This notice, which replaces version 1.0 dated 15 October 2026, explains how DREAMLAND SOCIETA' A RESPONSABILITA' LIMITATA, trading under the EL SPA brand, processes the personal data of users who visit the website, use the e-commerce service, interact with the AI Assistant, submit enquiries, purchase products or services, purchase or receive gift vouchers, request shipment of beauty products, submit reviews or provide optional consents.
1. Data Controller
Controller: DREAMLAND SOCIETA' A RESPONSABILITA' LIMITATA - VAT No. and Tax Code 13233911000 - registered office at Via Plinio 15/C, 00193 Rome (RM), Italy - e-mail: mail@elspa.it - telephone: +39 06 68192869.
As of the date of this notice, no Data Protection Officer (DPO) has been appointed. Privacy-related requests and requests to exercise data protection rights may be sent to the e-mail address indicated above.
2. Scope and principles
Processing is carried out in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality. EL SPA applies privacy by design and by default measures and restricts access to data to authorised personnel according to roles and operational needs.
3. Data processed
- Identification and contact data: first name, surname, e-mail address and telephone number.
- Purchase and order data: products and treatments purchased, amounts, coupons, order status, vouchers, delivery and collection methods.
- Shipping data: recipient name, street/address, street number, postal code, city, province and country, when the Customer chooses shipment of beauty products.
- Gift/voucher recipient data: name, recipient e-mail address, gift message, delivery date/method where provided by the purchaser.
- Payment data: the data required to process payment are handled through Stripe; EL SPA does not store full payment card details.
- Contact and enquiry data: content of messages submitted through contact forms and requests for an initial Mindfulness consultation.
- Reviews: name, optional e-mail address, rating, treatment indicated and review text.
- Technical data: session identifiers, information required for the operation of the website, minimised technical logs and privacy/cookie preferences.
- Consent data: type of consent, value, text version, source, date/time and any withdrawal.
- Data used for commercial profiling, only with prior consent: purchase history, frequency, average spend, purchased categories and derived indicators/segments.
- Conversations with the AI Assistant: session text and pseudonymous technical metadata. The assistant does not request health data and includes client-side and server-side filters designed not to retain or transmit such data if detected.
4. Purposes, legal bases and retention periods
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Browsing, security and technical functionality | Technical and session data | Article 6(1)(f) GDPR; for necessary technical storage, Article 122 of the Italian Privacy Code | For the strictly necessary period; according to the technical duration indicated in the Cookie Policy |
| Handling contact requests | Name, e-mail, telephone number, message | Article 6(1)(b) GDPR - pre-contractual measures requested by the data subject; Article 6(1)(f) for handling and defending requests | As a rule, up to 12 months after closure of the request, unless further retention is required or a dispute arises |
| Mindfulness pathway enquiries | Name, e-mail, telephone number, individual/couple preference, short note | Article 6(1)(b) GDPR | As a rule, up to 12 months after closure of the request. Do not enter health or psychological data in the form |
| Orders, checkout, payments and vouchers | Identification details, contact details, order, gift recipient, payment data handled by Stripe | Article 6(1)(b) GDPR; Article 6(1)(c) for tax/accounting obligations | Contractual and administrative/accounting data according to legal obligations, normally up to 10 years; other data for the period necessary to manage the relationship |
| Shipping of beauty products | Recipient name, address, street number, postal code, city, province, country, items to be shipped | Article 6(1)(b) GDPR - performance of the contract; Article 6(1)(c) where necessary for legal obligations | For the period necessary for fulfilment, delivery, support and management of returns/complaints; if incorporated into contractual/administrative documentation, according to the retention periods applicable to orders |
| Abandoned cart reminders | E-mail address, cart contents, consent status | Article 6(1)(a) GDPR - specific consent | Cart: max. 30 days; up to 3 reminders approximately at 1h/24h/72h; evidence of consent retained separately for accountability |
| Commercial profiling and personalisation | Purchase history, AOV, frequency, categories, segments; any minimised internal AI insights | Article 6(1)(a) GDPR - specific and separate consent | Profile active only while consent is valid; purchase data considered over a 12-month operational window. Withdrawal: immediate stop to profiling |
| Public AI Assistant | Chat messages, pseudonymous session_id, budget/gift information if provided | Article 6(1)(f) GDPR for delivery, security and quality control of the user-requested function; where applicable Article 6(1)(b) | Backend max. 90 days; browser persistence max. 90 days only with functional consent, otherwise session only |
| Reviews | Name, optional e-mail, rating, text, treatment | Article 6(1)(a) GDPR or voluntary request by the data subject, subject to prior moderation; Article 6(1)(f) for anti-abuse management | Published reviews for as long as relevant or until a removal request; unpublished reviews for the time required for moderation and in any event subject to periodic review |
| Consent and preference management | Consent and withdrawal receipts, anonymous identifier or e-mail where necessary | Articles 6(1)(c) and 6(1)(f) GDPR - accountability and evidence of lawfulness | For the period necessary to demonstrate lawfulness and manage any disputes; periodic review and deletion when no longer necessary |
5. Shipping of beauty products
If the Customer chooses shipment within Italy of beauty products purchased on a standalone basis, EL SPA processes the address solely to prepare and fulfil the order, arrange transport, manage delivery, customer support, any returns, complaints and related administrative obligations.
The shipping address is not placed in the abandoned cart before checkout, is not used for commercial profiling, marketing, segmentation or AI systems, and is not recorded in checkout technical logs. Data required for delivery may be disclosed to the appointed carrier or logistics provider, according to the privacy role applicable in the specific case.
6. Commercial profiling
Only where the user provides specific consent may EL SPA analyse purchase history to derive indicators such as number of orders, average spend, frequency, preferred categories and commercial segments (for example, regular customer, customer at risk of inactivity, preference for certain categories). Such information may be used by staff to prepare proposals, coupons or suggestions that are more consistent with the interests shown.
Certain internal functions may use an artificial intelligence system to support staff in interpreting the profile. The payload sent to the AI system is minimised and does not include name, e-mail address, telephone number or shipping address. The AI does not make binding decisions, determine access to services, automatically change prices or produce legal or similarly significant effects: any initiative remains subject to human control.
Consent to profiling is optional, is not a condition of purchase and may be withdrawn at any time. Withdrawal prevents any new profiling, without affecting the lawfulness of processing carried out before withdrawal or the retention of order data required for contractual or legal purposes.
7. EL SPA AI Assistant
The website includes an AI Assistant that provides information about treatments and may suggest options based on the user’s current request, such as occasion, available time, preferences and budget. The assistant does not access purchase history, is not linked to the customer account and does not provide diagnoses or medical advice.
The assistant is designed not to request health data. If the system detects that the user is entering health information, the content is blocked before transmission to the AI provider and is not retained in the browser; a second server-side safeguard prevents such data from being sent to the model or stored in the database.
AI requests are routed through Lovable AI Gateway to an OpenAI model. The application uses a stateless configuration with the parameter store:false. This setting prevents application-level storage of the response by the AI endpoint, but does not in itself guarantee the complete absence of technical or security logs maintained by the provider under its applicable terms and agreements.
8. Recipients and service providers
- authorised EL SPA personnel according to role and operational need;
- Lovable/Lovable Cloud and Supabase infrastructure, for hosting, database, authentication and application services;
- Lovable AI Gateway and, as the provider of the underlying model, OpenAI, for AI functionality;
- Stripe, for electronic payments and fraud prevention;
- carriers, couriers and logistics providers appointed to deliver beauty products, limited to the data required for shipment;
- transactional e-mail providers and technical infrastructure used through the platform;
- professional advisers, authorities and public bodies where required by law or necessary for the protection of rights.
9. Transfers outside the EEA
The project application database is configured in the EU AWS region eu-west-1 (Ireland). However, certain providers, particularly payment services and AI model providers or their subprocessors, may process data outside the European Economic Area. In such cases EL SPA requires the use of the transfer mechanisms provided by the GDPR, such as adequacy decisions/Data Privacy Framework where applicable, Standard Contractual Clauses and supplementary measures.
The European location of the database does not necessarily mean that AI inference always takes place in the EU. EL SPA keeps this aspect under review and limits data transmitted to AI systems in accordance with the data minimisation principle.
10. Data relating to voucher/gift recipients
Where a purchaser provides another person’s data so that a voucher or gift can be sent to them, EL SPA processes those data solely to carry out the requested delivery and manage the voucher. The purchaser is asked to provide only accurate and necessary data. At the first contact, the recipient is provided with a reference to this notice pursuant to Article 14 GDPR.
11. Cookies and device technologies
The website uses necessary technical technologies and, subject to consent, functional technologies. As of the date of this notice, no third-party analytics or marketing/advertising tools are active. For the list, duration and management methods, please refer to the Cookie Policy and the Privacy Preferences Centre accessible from the footer.
12. Automated decision-making
EL SPA does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user within the meaning of Article 22 GDPR. AI systems and segmentation rules provide informational or commercial support under human supervision.
13. Data subject rights
Where applicable, the data subject may exercise the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. For direct marketing and related profiling, the data subject may object or withdraw consent at any time. Requests may be sent to mail@elspa.it. A complaint may also be lodged with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
14. Security
Role-based access controls, Row Level Security in the database, segregation of administrative functions, log minimisation, limited retention of AI conversations and carts, recording of evidence of consent, scheduled automatic deletion for specific data categories and technical controls before data are sent to AI systems are applied.
15. Minors
The e-commerce services and personalisation features are not intentionally directed at minors. If EL SPA becomes aware that data have been collected inappropriately, it will take the necessary steps to delete or regularise them.
16. Changes
This notice may be updated following regulatory, organisational or technical changes. The current version and effective date are published on the website. Material changes to processing based on consent may require a new consent.
17. Contact details
For privacy questions or requests: mail@elspa.it. Controller: DREAMLAND SOCIETA' A RESPONSABILITA' LIMITATA, Via Plinio 15/C, 00193 Rome (RM), Italy, VAT No./Tax Code 13233911000.
Legal and documentary references
Regulation (EU) 2016/679 - GDPR.
Legislative Decree No. 196/2003 - Italian Privacy Code, as amended.
Italian Data Protection Authority - Guidelines on cookies and other tracking tools, 10 June 2021.
Italian Data Protection Authority - list of processing operations subject to a DPIA, 11 October 2018.
Regulation (EU) 2024/1689 - AI Act.