This policy explains how we process your personal data when you visit rodrigobarcellos.com, buy from the Shop, create an account or subscribe to our news, in line with the EU General Data Protection Regulation (GDPR, Regulation 2016/679).
1. Controller
[COMPANY_NAME], [REGISTERED_ADDRESS], VAT number [VAT_NUMBER]. Contact for privacy matters: [PRIVACY_EMAIL].
2. What data we process, why and on what basis
- Orders: name, email, delivery address, phone number, products bought and amounts, to sell and deliver your order and handle returns and guarantees. Basis: performance of a contract (Art. 6(1)(b) GDPR).
- Invoices and accounting: order and payment data that the law requires us to keep. Basis: legal obligation (Art. 6(1)(c) GDPR).
- Account: name, email, password (stored only as a one-way hash), order history and wishlist, to let you sign in and see your orders. Basis: performance of a contract (Art. 6(1)(b) GDPR).
- Newsletter: your email address, to send you news about our products. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email.
- Emails to customers: if you bought from us, we may email you about products similar to those you bought, unless you object. You can object when we collect your email and with the unsubscribe link in every email (Art. 130(4) of the Italian Privacy Code).
- Security and operation of the site: technical data such as IP address, browser type and request logs, to keep the site secure and prevent fraud. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
Providing the data marked as required in the forms is necessary to place an order or create an account; without it we cannot provide the service.
3. Payments
Card and other payment data are entered directly on the secure page of Stripe Payments Europe Ltd, which processes them as an independent controller. We only receive the result of the payment and limited details (for example the card brand and last four digits).
4. Who receives your data
- Stripe (payments) — Ireland and USA
- Resend (sending of emails) — USA
- [HOSTING_PROVIDER] (hosting of the site and database) — [HOSTING_COUNTRY]
- Cloudflare (network security and content delivery) — worldwide
- [CARRIER] (delivery of your order)
- Accountants and public authorities, when the law requires it
These providers process data on our behalf under data processing agreements, or as independent controllers where stated. We do not sell your data.
5. Transfers outside the EU
Some providers are based in the USA. Transfers are covered by the EU–US Data Privacy Framework or by the Standard Contractual Clauses approved by the European Commission.
6. How long we keep your data
- Order and invoice data: 10 years, as required by Italian tax and civil law.
- Account: until you delete it or ask us to delete it. Sign-in sessions expire after 30 days.
- Newsletter: until you unsubscribe. We keep a record of the unsubscribe so we do not email you again.
- Technical logs: [LOG_RETENTION].
7. Your rights
You can ask for access to your data, its correction or deletion, the restriction of processing, data portability, and you can object to processing based on our legitimate interest (Articles 15–21 GDPR). Where processing is based on consent, you can withdraw it at any time without affecting what was done before. Write to [PRIVACY_EMAIL].
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live.
We do not make decisions based solely on automated processing, including profiling.
8. Cookies
See the Cookie policy.
9. Changes
We may update this policy. The date at the top shows the latest version.