.

To verify and ensure the security and integrity of reviews and prevent fraud, we may process data such as IP address, browser, and device information.

We may request reviews solely through star ratings for a given product, in which case we will only process online identifiers (e.g. IP address, browser type, other online identifiers).

I) Creation and management of the user account
Although you can place orders through the website without creating a user account, you have the option to create an account to benefit from additional features, such as adding a product to your wishlist, accessing order and invoice history, managing delivery and billing addresses, managing commercial communication preferences, submitting and tracking return requests, and managing or deactivating your account.

For the purpose of creating and managing the user account, we will process the data necessary to identify and authenticate you on the platform. During registration, you will be asked to provide your email address, which will be verified via a one-time password (OTP) sent to the email address provided. After validating your email address, you will be able to complete the registration form and create the login credentials associated with your account, namely your username and password. The OTP will also be used by us when you change your password, access your account, or in other situations where we consider it useful to verify your identity.

Additionally, depending on the information you choose to provide and save in your account, we may process data such as your first and last name, email address, delivery and billing addresses, order and return history, commercial communication preferences, and any other information you choose to enter into your account.

Data processed for this purpose is used to create, manage, and secure the user account, authenticate and verify the user's identity, facilitate access to account features, manage account-related preferences and settings, and prevent unauthorized use of the account.

J) Receiving and managing messages
If you contact us through the contact form available on the website, by email, by phone, or through any other communication channel we provide, we will process the personal data you provide (such as your name, surname, email address, phone number, and the content of your request) for the purpose of managing, analyzing, and resolving the inquiries, questions, complaints, or requests for information submitted.

Please do not include special categories of personal data (for example, information about health status) in messages sent through the contact form or by phone, except where strictly necessary to resolve your request.

Phone calls with Customer Service may be recorded for the purpose of managing and resolving Customer requests, ensuring service quality, and staff training.

Please also use only your own current personal data. In such cases, our Company will not be responsible for the use of other persons' personal data that you provide to us, nor for any type of harm that person may suffer as a result of our use of their data for the purposes you provided to us.

Legal basis for the processing

A) Browsing the website:
The legitimate interests of the data controller or of third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring protection of personal data are not affected, taking into account the reasonable expectations of the data subject and the activities strictly necessary for the operation of and browsing on the website. Article 6(1)(f) GDPR. For non-essential technical cookies and similar technology, processing is based on your consent to the processing of personal data, in accordance with Article 6(1)(a) GDPR. Please refer to the cookie policy available in the website footer.

B) Contractual purposes:
The legal basis for this processing is the performance of the contract to which you are a party, or taking steps at your request prior to entering into the contract, in accordance with Article 6(1)(b) of Regulation (EU) 2016/679.

C) Fulfilment of legal obligations:
Compliance with a legal obligation. Article 6(1)(c) GDPR.

D) Legal proceedings:
The legitimate interests of the data controller or of third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring protection of personal data are not affected. Article 6(1)(f) GDPR.

E) Subsequent commercial communications:
The legitimate interests of the data controller or of third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring protection of personal data are not affected. (Recitals 47-50 GDPR, Article 6(1)(f) GDPR).

F) Profiling:
Consent (optional and revocable at any time), given by persons aged 18 and over. Article 6(1)(a) GDPR.

G) Direct marketing purposes:
Consent (optional and revocable at any time), given by persons aged 18 and over. Article 6(1)(a) GDPR.

H) Collection and publication of individual user reviews:
The legitimate interests of the data controller, provided that the interests or fundamental rights and freedoms of the data subject requiring protection of personal data are not affected. Article 6(1)(f) GDPR.

I) Creation and management of the user account
Performance of the contract to which you are a party, or taking steps at your request prior to entering into the contract, in accordance with Article 6(1)(b) of Regulation (EU) 2016/679.

J) Receiving and managing messages
The legal basis for the processing is our legitimate interest in responding to requests received and providing the necessary support to customers and users of the website.

Data retention period and nature of data provision

A) Browsing the website:
Browsing data is stored for a period of 6 months, after which it is automatically deleted for security reasons (e.g. fraud prevention). Please also refer to the cookie policy available in the website footer for other cookie storage periods.

B) Contractual purposes + C) Fulfilment of legal obligations:
For the entire duration of the contract and, after its expiration, for the usual period of 6 or 10 years, in accordance with the statute of limitations applicable in financial and accounting matters. You may request the deletion of your account at any time, in accordance with the procedure described in Section 8 of this policy. Deletion of your account will not result in the deletion of tax documents related to your orders, such as invoices and payments, for which there is a legal obligation of retention.

D) Legal proceedings:
In the event of a dispute or litigation, for its duration and, in any case, until the expiration of all deadlines for filing appeals.

E) Subsequent commercial communications:
Maximum 36 months from your last purchase or until you object to the processing of your data, whichever occurs first. You may object at any time using the direct link in each communication or from your account settings.

F) Profiling:
Your purchases will be examined to analyze related preferences, habits, and behaviors, and to send you personalized communications - including, if you have opted in, through interactions on social media and paid media platforms - based on information from the last 36 months.

G) Direct marketing purposes:
Maximum 36 months from the data subject's last qualifying interaction with the Company and, in any case, until consent is withdrawn. A "qualifying interaction" refers exclusively to the purchase of a KIKO product or service by the data subject.

H) Collection and publication of individual user reviews:
36 months from the collection and publication of your review. You may object to the processing of your data at any time using the direct link in each communication or by sending an email to CustomerService@kikocosmetics.ro.

Upon expiration of the retention periods mentioned above, personal data will be destroyed, deleted, or anonymized in accordance with the Company's technical deletion and backup procedures.

I) Creation and management of the user account
Until the account is closed. Account data backups may be retained to safeguard the Controller's legitimate rights and interests for a period of [...] from account closure.

J) Receiving and managing messages
Until the purpose for which you contacted us has been fulfilled, and subsequently for the maximum limitation period of 3 years for the defense of our rights and interests in the event of any disputes.

Provision of personal data

Providing data for purposes A), D), E), and H) is requested by the controller on the basis of its legitimate interest; however, you may always object to the processing, as set out in this policy. In particular, for purpose E) regarding subsequent commercial communications, you may object to receiving such communications at any time, through the means indicated in each communication.

Providing data for purposes B) and C) is mandatory. Any refusal to provide data will therefore prevent the purchase of products and/or the use of the Company's services.

Providing data for purposes E), F), and G) is optional. Refusal to provide data will not affect your ability to browse the website or purchase the Company's products and/or services. You will not receive automated communications, newsletters about the Company's events and promotions, or personalized communications, including through interactions on social media and paid media platforms, based on your purchasing habits, preferences, and related behaviors.

Creating an account is not mandatory in order to purchase products through the Website; however, without one, you will not have easy access to your order history, will not be able to modify your login details, and generally will not be able to enjoy the benefits of having an account. Alternatively, by contacting the Controller using the contact details mentioned in this Policy, you may request information about any previous orders or any other information about your interaction with us through the Website.

Categories of recipients of personal data

Data may be processed by external parties acting as independent data controllers in accordance with Articles 4 and 24 of the GDPR, including but not limited to supervisory/regulatory authorities and bodies, public or private parties authorized to request data, consulting firms and/or professional practices and/or professionals, such as legal, tax, and insurance consultants, social media channels or paid social media and media platforms, shipping and courier companies, postal service providers, and the online payment services provider.

Data may also be processed on the Company's behalf by external parties designated as processors in accordance with Article 28 of the GDPR, to whom appropriate operational instructions are provided for the correct processing of your personal data. These parties fall mainly into the following categories, by way of example: companies providing email services, companies providing website maintenance and development services, social media channels, companies supporting market research studies, companies providing after-sales customer assistance and support, companies providing marketing message delivery services, and Company-affiliated companies that provide intra-group services and manage purchases made in each Company affiliate's stores.

Your data will be processed by Company employees designated to pursue the purposes mentioned above, who are expressly authorized to process the data and have received appropriate operational instructions in accordance with Article 29 of the GDPR.

Transfer of personal data to countries outside the European Union

Since the Company's activities are carried out globally, personal data may be transferred to countries inside or outside the European Union, namely to companies (including affiliates of SLF ROMBEAUTY S.R.L.) and social networks such as Instagram, Facebook, Twitter, YouTube, and TikTok. Depending on the circumstances, these social media channels may act as independent data controllers or as processors for carrying out the processing activities described in this policy regarding your use of our products and/or services.

In any case, the transfer of personal data to countries outside the European Union (including the USA) will take place in accordance with Article 44 et seq. of the GDPR, implementing safeguards to ensure an adequate level of data protection during the transfer, including: adequacy decisions adopted by the European Commission regarding third countries that guarantee an adequate level of protection; data transfer agreements including the European Commission's Standard Contractual Clauses; additional measures required by applicable regulations and/or orders of competent authorities.

For more information about the purposes and methods of data processing by social networks, please refer to their privacy policies:

Regarding the processing of profiling-related data when carried out through customer audiences and social advertising, please refer to the privacy policies of the following third parties:

The Company and Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland ("Meta Ireland"), act as joint data controllers under a specific data-sharing agreement. The Company and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, act as joint data controllers under a specific data-sharing agreement.

At registration, your email address and password will also be verified by an "identity provider" service offered by Google. Regarding the transfer and processing of the IP address and email address by Google, please refer to the relevant privacy policy:

Your rights as a data subject - complaint to a supervisory authority

To exercise their rights, the User/Customer may contact the Company at the email address CustomerService@kikocosmetics.ro. The data subject's rights are as follows:

(i) the right to access their personal data (Article 15 GDPR). The right of access entails the right to obtain confirmation from the Company that it is processing personal data belonging to the data subject, as well as information regarding: the purpose of the processing, the categories of data processed, their recipients, the data storage period, the existence of the right to request rectification or deletion of data from the Company, restriction of processing or the right to object, the right to lodge a complaint with a supervisory authority, whether there is automated decision-making, i.e. whether decisions are made solely as a result of automated processing of personal data, whether the data is transferred to third countries, and what safeguards the Company has implemented to ensure the security of the transferred data.

(ii) the right to request rectification of data when it is incorrect, needs updating, or is incomplete (Article 16 GDPR),

(iii) the right to request its deletion when the personal data is no longer necessary to fulfil the purposes, when the data subject withdraws their consent, when the data subject objects to processing and there are no legitimate grounds that override the objection (Article 17 GDPR)

(iv) the right to request restriction of data processing until the data is rectified, or, to the extent the data subject objects to processing, until this request is resolved (Article 18 GDPR)

(v) the right to data portability (Article 20 GDPR), meaning that, with respect to processing purposes based on contract or consent, carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and the right to transmit this data to another controller without any restriction from the Company, if technically feasible (right to data portability - Article 20 GDPR).

(vi) the right to object at any time to the processing of your data (Article 21 GDPR), for reasons related to your particular situation, when the processing is based on the Company's legitimate interest, including the creation of profiles based on those provisions.

(vii) the right to withdraw your consent for marketing and/or profiling purposes at any time, by logging into your account on the website (and accessing "Privacy Settings") or by sending an email to CustomerService@kikocosmetics.ro. Withdrawal of consent does not affect in any way the lawfulness of processing based on consent given before its withdrawal.

(viii) the right to lodge a complaint with the competent supervisory authority in the member state where you live, work, or have your habitual residence, or where the alleged infringement occurred: in Romania: www.dataprotection.ro.

Update of the privacy policy

The data controller reserves the right to modify/update this policy at any time. For this purpose, the date of the most recent update is indicated below.

Last updated: 24 April 2026

Easy returns in 30 days

Free shipping from 200 lei

makeup session online booking

Gifts & offers

Secure payments