Privacy Policy

1. Who we are

This website (kysh-labs.com) is operated by KYSH Labs, the Innovation, Research & Development Division of KYSH Cosmetics. In this policy, “KYSH Labs”, “we”, “us” and “our” refer to KYSH Cosmetics acting as data controller for the personal data collected through this website.

For any privacy-related request, you can contact us at labs@kyshcosmetics.com.

2. What data we collect

When you submit the contact form on this website, we collect the information you provide, which may include:

• Full name
• Email address
• Company, country, website, industry (optional)
• Area of interest and the content of your message

For security and abuse-prevention purposes, we also automatically record your IP address and browser user-agent at the time of submission.

3. Why we process your data (legal basis)

• To respond to your inquiry and evaluate a potential business relationship — legal basis: your consent (Art. 6(1)(a) GDPR) and pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• To protect the website from spam, abuse and fraudulent submissions — legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To comply with legal obligations, when applicable — legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not use your data for automated decision-making or profiling, and we do not send marketing communications without your explicit opt-in.

4. Data retention

Contact-form submissions are retained for the time strictly necessary to handle your inquiry and any resulting business relationship, and in any case no longer than 24 months from the last meaningful contact, unless a longer period is required by law or to establish, exercise or defend legal claims.

5. Who has access to your data

Your data is accessed only by authorised personnel of KYSH Labs and KYSH Cosmetics. We may share it with trusted service providers acting as data processors on our behalf:

• Lovable (Sweden) — hosting, application platform and email delivery infrastructure.
• Supabase (EU / global) — managed database used to securely store contact-form submissions.

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

6. Cookies and analytics

This website does not use advertising cookies or third-party tracking. Only strictly necessary technical storage may be used to make the site function correctly. If we introduce analytics in the future, this policy will be updated and, where required, a cookie-consent banner will be shown.

7. Your rights (GDPR)

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the right to:

• access the personal data we hold about you;
• request rectification or erasure of your data;
• request restriction of, or object to, its processing;
• receive your data in a portable format;
• withdraw your consent at any time (this does not affect the lawfulness of processing carried out before the withdrawal);
• lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

To exercise any of these rights, please write to labs@kyshcosmetics.com.

8. Security

We apply reasonable technical and organisational measures to protect personal data, including encrypted transport (HTTPS), database access controls (row-level security) and restricted administrative access. No system is 100% secure, but we work to continuously improve our protections.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top of this page will always reflect the most recent version.