🔒 Privacy Policy

1. Information We Collect

We collect and process personal data in accordance with GDPR Article 6 (lawful basis) and Article 9 (special categories). The following information is collected:

Personal Information

• Name, email address, and phone number for account creation and communication
• Billing and shipping addresses for order processing and delivery
• Payment information (processed securely by third-party payment processors)
• Purchase history and order preferences for customer service

Technical Information

• IP address, browser type, and device information for security and analytics
• Website usage data and navigation patterns for service improvement
• Cookies and similar technologies for functionality and personalization
• Communication logs for customer support and quality assurance

Marketing Information

• Email preferences and communication history (with explicit consent)
• Product interests and browsing behavior for personalized recommendations
• Survey responses and feedback (voluntary participation)

2. Legal Basis for Processing

Under GDPR Article 6, we process your personal data based on the following lawful grounds:

Contract Performance (Article 6(1)(b))

Processing necessary for order fulfillment, delivery, customer service, and warranty claims. This includes payment processing, shipping coordination, and post-sale support.

Legitimate Interest (Article 6(1)(f))

Analytics for website improvement, fraud prevention, security monitoring, and business optimization. We conduct regular assessments to ensure our legitimate interests don't override your privacy rights.

Consent (Article 6(1)(a))

Marketing communications, personalized recommendations, and optional services. You can withdraw consent at any time without affecting other processing activities.

Legal Obligation (Article 6(1)(c))

Tax records, regulatory compliance, and legal reporting requirements under Italian and EU law.

3. Data Sharing and Third Parties

We share personal data only when necessary and with appropriate safeguards:

Service Providers

• Payment processors (Stripe, PayPal) for secure transaction handling
• Shipping companies for delivery coordination and tracking
• Cloud hosting providers (AWS, Google Cloud) with EU data residency
• Customer support tools for efficient service delivery

Legal Requirements

• Tax authorities for VAT and regulatory compliance
• Law enforcement when legally required
• Regulatory bodies for consumer protection compliance
• Courts and legal proceedings when mandated

Business Operations

• Authorized suppliers for warranty and authenticity verification
• Analytics providers for website performance (anonymized data)
• Security services for fraud prevention and protection

4. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy:

Account Information

Retained while your account is active plus 3 years for customer service and legal compliance. You can request deletion at any time subject to legal obligations.

Transaction Records

Maintained for 10 years as required by Italian tax law and consumer protection regulations. Financial records cannot be deleted during this period.

Marketing Data

Processed until consent is withdrawn or account closure. You can opt-out of marketing communications while maintaining your account.

Technical Logs

Security and performance logs retained for 12 months for system integrity and fraud prevention purposes.

5. Your Privacy Rights Under GDPR

As an EU resident, you have comprehensive rights regarding your personal data:

Right of Access (Article 15)

Request a copy of all personal data we hold about you, including processing purposes and retention periods.

Right to Rectification (Article 16)

Correct any inaccurate or incomplete personal information in our systems.

Right to Erasure (Article 17)

Request deletion of your personal data when processing is no longer necessary or consent is withdrawn.

Right to Restrict Processing (Article 18)

Limit how we use your data while disputes are resolved or accuracy is verified.

Right to Data Portability (Article 20)

Receive your data in a structured, machine-readable format for transfer to other services.

Right to Object (Article 21)

Stop processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making (Article 22)

Request human review of automated decisions that significantly affect you.

6. International Data Transfers

When personal data is transferred outside the EU/EEA, we ensure adequate protection through:

• European Commission adequacy decisions for approved countries
• Standard Contractual Clauses (SCCs) for third-party processors
• Binding Corporate Rules for multinational service providers
• Explicit consent for specific transfer purposes

Primary data processing occurs within the EU through our European cloud infrastructure partners.