1.Data controller
The data controller is Da inserire, with registered office at Da inserire, Da inserire Da inserire (Da inserire), email Da inserire. The same address can be used to exercise the rights described below.
2.Which data is processed and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Orders and deliveries | Name, address, email, phone, products ordered | Performance of the contract and tax obligations (art. 6.1.b and 6.1.c GDPR) | For the duration of the relationship and then for the time required by accounting and tax rules |
| Subscriptions | Name, delivery address, email, product, frequency, subscription status, reference to the payment method stored by Shopify | Performance of the contract (art. 6.1.b) | For the duration of the subscription and then as for orders |
| Customer area (My account) | Sign-in email, one-time sign-in codes handled by Shopify, profile details, linked orders and subscriptions | Performance of the contract at the data subject's request (art. 6.1.b) | While the account stays active; the session on the site expires by itself |
| Withdrawal and support | Data entered in the form, content of the declaration, receipt | Legal obligation and performance of the contract (art. 6.1.c and 6.1.b) | For the time needed to prove that the right was exercised |
| Newsletter | Email address, language, proof of consent (date, text version, network address in hashed form) | Consent (art. 6.1.a) | Until consent is withdrawn; proof of consent is kept to show it was valid |
| Security and aggregate statistics | Network address in hashed form to limit abuse, technical logs, cookieless visit statistics | Legitimate interest (art. 6.1.f) | For short periods; statistics are aggregated |
Providing the data needed to fulfil an order is essential: without it the purchase cannot be completed. Subscribing to the newsletter is optional.
3.Recipients of the data
Data may be shared with parties who process it on behalf of the controller, appointed as processors, or as independent controllers where the law provides so:
- Shopify, for the online store, the checkout page, order management, the customer area and subscriptions (Shopify Subscriptions app);
- couriers, for delivery;
- Vercel, for hosting the site and aggregate visit statistics;
- Supabase, for storing withdrawal requests and consents;
- Resend, for sending service emails and the newsletter.
Data is not sold or handed to third parties for marketing purposes.
4.Transfers outside the European Economic Area
Some suppliers may also process data outside the European Economic Area, for example in the United States. In these cases the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses.
5.Store search and recommendations
To power search and product recommendations, Shopify may use information about how visitors interact with the stores in its network (its “Network Intelligence” feature). Details are in Shopify's own privacy notice.
7.Rights of the data subject
The data subject may request access to the data, rectification, erasure, restriction of processing, objection and portability (arts. 15-22 GDPR), and may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
For the newsletter it is enough to use the unsubscribe link in every email. For any other request write to Da inserire. The data subject also has the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
8.Updates
This notice may be updated: the date of the last update is shown at the top of the page.