Privacy Policy

PRIVACY POLICY

Pursuant to Article 13 of EU Regulation 2016/679 (GDPR)

This Privacy Policy describes how we collect, use, and protect the personal data of users who browse our website, make purchases online, or subscribe to our newsletter.

1. Data Controller

The Data Controller is CALREF Srl, with registered office at Via Ambrosoli 8/b – 20053 Rodano (Milan) – Italy, VAT No./Tax Code 08209930968.

  • Contact email: info@calref.eu

2. Type of Data Collected

The website collects the following personal data, directly from the user or through automated systems:

  • Purchase and billing data: Name, surname, shipping address, billing address, telephone number, tax code, or VAT No.
  • Payment data:  Credit card or PayPal account details are not stored on our server, but are managed directly by secure payment gateways (e.g., Stripe, PayPal).
  • Newsletter data: Email address, name (if required).
  • Browsing and technical data: IP address, tracking data, and cookies (e.g., abandoned cart, pages viewed).

3. Purpose and Legal Basis of Processing

The data is processed for the following purposes:

  • Order management and purchase fulfillment: Order processing, product shipping, returns management, and customer support.
    • Legal basis: Performance of a contract to which the user is a party (Article 6.1.b GDPR).
  • Tax and legal obligations: Issuing invoices and compliance with Italian accounting and tax regulations.
    • Legal basis: Legal obligation to which the Data Controller is subject (Article 6.1.c GDPR).
  • Commercial information via Newsletter: Sending promotions, discounts, news, and marketing communications.
    • Legal basis: Explicit user consent (Article 6.1.a GDPR), revocable at any time.
  • Abandoned cart recovery: Sending email reminders if the user abandons a purchase halfway through (if enabled on your e-commerce site).
    • Legal basis: Legitimate interest of the Data Controller in optimizing sales (Article 6.1.f GDPR).

4. Sharing Data with Third Parties (Recipients)

In order to complete purchases and send newsletters, the data will be shared exclusively with qualified technical partners, appointed as Data Processors:

  • Shipping and logistics companies: Express couriers (e.g., GLS, DHL, BRT, Poste Italiane) for the physical delivery of products.
  • Payment service providers: Platforms that guarantee transaction security (e.g., Stripe, PayPal, Shopify Payments).
  • Email Marketing Providers: Newsletter sending platforms (e.g., Mailchimp, Brevo/Sendinblue, Klaviyo).
  • Tax Advisors: Accounting firms for corporate accounting.

5. Transfer of Data Outside the EU

Some of the above-mentioned providers (e.g., Mailchimp or Stripe) may transfer data to the United States. This transfer occurs exclusively in accordance with the Data Privacy Framewor or through the adoption of the Standard Contractual Clauses approved by the European Commission, ensuring an adequate level of protection.

6. Data Retention Period

The data will be retained according to the following time criteria:

  • Purchase and billing data: Retained for 10 years, as required by Italian tax and civil regulations. 10 anni, come richiesto dalle normative fiscali e civili italiane.
  • Newsletter data: Retained until the user requests to unsubscribe (which can be done at any time via the link at the bottom of each email).

7. Rights of the Data Subject

In accordance with the GDPR, you have the right at any time to:

  1. Access your data and request a copy.
  2. Request the correction of inaccurate data or the completion of incomplete data.
  3. Request the deletion of your data (unless otherwise required by law for 10 years of tax retention).
  4. Revoke your consent to the newsletter at any time, without any impact on your purchases.
  5. File a complaint with the Italian Data Protection Authority.

To exercise your rights, please send an email to: info@calref.eu.

8. Updates

This policy is updated as of September 4, 2026.

Privacy Policy Powered by CalRef Srl