1. Data controller
The data controller is:
- [REPLACE: Ragione sociale, es. Scarpe Italiane Stock S.r.l.]
- Registered office: [REPLACE: Sede legale, via, città, CAP, Italia]
- VAT no.: [REPLACE: Partita IVA]
- Email: [REPLACE: privacy@scarpeitalianestock.it]
- Certified email (PEC): [REPLACE: pec@scarpeitalianestock.it]
This notice is provided under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
2. Personal data processed
We process the following categories of data:
- Identity data: first name, last name.
- Contact data: email, phone number.
- Shipping data: address, city, postal code, province.
- Payment data: handled entirely by Stripe and PayPal; we do not store card numbers on our servers.
- Navigation data: technical logs, IP address, technical cookies.
- Account data: if you create an account, your email and (for Google sign-in) Google profile data (name, image).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Performance of the sales contract | Art. 6.1.b GDPR — contract |
| Shipping and order tracking | Art. 6.1.b GDPR — contract |
| Tax and accounting obligations | Art. 6.1.c GDPR — legal obligation |
| Account management and sign-in | Art. 6.1.b GDPR — contract |
| Site security and fraud prevention | Art. 6.1.f GDPR — legitimate interest |
4. Data provision
Providing the data marked as required at checkout (first name, last name, email, phone, shipping address) is necessary to conclude and perform the contract. Without it, we cannot fulfill the order.
5. Data recipients
Data may be shared with the following parties, as processors or independent controllers:
- Stripe Payments Europe Ltd. — card payment processing.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — PayPal payment processing.
- Couriers (BRT, GLS, Poste Italiane) — order delivery.
- Supabase (database hosting) — EU-based servers.
- Hostinger — site hosting.
- Google LLC — Google sign-in (if used).
- Competent authorities, where required by law.
6. International data transfers
Data is mainly processed within the European Economic Area. Some providers (e.g. Google) may process data outside the EU; in that case, transfers are made under Standard Contractual Clauses approved by the European Commission or other adequate safeguards.
7. Retention period
- Order and invoicing data: 10 years (Italian tax obligations).
- Account data: until account deletion is requested.
- Security logs: max 12 months.
- Technical cookies: session duration.
8. Your rights
As a data subject, you have the right to:
- access your data (Art. 15 GDPR);
- rectify inaccurate data (Art. 16 GDPR);
- delete your data (Art. 17 GDPR), subject to retention obligations;
- restrict processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing based on legitimate interest (Art. 21 GDPR);
- withdraw consent, where applicable.
To exercise your rights, write to: [REPLACE: privacy@scarpeitalianestock.it]
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
9. Cookies
The site uses:
- Technical cookies: required for operation (session, cart, language/theme preferences). No consent required.
- Authentication cookies: to maintain your login session (NextAuth).
The site does not use profiling cookies or third-party tracking without your explicit consent.
10. Security
We adopt appropriate technical and organizational measures to protect your data: HTTPS connections, password hashing, restricted database access, regular backups.
11. Changes to this notice
We reserve the right to update this notice. The current version is always available on this page.
12. Contact
For any privacy questions: [REPLACE: privacy@scarpeitalianestock.it]