Privacy Policy

Our promise to you

At Surya Brasil, care is the heart of everything we make — and that care extends to your personal information, not just what goes on your skin and hair. Just as we believe you deserve to know exactly what's in our formulas, you deserve to know exactly how we handle your data: what we collect, why, and the choices that remain firmly in your hands.

This policy explains all of that in plain language. It applies when you visit our website or use any related applications (together, the "Site"). By using our Site, you're trusting us with your information, and we take that seriously.

This Site is operated for the European market. If you are an EU resident, your data is protected under the General Data Protection Regulation (GDPR, Reg. EU 2016/679).

1. Who is responsible for your data

The data controller responsible for your personal information is:

Natuessence Italy S.r.l. (trading as Surya Brasil Italy) Via Libero Temolo 4, 20126 Milan (MI), Italy VAT no. (P. IVA): 14033060964 Email: info@natuessence.it

If you have any questions about your privacy or wish to exercise your rights, this is where to reach us.

2. What we collect, and why

We only collect what we need to serve you well. Depending on how you interact with us, this may include:

Information you give us — your name, email address, shipping and billing address, phone number, and (where relevant) date of birth or gender. We collect this when you create an account, place an order, contact us, or subscribe to our newsletter.

Payment information — processed securely by our payment provider. We do not store your full card details on our systems.

Information collected automatically — your browser type, IP address, time zone, and cookies installed on your device, gathered as you browse so the Site works properly and improves over time.

3. The legal basis for using your information

Under GDPR, we must have a lawful reason to process your data. We rely on the following:

• To fulfil your order (contract) — processing payments, arranging delivery, and sending order confirmations and shipping updates.
• With your consent — sending you newsletters, promotions, and personalised recommendations. You can withdraw this consent at any time.
• Our legitimate interests — improving the Site, understanding how it's used, and preventing fraud and abuse, always balanced against your rights.
• Legal obligation — keeping records (such as invoices) as required by tax and consumer law.

4. How long we keep it

We keep your information only as long as necessary for the purposes above:

• Order and transaction records: retained as required by Italian and EU tax law (10 years for accounting records).
• Marketing data: until you unsubscribe or withdraw consent.
• Account data: for as long as your account remains active.

5. Who we share it with

We never sell your personal information. We share it only with trusted partners who help us run our business, and only as far as needed to do their job:

• Payment processors, to handle your transactions securely.
• Shipping and fulfilment partners, to deliver your order.
• Technology providers (including our e-commerce platform, Shopify) that host and operate the Site.
• Marketing and analytics providers, to help us communicate and improve.

Each of these is bound to protect your data and use it only for the services they provide to us.

6. International transfers

Some of our service providers may process data outside the European Economic Area (for example, in the United States). Where this happens, we ensure appropriate safeguards are in place — such as the European Commission's Standard Contractual Clauses — so your information continues to enjoy GDPR-level protection wherever it travels.

7. Your rights

Your data belongs to you. Under GDPR, you have the right to:

• Access the personal information we hold about you.
• Correct any information that's inaccurate or incomplete.
• Erase your data ("right to be forgotten"), where applicable.
• Restrict or object to how we process it.
• Portability — receive your data in a usable format to take elsewhere.
• Withdraw consent at any time, without affecting processing done beforehand.

To exercise any of these rights, simply email us at info@natuessence.it, or submit a request through our Privacy Request form. We'll respond within the timeframes set by law.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), if you believe your data has been mishandled.

8. Cookies

Our Site uses cookies to function properly, remember your preferences, and understand how the Site is used. You can manage or disable cookies through your browser settings or our cookie banner. For more detail, see our Cookie & GDPR information.

9. Keeping your data safe

We take reasonable technical and organisational measures to protect your information from unauthorised access, loss, or misuse. That said, no method of transmission over the internet is ever completely secure — so while we work hard to safeguard your data, we can't guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. When we do, we'll post the revised version here. We encourage you to check back periodically.

11. Contact us

Questions about your privacy or this policy? We're always happy to help.

Surya Brasil Italy Operated by Natuessence Italy S.r.l. Via Libero Temolo 4, 20126 Milan (MI), Italy Email: info@natuessence.it Certified email (PEC): natuessenceit@pec.it VAT no. (P. IVA): 14033060964 Tax code / Business Register no. (Codice Fiscale / Registro Imprese di Milano): 14033060964 Economic Administrative Index (REA): MI-2758618