Elti Traders LP with registered office at 6 Inns Court, Winetavern Street, Dublín, D08 DV20, Ireland (hereinafter, the "Data Owner"), owner of this website (hereinafter, the "Site"), as owner of the treatment of the personal data of users who browse and participate in the initiative on the Site (hereinafter, the "Users") provides below the privacy information pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, the "Regulation") and art. 13 of the Data Protection Act 2018 (hereinafter, jointly with the Regulation, "Applicable Law").

The Owner, established outside the European Union, offering a service to subjects residing in the European Union, will process the personal data of users who browse and participate in the initiative on the Site pursuant to art. 3, par. 2 lett. a) of the Regulation.

The initiative is reserved for individuals who have completed eighteen years of age. Therefore, the Data Controller does not collect personal data relating to persons under the age of 18. Upon request by the Users, the Data Controller will promptly cancel all personal data involuntarily collected and relating to persons under the age of 18.

The Owner takes the utmost account of the right to privacy and the protection of personal data of its Users. For any information in relation to this privacy statement, Users can contact the Owner at any time, using the following methods:

• By sending a registered letter with return receipt to the Data Controller's registered office (6 Inns Court, Winetavern Street, Dublín, D08 DV20, Ireland)
• By sending an e-mail message to: privacy@freebeautyadvice.com

The Data Controller has not identified the figure of the Data Protection Officer (RPD or DPO), as he is not subject to the designation obligation set forth in art. 37 of the Regulation.

1. Purpose of the treatment

Users' personal data will be processed lawfully by the Data Controller pursuant to art. 6 of the Regulation for the following processing purposes:

a. Contractual obligations and provision of the service: to implement the regulation of the prize event, which is accepted by the User during registration; fulfill specific User requests. The User's data collected by the Data Controller for the purpose of possible participation include: name, surname, date of birth, address, house number, city, postal code, e-mail, telephone number, as well as all personal information of the User possibly and voluntarily provided. Unless the User gives the Owner a specific and optional consent to the processing of their data for marketing purposes or for the purpose of communicating data to the Owner's Partners pursuant to article 2 below, the above data will be used by the Owner at the exclusive purpose of ascertaining the identity of the User (also by validating the e-mail address), thus avoiding possible scams or abuses and contacting the User for service reasons only (e.g. managing any participation by the User at the prize event, notify any winnings and manage the phase of attribution and delivery of prizes; contact the User to obtain additional data and information – such as a copy of the identity document – possibly requested by the notary and by the Chamber of Commerce official in charge of the competitions prizes, in order to ascertain their identity and avoid scams and abuses; make any urgent communications by telephone in phase of withdrawal and use of prizes). Without prejudice to the provisions elsewhere in this privacy statement, in no case will the Data Controller make the Users' personal data accessible to other Users.

b. Administrative-accounting purposes: i.e. to carry out activities of an organisational, administrative, financial and accounting nature, such as internal organizational activities and functional activities for the fulfillment of contractual and pre-contractual obligations.

c. Legal obligations: or to fulfill obligations established by law, by a regulation or by European legislation (e.g. legislation on tax matters; legislation on prize events – Presidential Decree 430/2001).

The provision of personal data for the processing purposes indicated above is optional but necessary, since failure to provide them will make it impossible for the User to use the services offered by the Data Controller and participate in the prize event.

The personal data that are necessary for the pursuit of the processing purposes described in this article 1 are indicated with an asterisk within the initiative registration form.

2. Further processing purposes

2.1. Marketing (sending of advertising material, direct sales and commercial communication)

With the free and optional consent of the User, some personal data of the User (name, surname, date of birth, address, house number, city, zip code, e-mail, telephone number) may be processed by the Data Controller also for marketing purposes (sending of advertising material, direct sales and commercial communication), or so that the Data Controller can contact the User by post, e-mail, telephone (landline and/or mobile, with automated call or call with and/or without the intervention of an operator) and/or SMS and/or other messaging systems, to offer the User the purchase of products and/or services offered by the Owner and/or by third-party companies, present offers, promotions and commercial opportunities.

Profiling: The User's personal data (i.e. personal and contact details, and information relating to the services in which the User has expressed an interest) may also be processed by the Data Controller for profiling purposes, i.e. to reconstruct the User's tastes and consumption habits, identifying the User's consumer profile, in order to be able to send the User commercial offers consistent with the identified profile.

If consent is not given, the possibility of registering on the Site will not be affected in any way. In the event of consent, the User may revoke it at any time by making a request to the Data Controller sending an email at privacy@freebeautyadvice.com

User ID verification: The Controller informs that, in the pursuit of its legitimate interest, the User's personal data (i.e. personal and contact details) may also be processed by the Controller for security purposes, i.e. to verify the User's digital identity and to prevent fraud and abuse of personal data. The User may at any time object to this processing by making a request to the Data Controller sending an email at privacy@freebeautyadvice.com. In case of lack of consent, the possibility of registering for the initiative will not be affected in any way. In case of consent, the User may revoke it at any time, making a request to the Data Controller in the manner indicated in the following article "Rights of the interested parties".

The User can also easily oppose further sending of promotional communications via e-mail by clicking on the appropriate link for the withdrawal of consent, which is present in each promotional e-mail. If the User intends to revoke his consent to the sending of promotional communications by telephone, while continuing to receive promotional communications by e-mail, or vice versa, please send a request to the Data Controller in the manner indicated in the following article "Rights of Interested".

The Data Controller informs that, following the exercise of the right to object to the sending of promotional communications via e-mail, it is possible that, for technical and operational reasons (e.g. formation of contact lists already completed shortly before receipt by the Holder of the opposition request) the User continues to receive some further promotional messages. If the User should continue to receive promotional messages after 24 hours have passed from exercising the right to object, please report the problem to the Owner, using the contacts indicated in the following article "Rights of the interested parties".

2.2. Communication of data to the Owner's Partners

With the User's free and optional consent, the User's personal data (name, surname, date of birth, address, house number, city, zip code, e-mail, telephone number and IP address) will be communicated from the Owner to the following categories of third-party companies: (i) landline and mobile phone companies; (ii) companies active in the publishing world (printed paper, internet, television and new media); (iii) companies active in the sector of electronic commerce of products and services; (iv) companies operating in the energy sector; (v) companies operating in the travel and leisure sector; (vi) companies involved in professional and/or educational training; (vii) advertising agencies, media centers and contact centres; (viii) companies operating in the food sector; (ix) NGOs and ONLUS; (x) companies operating in the financial and insurance sector; (xi) companies operating in the marketing and web communication sector (collectively, the "Partners of the Owner").

We and our website sponsors, partners and selected third parties operate in the following areas: Retail, Automotive, Lifestyle, Charity, Utility, Telecommunications, Insurance, Publishing / Media, Entertainment/Gaming/Leisure, Public Sector, Financial Services, Travel, Mail Order, Health/Beauty, Education, FMCG, Marketing Agencies and Brokers, Property, Pharmaceuticals, Claims Companies and Short Term Loans.

We may share your personal information with our partner WINR Data Pty Ltd (WINR) and their global partners for the purposes of: Fraud Prevention – preventing others from misusing your personal information. This may involve identity verification for anti-fraud, anti-money laundering, anti-crime, asset recovery, debt collection and reuniting individuals with unclaimed assets; and Digital Advertising – providing personalised advertising and content that is relevant to you. This may involve identity resolution for data analysis, matching and linkage.

WINR and their global partners will process and retain your personal information for as long as necessary for these specific purposes and on the lawful basis of legitimate interests. You can submit a request to exercise any of your privacy rights to the Data Protection Officer at WINR https://www.winrdata.com/privacy-policy/

We may share your data with other third-party partners, which may use such personal data for targeted advertising, measurement, suppression management and identity resolution purposes, including for measurement and analytics on campaign performance, personalization, modelling, onboarding, analysis, profiling and linkage, to extend their databases by appending additional information to existing information they may already hold on you. These organisations will have a relationship with you or may use your data where they have a lawful reason, which may include these organisation's own legitimate interests. Use of your data may also include tracing of individuals, verification and/or validation of the identity of individuals for the purposes of, but not limited to, anti-money laundering regulations, national security, crime prevention and detection, enforcement, anti-fraud processes, asset recovery and asset reunification, and revenue collection. When supplying your data with third party partners for purposes including but not limited to online linkage, fraud prevention and tracing, we will rely upon legitimate interests as our legal basis for processing your data.

We use suitable safeguards to transfer your data to third countries such as standard contractual clauses and adequacy decisions to protect your rights. If you would like to receive a copy of our safety measures, you can contact us via email.

The Owner's Partners, as independent data processors, will process the User's personal data for their own marketing purposes. In case of lack of consent, the possibility of registering for the Initiative will not be affected in any way. In case of consent, the User may revoke it at any time, making a request to the Data Controller in the manner indicated in the following article "Rights of the interested parties". Furthermore, it is possible to analytically select for which Partners you intend to give your consent to the transfer of your personal data when registering for the competition. A list of the Owner's Partners is constantly updated and can be obtained by writing to the Owner at the addresses indicated in the following article "Rights of the interested parties".

3. Method of treatment and data retention

The Data Controller will process Users' personal data using paper, electronic and automated tools, in compliance with the provisions of the Applicable Law, in order to guarantee the confidentiality and security of the data and to avoid the risks of loss or destruction, even accidental, of the data themselves, unauthorized access or treatment that does not comply with the purposes indicated in this privacy statement. The data will be stored in a form that allows the identification of the User for the time strictly necessary for the purposes for which the data were collected and subsequently processed, and in any case within the limits of the law. In particular:

• For the purposes referred to in article 1, letter a) (contractual obligations and provision of the service) the data will be kept for the entire duration of the relationship with the Owner and subsequently, if the relationship is terminated, also for the ordinary limitation period of 10 years. For the purposes referred to in art. 1, lett. b) (administrative-accounting) the data will be kept for the entire duration of the relationship with the Owner and subsequently for the period required by law for this purpose (10 years). For the purposes referred to in art. 1, lett. c) (legal obligations) the data will be kept for the period required by specific legal obligations or applicable regulations.
• For the purposes referred to in article 2.1 (marketing) and 2.2 (communication of data to Partners of the Owner), the data will be kept until the revocation of consent by the User and, in any case, for a period not exceeding 24 months from the collection of data for the purposes of marketing and 12 months from the collection of data for the purposes of communication to Partners.

At the end of the retention period, the personal data will be deleted or transformed into an anonymous form.

4. Scope of communication and dissemination of data

The Data Controller may communicate Users' personal data, for the purposes set out in article 1 of this privacy statement, to: subjects, public or private, that can access the data in compliance with legal provisions, regulations or European legislation, within the limits provided for by these rules; subjects who process the data in execution of specific contractual obligations with the User, for purposes strictly connected to the performance of the activities carried out to provide the services requested by the User (by way of example, the notary and the Chamber of Commerce official in charge of the prize competitions, the companies that manage the prize awarding phase, shipping companies in charge of delivering the prizes, IT service providers, etc.); employees and/or collaborators of the Data Controller who are in charge of managing the User's requests and providing the services covered by the initiative, in their capacity as persons in charge and/or responsible for the processing, after having received adequate operating instructions from the Data Controller.

For the purposes referred to in article 2.2 of this privacy statement, Users' personal data may be communicated to the Owner's Partners, as independent data controllers. The updated list of the Owner's Partners is available at the Owner's registered office and can be requested by writing to the addresses indicated in the following article "Rights of the interested parties". The personal data processed by the Data Controller are not subject to dissemination.

5. Transfer of data to third countries

The Data Controller may transfer the User's personal data to third countries outside the European Union. In this case, the Data Controller guarantees that the transfer of personal data will take place in compliance with the Applicable Law and that it will take place only: to countries qualified by the European Commission as offering an adequate level of protection pursuant to art. 45 of the Regulation; to subjects that provide adequate guarantees pursuant to art. 46 of the Regulation, including standard contractual clauses approved by the European Commission and binding corporate rules. Users have the right to obtain a copy of the data transferred to countries outside the European Union and to obtain information on the place where such data are stored, by contacting the Data Controller at the addresses indicated in the following article "Rights of the interested parties". The Data Controller also uses suitable safeguards to transfer data to third countries, including standard contractual clauses and adequacy decisions.

6. Rights of the interested parties

Users, as data subjects, may exercise at any time the rights recognized by the Applicable Law, including the right to:

• Access: obtain confirmation of the existence or not of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;
• Rectification: obtain the rectification of inaccurate data concerning you or the integration of incomplete data;
• Cancellation: obtain the cancellation of data concerning you, if the conditions provided for by the Applicable Law exist;
• Limitation: obtain the limitation of processing, in the cases provided for by the Applicable Law;
• Portability: receive data concerning you in a structured format, commonly used and readable by an automatic device, and transmit such data to another data controller, only if the processing is based on consent or contract and is carried out by automated means;
• Opposition: object at any time to the processing of data concerning you, unless there are legitimate reasons for the Data Controller to continue processing;
• Withdraw consent: revoke the consent given at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation;
• Lodge a complaint: lodge a complaint with the competent supervisory authority in the Member State where you usually reside or work, or in the State where the alleged violation has occurred (in the United Kingdom, the Information Commissioner's Office – ICO; in Ireland, the Data Protection Commission – DPC).

To exercise these rights, Users may contact the Data Controller at any time using the following methods: by sending a registered letter with return receipt to the Data Controller's registered office at 6 Inns Court, Winetavern Street, Dublín, D08 DV20, Ireland; by sending an e-mail message to: privacy@freebeautyadvice.com

Users who believe that the processing of their personal data by the Data Controller occurs in violation of the provisions of the Applicable Law may also lodge a complaint with the competent supervisory authority (in the United Kingdom, the Information Commissioner's Office – ICO; in Ireland, the Data Protection Commission – DPC) or appeal to the appropriate judicial authorities.

The exercise of rights is not subject to any form constraint and is free of charge, except in cases where the requests are manifestly unfounded, excessive or repetitive, in which case the Data Controller may charge a reasonable fee or refuse to satisfy the requests.

7. Changes to this privacy policy

The Data Controller reserves the right to make changes to this privacy statement at any time, giving appropriate publicity to Users on the Site and ensuring in any case adequate and similar protection of personal data. In order to always be aware of the methods of treatment and of any changes, Users are invited to regularly consult this privacy statement. In case of substantial changes that may affect the rights of Users, these will be communicated directly by the Owner.

Last updated: December 2025