Privacy policy
- en they collect or process personal data on our behalf.
- From our partners or third parties, for example payment networks or couriers.
5. Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing your order: payment, fulfilment, shipping, returns, refunds, after-sales support, creating and managing your account | Performance of a contract — Art. 6(1)(b) GDPR |
| Issuing and retaining invoices and tax records, complying with consumer protection obligations | Legal obligation — Art. 6(1)(c) GDPR |
| Sending you our newsletter and promotional communications; setting analytics, marketing and personalisation cookies; publishing your review together with your name | Your consent — Art. 6(1)(a) GDPR (withdrawable at any time) |
| Sending our customers offers on products similar to those they have already purchased | Legitimate interest / Article 130(4) of the Italian Privacy Code, with the right to object always available |
| Keeping the site secure, preventing fraud and unlawful use, establishing or defending legal claims | Legitimate interest — Art. 6(1)(f) GDPR |
Providing the data marked as mandatory during checkout is necessary in order to enter into the contract: without it we cannot fulfil your order. Providing data for marketing purposes is optional, and refusing has no effect whatsoever on your purchase.
6. How long we keep the data
| Type of data | Retention period |
|---|---|
| Order data, invoices and accounting records | 10 years from registration (Article 2220 of the Italian Civil Code and tax legislation) |
| Customer account | For as long as the account remains active; deleted upon your request |
| Newsletter subscription | Until consent is withdrawn or you unsubscribe; we then keep proof of your consent for as long as needed to demonstrate its lawfulness |
| Emails and support requests | 24 months from closure of the request, unless a dispute is pending |
| Data relating to the legal guarantee and right of withdrawal | 24 months from delivery, plus any applicable limitation periods |
| Cookies and browsing data | As set out in the table in section 13 |
7. Who we share your data with
We disclose your personal data only to parties who genuinely need it, and only for the purposes described above:
- Shopify (Shopify International Ltd., Ireland), which hosts the store and provides the underlying technology.
- Payment service providers: Shopify Payments (Shopify International Ltd.) for card, Apple Pay and Google Pay payments; PayPal (Europe) S.à r.l. et Cie, S.C.A. for PayPal payments. These parties process payment data as independent controllers, under their own privacy policies.
- The courier handling delivery (currently GLS), to whom we pass your name, address, email and telephone number so that the shipment and tracking notifications can be carried out.
- Our email service provider (Shopify Email), for transactional messages and the newsletter.
- The analytics and advertising providers listed in section 13.
- Consultants, accountants and professional advisers who assist us in accounting, tax and legal matters.
- Public authorities and judicial bodies, where disclosure is required by law or necessary to establish or defend a legal claim.
- In the event of a corporate transaction (merger, sale of business, insolvency proceedings), the acquiring party, which will remain bound by this policy.
We do not sell your personal data to third parties.
8. Our relationship with Shopify
The Services are provided through Shopify, which collects and processes personal data relating to your access to and use of the Services in order to provide and improve them. The data you submit to the Services may therefore be transmitted to Shopify and to third parties that may be located in countries other than your own.
We also use certain advanced Shopify features that incorporate data derived from your interactions with our store, with other merchants and with Shopify itself. For these specific purposes Shopify acts as an independent data controller, including in respect of requests to exercise your rights. You can consult the Shopify Consumer Privacy Policy and exercise your rights towards Shopify through the Shopify Privacy Portal.
9. Transfers outside the European Union
Some of the providers listed above (in particular Google, Microsoft, Meta and Shopify) may also process data in the United States or in other countries outside the EEA.
Such transfers take place in compliance with the safeguards set out in Chapter V of the GDPR: the providers' certification under the EU-U.S. Data Privacy Framework and/or the adoption of the Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional measures. You may request a copy of the safeguards in place by writing to info@essenzadipisa.com.
10. Data security
We apply appropriate technical and organisational measures to protect your data: an encrypted connection (HTTPS) across the whole site, access restricted to authorised personnel, and providers selected on the basis of the safeguards they offer.
No security measure is perfect or impenetrable, however, and we cannot guarantee absolute security. We recommend that you use a strong password, that you never share your credentials with anyone, and that you do not send us confidential information through insecure channels.
11. Your rights
You may exercise the rights granted by Articles 15 to 22 GDPR at any time:
- access to the personal data concerning you;
- rectification of inaccurate or incomplete data;
- erasure of your data, in the cases provided for by law;
- restriction of processing;
- data portability, that is, receiving your data in a structured, commonly used and machine-readable format and asking us to transmit it to another controller;
- objection to processing based on legitimate interest, and in any event to direct marketing;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise them, write to info@essenzadipisa.com. We will reply within one month of your request; this period may be extended by a further two months for particularly complex requests, in which case we will inform you. Before acting on a request we may need to verify your identity.
You can unsubscribe from promotional communications at any time using the link at the bottom of every email. Even after unsubscribing, you will continue to receive non-promotional messages such as order confirmations and shipping notifications.
Complaints. If you believe that the processing of your data infringes data protection law, you have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country in which you reside (list of EEA authorities). Before doing so, you are welcome to write to us: we try to resolve every issue directly.
12. Children's data
The Services are not intended for persons under 18 years of age, and we do not knowingly collect the personal data of minors. In Italy, consent to processing in relation to information society services is valid from the age of 14 (Article 2-quinquies of Legislative Decree No. 196/2003); below that age, the consent of the holder of parental responsibility is required.
If you are the parent or guardian of a minor who has provided us with their personal data, please write to info@essenzadipisa.com and we will delete it.
13. Cookies and tracking technologies
What they are
The site uses cookies and similar technologies (pixels, web beacons, local storage). Cookies are small text files stored on your device that allow us to operate the site, remember your preferences, measure usage and — only with your consent — offer you relevant content and advertising.
Categories of cookies we use
- Necessary cookies — always active, no consent required. They make the site work (cart, session, security, login). They are managed by Shopify, the platform the site is built on.
- Analytics/statistics cookies — set only with your consent. They help us understand how visitors use the site (pages viewed, navigation path, drop-off points) so that we can improve it.
- Marketing/advertising cookies — set only with your consent. They measure the effectiveness of our campaigns and allow relevant ads to be shown to you on other websites.
- Personalisation cookies — set only with your consent. They store your choices in order to personalise your future visits.
Third-party providers
| Provider | Purpose | Privacy policy |
|---|---|---|
| Google Analytics 4 — Google Ireland Ltd. / Google LLC | Usage statistics and aggregated analysis of browsing behaviour | policies.google.com/privacy |
| Google Ads and Google Shopping — Google Ireland Ltd. / Google LLC | Conversion measurement, remarketing and advertising | policies.google.com/privacy |
| Meta Pixel — Meta Platforms Ireland Ltd. | Conversion measurement and personalised advertising on Facebook and Instagram | facebook.com/privacy/policy |
| Microsoft Clarity — Microsoft Ireland Operations Ltd. | Heatmaps and anonymised session recordings used to analyse site usability | privacy.microsoft.com/privacystatement |
| Shopify — Shopify International Ltd. | Store operation, cart, checkout and security | shopify.com/legal/privacy |
| PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A. | Processing of PayPal payments | paypal.com/webapps/mpp/ua/privacy-full |
Main cookies used
The list below is indicative and representative; names and durations may change over time.
| Cookie | Provider | Category | Duration |
|---|---|---|---|
_ga |
Google Analytics | Statistics | ~2 years |
_ga_XXXXXXXXXX |
Google Analytics | Statistics (session state) | ~2 years |
_gcl_au |
Google Ads | Conversion measurement | ~90 days |
IDE |
Google (DoubleClick) | Advertising / remarketing | ~13 months |
_fbp |
Meta | Advertising / remarketing | ~3 months |
fr |
Meta | Advertising | ~3 months |
_clck |
Microsoft Clarity | Behavioural analytics | ~1 year |
_clsk |
Microsoft Clarity | Behavioural analytics | ~1 day |
CLID |
Microsoft Clarity | Behavioural analytics | ~1 year |
MUID |
Microsoft | Analytics / advertising | ~13 months |
cart, _shopify_s, _shopify_y, secure_session_id
|
Shopify | Necessary — site operation | Always active |
Consent and managing your preferences
Non-necessary cookies are only set after we have obtained your consent through the banner shown on your first visit. You can accept or refuse each category individually, and change or withdraw your choices at any time through the "Cookie preferences" link available on the site. Refusing non-necessary cookies does not prevent you from browsing or making a purchase.
You can also manage or delete cookies already stored through your browser settings.
14. Third-party websites and links
The Services may contain links to websites or platforms operated by third parties. If you follow them, their privacy policies and terms will apply: we neither control nor are responsible for the privacy, security or accuracy of the information on those sites.
Information you publish in public or semi-public contexts, including anything you share on third-party social platforms, may be seen by other users. The presence of a link does not imply any endorsement by us of the linked content.
15. Changes to this policy
We will update this policy from time to time, to reflect changes in our practices or for other operational, legal or regulatory reasons. We will publish the updated version on the site and change the "Last updated" date at the top of the page and, where the law requires it, we will notify you.
16. Contact
For any question about this policy or to exercise your rights:
INTERCOM S.R.L. — Via Genova 27, Calcinaia (PI), Italy — VAT no. IT 01774810509
Telephone: +39 347 373 4434 — Email: info@essenzadipisa.com
This is a translation of the Italian "Informativa sulla privacy" provided for the convenience of English-speaking customers. In the event of any discrepancy, the Italian version prevails.
