Privacy Policy

Last updated: 4 October 2026 — Version v1.2

Introduction

Orsolya Anna Varady, Via Merulana 53, 00185 Rome, Italy, email privacy@healingragdoll.com, telephone +39 352 022 4491 (hereinafter the “Data Controller”), as controller of personal data, informs you that personal data is processed in compliance with Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.

The Data Controller carries out an occasional, non-habitual activity, not subject to the VAT registration requirement under Italian tax law, and manages the website healingragdoll.it (the “Site”).

1. Types of data processed

• Browsing data: technical information collected automatically by computer systems (IP addresses, logs, access time, etc.) used only for anonymous statistical purposes and to check that the site is working properly.
• Cookies: the site uses technical cookies needed for it to work and, with consent, third-party cookies. For more information, see the Cookie Policy.
• Data provided voluntarily: first name, surname, email address, contact details and other data sent through contact forms or newsletter sign-up.
• Letters from readers: if you write to redazione@healingragdoll.com for the «Reader Emails» column, we process your email address and the content of your message only to read it, reply and, if we decide to and with your consent, publish or quote it in the Magazine (legal basis: Art. 6(1)(b) and (a) GDPR); publication takes place anonymously or with your first name only, unless you request otherwise, and we never publish the email address; the message is kept for the time needed to reply and, if published, for as long as it remains online; you can ask for its removal or deletion at any time by writing to privacy@healingragdoll.com.

2. Purposes and legal basis of processing

Data is processed in order to: (a) handle information and contact requests; (b) fulfil legal, tax or contractual obligations; (c) send newsletters, promotional communications or updates, with the data subject’s consent; (d) analyse use of the site in aggregate form and improve the services offered; (e) measure the effectiveness of advertising campaigns and deliver targeted advertising on third-party social networks, with specific consent given through the cookie banner (§5).

Legal basis: Art. 6(1)(b) and (a) GDPR.

3. Methods of processing

Processing is carried out by electronic and paper means, in compliance with the principles of lawfulness, fairness and transparency. Data is accessible only to authorised personnel or technical suppliers appointed as external Data Processors (e.g. hosting provider, IT support, newsletter platforms, couriers).

4. Social networks and third-party services

The site may include links or plug-ins to social networks (e.g. Facebook, Instagram). Interacting with these services involves sharing data with the relevant platforms, which act as independent data controllers. The Data Controller does not control or manage the cookies or processing methods adopted by those parties. Users are invited to read the respective privacy notices.

5. Meta Pixel, Conversions API and custom audiences

Only with specific consent given through the cookie banner (category “Marketing / Advertising”), the Site uses the Meta Pixel (identifier 1946972509259905) provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”) for measurement, remarketing and the creation of custom audiences (“Custom Audiences”) and lookalike audiences (“Lookalike Audiences”) for the delivery of the Data Controller’s advertising campaigns on Meta’s platforms (Facebook, Instagram).

The events sent to Meta through the Pixel are the following:

• PageView — viewing of a page of the Site;
• Lead — submission of a contact or information request form.

In addition to or instead of the client-side Pixel, the Data Controller may send the same events to Meta through the Conversions API (CAPI), a server-to-server channel that transmits the same data (event, URL, pseudonymised user identifiers) directly from its own servers to Meta’s servers.

The Meta Pixel uses third-party cookies — in particular _fbp and _fbc — and sends to Meta anonymous browser identifiers, the URL of the page visited, technical data about the device and any parameters of the advertising campaign. No special category data (Art. 9 GDPR) is transmitted.

The Data Controller and Meta act as joint controllers of the processing limited to the collection and transmission of events to the Pixel, under the joint controllership agreement available at facebook.com/legal/controller_addendum. For subsequent processing Meta acts as an independent controller.

Consent can be withdrawn at any time through the “Cookie Settings” panel in the footer or by removing the cookieyes-consent cookie. Withdrawal prevents further transmissions but does not affect data already sent to Meta before withdrawal. For Meta’s privacy notice see facebook.com/privacy/policy.

6. Nature of the provision of data and consent

The provision of data for the purposes in letters (a) and (b) is necessary for the delivery of services. Consent for the purposes in letters (c), (d) and (e) is optional and can be withdrawn at any time through the unsubscribe link in communications, through the “Cookie Settings” panel, or by writing to info@healingragdoll.com.

7. Disclosure and retention of data

Data may be disclosed to parties providing technical or administrative services on behalf of the Data Controller (e.g. hosting, email and newsletter providers). The transfer of data to Meta involves the transfer of personal data to third countries (United States), covered by the standard contractual clauses and by the EU-US Data Privacy Framework under the European Commission adequacy decision C(2023) 4745. For other processing, no transfer of data outside the European Economic Area is planned except with adequate safeguards under Arts. 44–49 GDPR. Data is kept for the time needed to achieve the stated purposes or until consent is withdrawn.

8. Rights of the data subject

Data subjects may exercise the rights provided for in Arts. 15–21 GDPR by writing to info@healingragdoll.com. They may also lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

9. Data Controller

Orsolya Anna Varady
Occasional, non-habitual activity, not subject to the VAT registration requirement under Italian tax law
Email: info@healingragdoll.com