1. Data controller
In accordance with Regulation (EU) 2016/679 (GDPR), the data controller is UNRULED s.r.l.s., Via Borghetto 2, 24020 Torre Boldone (BG), Italy, VAT IT04917070163, which can be contacted at [email protected] or by certified email at [email protected].
2. Data collected and purpose of processing
We collect personal information voluntarily provided by users: first name, last name, shipping and billing address, email address, phone number and payment information (which is processed by our payment providers and never stored by us).
These data are processed exclusively for the following purposes:
- Order management and fulfilment (checkout, shipping, invoicing) — legal basis: performance of the contract; kept for 10 years as tax and accounting law requires.
- Your account, if you create one — legal basis: performance of the contract; kept until you close it.
- Customer support — legal basis: our legitimate interest in answering you; kept for 2 years.
- Marketing communications and newsletters — only with your explicit consent, which you can withdraw at any time from the link in every email; kept until you unsubscribe.
- Keeping the site working and secure — technical logs (IP address, browser, pages requested); legal basis: legitimate interest; kept for 30 days.
We do not profile you and we do not sell your data.
3. Who receives the data
Your data is shared only with the services needed to run the shop, each under a data-processing agreement: our payment providers (Stripe and PayPal), our couriers, the provider hosting the website, and our email service for order emails and, if you opted in, the newsletter. Where a provider stores data outside the EU it does so under the European Commission’s standard contractual clauses or an adequacy decision.
4. Cookies
What the site stores on your device, and why, is set out in the Cookie policy.
5. Data retention and your rights
Personal data are retained only for the period necessary to fulfil the purposes for which they were collected or to comply with legal obligations, as listed above. You may request access to, correction, deletion, portability or restriction of your personal data, or object to their processing, at any time by writing to [email protected]. We answer within one month. You may also lodge a complaint with the Garante per la protezione dei dati personali at garanteprivacy.it.
6. Security
The site runs over HTTPS, passwords are stored hashed, and card details never touch our servers. Access to order data is limited to the people who need it to fulfil orders.
7. Changes
We will update this notice when our practices change. Last updated September 2026.
