Privacy policy

Last updated: June 7, 2026

1. Data Controller

The Data Controller responsible for your personal data is:

ORMESINI1271 S.R.L. operates the online store Ormesini1271 (hereinafter "the Website"), including all related content, features, tools, products and services (hereinafter "the Services"). The Services are provided through the Shopify platform.

2. Personal Data We Collect

Depending on how you interact with the Services, we may collect the following categories of personal data:

• Identity and contact data: first name, last name, shipping and billing address, phone number, email address.
• Payment data: credit/debit card information, transaction details, payment method. Full payment card details are handled directly by our payment processor and are not stored on our servers.
• Account data: username, password, preferences and settings.
• Transaction data: products viewed, added to cart, purchased, returned or exchanged, order history.
• Communications data: information included in your communications with us, such as customer support inquiries.
• Device and browsing data: IP address, browser type, operating system, unique device identifiers, network connection information.
• Usage data: information about how you interact with the Services, pages visited, session duration, navigation paths.
• Survey data: responses to post-purchase surveys, including how you heard about us and order feedback.

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes and on the following legal bases under Article 6 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"):

a) Performance of a contract (Art. 6.1.b GDPR)

We use your data to: process and manage your orders, process payments, arrange shipping and delivery through our logistics partners, manage returns and refunds, create and manage your customer account, and provide customer support.

b) Consent (Art. 6.1.a GDPR)

With your explicit consent, we use your data to: send you marketing and promotional communications via email, SMS or postal mail, show you personalized advertising on our and other websites through marketing and profiling cookies, and activate non-essential analytics cookies.

You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

c) Legitimate interest (Art. 6.1.f GDPR)

Based on our legitimate interest, we use your data to: prevent fraud and ensure the security of the Services, improve and optimize the Services, analyze store performance, and defend our legal rights.

d) Legal obligation (Art. 6.1.c GDPR)

We process your data when necessary to comply with legal obligations, such as tax and accounting requirements under applicable law.

e) Nature of data provision

The provision of personal data for the purposes described in sections (a) and (d) above is necessary for the performance of the contract and to comply with legal obligations. Failure to provide such data will make it impossible to process your order or provide the requested Services. The provision of personal data for the purposes described in sections (b) and (c) above is voluntary. Refusal to provide such data will not affect the performance of the contract but may limit our ability to send you promotional communications or to personalize your experience.

f) Automated decision-making

We do not use automated decision-making processes, including profiling, that produce legal effects or similarly significant effects on you as defined under Article 22 of the GDPR.

4. Cookies and Tracking Technologies

The Website uses cookies and similar technologies. Cookies are small text files stored on your device when you visit the Website. Below you will find the categories of cookies used, along with a detailed table listing each cookie by name, provider, purpose and duration.

How to manage cookies: When you first visit the Website, a cookie banner will be displayed allowing you to accept or reject non-essential cookies. You can change your preferences at any time by clicking the cookie preferences link in the Website footer or through your browser settings.

Note: The cookie table above reflects the cookies identified on the Website at the time of the last update of this Privacy Policy. The actual cookies set may vary depending on your interactions with the Website and the tools in use. We recommend periodically reviewing your cookie preferences.

5. Data Recipients and Disclosure

Your personal data may be shared with the following categories of recipients:

• Shopify Inc. (Canada): e-commerce platform hosting the Website and processing payments. Shopify Privacy Policy.
• SendCloud B.V. (Netherlands): logistics platform used to manage shipments. Shared data includes name, shipping address, email, phone number and order details. SendCloud Privacy Policy.
• Klaviyo Inc. (USA): email marketing and automation platform. Shared data includes name, email address, purchase history and browsing data. Klaviyo Privacy Notice.
• Gorgias Inc. (USA): customer support platform. Shared data includes name, email address, order history and any information provided in support requests. Gorgias Privacy Policy.
• Microsoft Corporation (USA): for Microsoft Clarity analytics service (session recordings, heatmaps). Microsoft Privacy Statement.
• Google LLC (USA): for Google Analytics 4 and Google Ads services. Google Privacy Policy.
• Meta Platforms Ireland Ltd (Ireland): for the Meta Pixel service.
• TikTok Technology Limited (Ireland): for the TikTok Pixel service.
• Fairing Inc. (USA): post-purchase survey platform. Shared data may include order details and survey responses. Fairing Privacy Policy.
• LittleData Ltd (UK): server-side data integration platform that connects Shopify with Google Analytics 4, Google Ads, Meta Pixel, TikTok Pixel and Klaviyo. Shared data includes browsing, transaction and customer data as needed by each connected service. LittleData Privacy Policy.
• ThoughtMetric Inc. (USA): marketing attribution platform. Shared data includes order and traffic source information. ThoughtMetric Privacy Policy.
• Alhena AI (USA): AI-powered customer service tool. Shared data may include name, email and customer support interactions.
• Payment processors: for secure transaction processing.
• Carriers and logistics partners: for order delivery.
• Professional advisors: accountants, legal counsel, where necessary.
• Public authorities: when required by law.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). The transfer of your personal data to these providers is carried out on the basis of the following safeguards:

Provider	Country	Transfer mechanism
Google LLC	USA	EU-US Data Privacy Framework (adequacy decision of the European Commission, 10 July 2023)
Meta Platforms Inc.	USA	EU-US Data Privacy Framework
Microsoft Corporation	USA	EU-US Data Privacy Framework
Klaviyo Inc.	USA	EU-US Data Privacy Framework + Standard Contractual Clauses (SCCs)
Gorgias Inc.	USA	Standard Contractual Clauses (SCCs)
Fairing Inc.	USA	Standard Contractual Clauses (SCCs)
ThoughtMetric Inc.	USA	Standard Contractual Clauses (SCCs)
Alhena AI	USA	Standard Contractual Clauses (SCCs)
Shopify Inc.	Canada	Adequacy decision of the European Commission for Canada
LittleData Ltd	UK	Adequacy decision of the European Commission for the UK (28 June 2021)

You may request further information about the safeguards in place by contacting us at the address provided in the "Contact" section.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected:

• Order and transaction data: 10 years from the date of the transaction, in compliance with tax and accounting obligations under Italian law.
• Account data: for the duration of the contractual relationship and until the account is deleted, unless longer retention is required by law.
• Marketing data: until you withdraw your consent or, if no withdrawal occurs, for a maximum of 24 months from the last active interaction.
• Cookie data: according to the duration specified for each cookie in the table above. Session cookies are deleted when you close your browser.
• Fraud prevention and security data: for the time necessary to pursue such purposes.

8. Your Rights

As a data subject, under Articles 15–22 of the GDPR, you have the right to:

• Access (Art. 15): obtain confirmation of whether your personal data is being processed and access to such data.
• Rectification (Art. 16): obtain the correction of inaccurate personal data or the completion of incomplete data.
• Erasure (Art. 17): obtain the deletion of your personal data, in the circumstances provided by law.
• Restriction (Art. 18): obtain the restriction of processing in the circumstances provided by law.
• Portability (Art. 20): receive your personal data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Objection (Art. 21): object at any time to the processing of your personal data based on legitimate interest.
• Withdrawal of consent: withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, please contact us at customer@ormesini1271.com. We will respond to your request within 30 days, as required by applicable law.

For rights related to data processed directly by Shopify, please visit the Shopify Privacy Portal.

9. Complaints

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. For Italy, the competent authority is:

10. Children's Data

The Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us so that we can arrange for its deletion.

11. Third-Party Links

The Website may contain links to websites or online platforms operated by third parties. We are not responsible for the privacy practices of such websites. We encourage you to read their privacy policies before providing any personal data.

12. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. In the event of material changes, we will publish the updated version on the Website with a revised "Last updated" date. We encourage you to review this page periodically.

13. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, you may contact us: