Privacy policy

Information provided under Articles 13-14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller

Luchetti Lorenzo, VAT 17891071007, Via delle Calendule 12, 00172 Roma (RM), Italia — email: lorenzoprosell@gmail.com

2. Data processed and purposes

• Order and shipping data (name, address, email, phone): performance of the sales contract and tax obligations — legal basis Art. 6.1.b and 6.1.c GDPR.
• Account data (email, encrypted password, order history): providing the personal area — Art. 6.1.b GDPR.
• Payment data: processed only by the payment providers (Stripe, PayPal); the controller never receives or stores card numbers.
• Technical cookies: strictly necessary for the site to work (cart, login session, language). No profiling. See the cookie policy.
• Anonymous visit statistics (page viewed, referring site, device type, country and city derived from the network, cart steps: items added or removed, checkout opened, payment method chosen, errors): measuring use of the shop in aggregate form, with a random code that lasts as long as the browser tab. No IP address stored, no matching with other data, no sharing with third parties — Art. 6.1.f GDPR (legitimate interest); treated like technical cookies under the Italian Data Protection Authority guidelines of 10 June 2021, hence without prior consent. Individual visits are kept for up to 13 months.

3. Retention

Order data is kept for 10 years for civil and tax obligations (Art. 2220 Italian Civil Code). Account data is kept while the account is active; upon a deletion request, data not subject to retention obligations is removed within 30 days.

4. Where the data is stored and by whom

• Order and account database: Turso (Iku Turso Inc.) on AWS infrastructure in the eu-west-1 region (Ireland, European Union) — processor under Art. 28 GDPR.
• Website hosting: Cloudflare, Inc. (Cloudflare Workers network: pages are served from the data centre closest to the visitor) — processor under Art. 28 GDPR.
• Transactional emails (order confirmations): Google LLC (Gmail), with only the information needed to send them (email, name, order content).
• Payments: Stripe Payments Europe Ltd / PayPal (Europe) S.à r.l. — the controller never receives or stores card numbers.
• Couriers and Packlink (to create shipping labels and deliver parcels) and the tax advisor.

Any transfers outside the EU (e.g. Google, Cloudflare) take place on the basis of standard contractual clauses under Art. 46 GDPR.

5. Your rights and the right to erasure

Under Articles 15-22 GDPR you have the right of access, rectification, erasure (“right to be forgotten”), restriction, portability and objection. You can delete your account yourself from the account page (“Delete account”): the account and the associated personal data are removed immediately; only order data subject to tax obligations (Art. 2220 Civil Code) is kept, no longer linked to the account. For any other request write to lorenzoprosell@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

6. Whether providing data is mandatory

Providing the data marked as mandatory is necessary to fulfil the order; without it the purchase cannot be completed.

Last updated: September 2026.