Privacy notice

Here we explain which personal data we collect when you browse, buy or write to us, why we use it and what rights you have. It is the notice required by articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Last updated: Draft to be reviewed by a professional

Table of contents

Data controller

The data controller is the seller that runs this site:

Name
Viemylu
Company name
Ditta individuale
Registered office
Via Alcide de Gasperi 1, 88831 Scandale (KR)
VAT number
03938920794
Email
info@viemylu.com
Phone
+39 328 285 2041 / +39 392 302 3285

For any request about your data you can write to us at the email address shown above. We have not appointed a data protection officer (DPO), because the appointment is not mandatory for our activity.

Data we process

  • Identification and contact data: first name, surname, email address, phone number if you enter it.
  • Order data: products purchased, shipping and billing address, amounts, order status, communications about the order.
  • Payment data: payment is handled by Stripe and PayPal. We neither see nor store the full card number; we receive the outcome of the transaction and a transaction reference.
  • Newsletter subscription data: email address, language, date of the request and of the confirmation.
  • Content of requests: the data you enter in the contact form or in the emails you send us.
  • Technical browsing data: IP address, type of browser and device, date and time of requests, recorded in the server logs for the operation and security of the site.
  • Data saved on your device: cart, favourites, cookie choice and theme. They stay in your browser; we describe them in the cookie policy.

The data is provided to us directly by you. We do not collect data from third-party sources, except for the payment outcome and the delivery information that we receive from the providers listed below (article 14 GDPR).

  • Managing orders, payments, shipments, returns and warranty. Legal basis: performance of the contract or of pre-contractual measures requested by you (article 6(1)(b) GDPR).
  • Replying to your support requests. Legal basis: performance of pre-contractual measures or of the contract, or our legitimate interest in replying to those who write to us (article 6(1)(b) and (f)).
  • Complying with legal obligations, in particular accounting and tax, invoicing and consumer law. Legal basis: legal obligation (article 6(1)(c)).
  • Site security, prevention of fraud and abuse, protection of our rights including in court. Legal basis: legitimate interest (article 6(1)(f)), after assessing that your rights and freedoms do not override it.
  • Non-technical cookies and measurement tools. We do not use them today. If we activate them in the future, we will do so only with your consent (article 6(1)(a)), which you can withdraw at any time.
  • Sending you the newsletter, only if you subscribe. Legal basis: consent (article 6(1)(a)), which you confirm by clicking the link in the email we send you. You can withdraw it at any time with the unsubscribe link in every email.

The newsletter is optional and separate from the purchase: you receive promotional communications only if you subscribe and confirm your email address.

Recipients of the data

The data is processed by the controller and by authorised persons. It may also be disclosed to the following parties, who process it for the purposes indicated:

  • WooPayments (a service of Automattic that uses the infrastructure of Stripe Payments Europe Ltd, Ireland), for payments by card and linked digital wallets (Apple Pay, Google Pay).
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), for payments with PayPal.
  • The courier in charge of delivery, which receives name, address and contact details to deliver the parcel.
  • Vercel Inc., provider of the hosting and infrastructure on which the site runs.
  • Aruba S.p.A. (Italy), provider of the shop's hosting, which includes sending emails: order confirmations, replies to messages and the newsletter confirmation.
  • Tax, accounting and legal advisers, and public authorities when the law requires it.

Hosting and email act as processors, appointed under an agreement pursuant to article 28 GDPR. Stripe, PayPal and the courier normally process data also as independent controllers, for their own purposes (for example anti-fraud, legal obligations, carrying out the transport): for those processing operations their own notices apply. The data is neither disclosed nor sold.

Transfers outside the European Economic Area

Some providers, in particular Vercel and in part Stripe and PayPal, may process data in non-EU countries, including the United States. In these cases the transfer takes place only with adequate safeguards provided by the GDPR: an adequacy decision of the European Commission (EU-US Data Privacy Framework) for the companies that adhere to it, or standard contractual clauses approved by the Commission (articles 45 and 46 GDPR). You can ask us for a copy of the safeguards adopted by writing to us.

How long we keep the data

  • Order, invoice and payment data: 10 years from the date of the document, as provided by civil and tax law (article 2220 of the Italian Civil Code and tax provisions).
  • Support requests: for the time needed to handle them and, afterwards, up to 12 months from closure, unless needed to protect a right of ours. Messages sent through the contact form are deleted automatically after 12 months.
  • Newsletter: until you unsubscribe. Subscription requests that are not confirmed are deleted after 14 days.
  • Technical server logs: for the period set by the hosting provider, normally limited and in any case no longer than necessary for security.
  • Data in case of litigation: until the end of the litigation and of the appeal periods.
  • Data on your device: stays until you delete it from the browser.

Once the periods have expired, the data is deleted or made anonymous.

Your rights

At any time you can exercise the rights provided by articles 15-22 GDPR:

  • access to your data and a copy (article 15);
  • rectification of inaccurate data or completion of incomplete data (article 16);
  • erasure, in the cases provided (article 17);
  • restriction of processing (article 18);
  • portability of the data you provided, for processing based on contract or consent and carried out by automated means (article 20);
  • objection to processing based on legitimate interest (article 21);
  • withdrawal of consent, when the processing is based on it, without affecting the lawfulness of processing already carried out (article 7(3)).

To exercise them write to info@viemylu.com. We reply without undue delay and, as a rule, within one month of the request (article 12 GDPR). To protect your confidentiality we may ask you to verify your identity.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work, or to go to court.

Nature of the provision of data

To complete an order you must provide the data requested at checkout (name, address, email and the data needed for payment): without it we cannot handle the purchase, ship it or issue the tax documents. Providing data in the contact form is optional, but the marked fields are needed so that we can reply to you.

Automated decisions

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (article 22 GDPR). The anti-fraud checks of payment providers are carried out under their responsibility; if a payment is declined you can contact us to ask for a check.

Changes and contact

We may update this notice, for example if providers or purposes change. The date of the last update is shown at the top. For privacy questions write to info@viemylu.com or by post to Via Alcide de Gasperi 1, 88831 Scandale (KR).