Privacy policy
Last updated: 19 July 2026
1. Data controller
The data controller is [COMPANY DETAILS — to be completed] (company name, registered office, VAT number, contact details) — "ROMANTICO", "we". For any privacy request, contact us through the contact form or by post at the registered office.
This policy applies to the processing of personal data of visitors and customers of this website, in accordance with Regulation (EU) 2016/679 ("GDPR") and, for UK residents, the UK GDPR and Data Protection Act 2018.
2. What we process, why, and on what legal basis
| Processing | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Order management and delivery | Identity, shipping/billing address, email, phone (optional), order details | Art. 6(1)(b) — performance of a contract | Duration of the contract, then as per fiscal retention below |
| Invoicing and tax obligations | Billing data, transaction records | Art. 6(1)(c) — legal obligation | 10 years (Italian civil and tax law) |
| Newsletter | Email address | Art. 6(1)(a) — consent (double opt-in); for existing customers, the soft opt-in regime for similar products (Art. 130(4) Italian Privacy Code), with opt-out in every message | Until consent is withdrawn / opt-out |
| Analytics (GA4, Shopify Analytics) | Pseudonymised usage data, device data | Art. 6(1)(a) — consent (cookie banner; Consent Mode v2) | Up to 14 months |
| Fraud prevention and security | Order, payment and technical data | Art. 6(1)(f) — legitimate interest in preventing fraud | As strictly necessary |
| Customer service | Contact form data, correspondence | Art. 6(1)(b) — pre-contractual/contractual measures | Time needed to handle the request |
| Restock notifications ("Notify me") | Email address, product of interest | Art. 6(1)(a) — consent | Until notification is sent or consent withdrawn |
Providing the data marked as required at checkout is necessary to conclude the purchase; without it, we cannot process the order.
3. Recipients
Your data may be shared, to the extent necessary, with: Shopify (e-commerce platform and hosting); payment providers (Shopify Payments, PayPal, Klarna — each acting as autonomous controller for payment data); couriers for delivery; Google (analytics, subject to your consent); professional advisers and authorities where required by law. We do not sell personal data.
4. International transfers
Some providers (e.g. Shopify, Google, PayPal) may process data outside the EEA. Transfers are protected by adequacy decisions (including the EU–US Data Privacy Framework, for certified providers) and/or Standard Contractual Clauses (SCCs), with supplementary measures where needed.
5. Retention
We keep personal data only as long as necessary for the purposes above: fiscal and accounting data for 10 years; marketing data until you withdraw consent or object; analytics data up to 14 months; other data for the time strictly necessary to the purpose.
6. Your rights
Under Articles 15–22 GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting prior processing). To exercise your rights, contact us through the contact form.
You also have the right to lodge a complaint with the supervisory authority: in Italy, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it); in the UK, the Information Commissioner's Office (ICO) (www.ico.org.uk).
7. Cookies
For information on cookies and similar technologies, and to change your preferences at any time, see the Cookie Policy and the "Cookie preferences" link in the footer.
8. Changes
We may update this policy; the date above reflects the latest version. Substantial changes will be highlighted on the Site.