1. Data controller
Alessandro Gherardeschi, with registered office at [indirizzo della sede — da completare], VAT number [P.IVA — da completare]. For any privacy matter write to privacy@gherardeschi.it.
2. Data we process
Identification and contact data (name, email, optional phone), protected credentials, shipping addresses, orders and their contents, payment status, communications and preferences, technical and security data (logs). Payment data is processed by Stripe: we only receive the outcome, never your card number. Signing in with Google, Apple or Telegram gives us the provider identifier, name and email when available. Garment photos uploaded in the reserved area serve catalogue production and are never published without your consent when they portray people.
3. Purposes and legal bases
Performance of the contract for account, bag, payment, delivery, returns and support; compliance with legal obligations for accounting and tax retention; legitimate interest for site security, fraud prevention and defence of rights; separate, revocable consent for marketing email and non-essential cookies.
4. Recipients and transfers
Data may be processed, when necessary, by appointed processors: hosting providers, Stripe for payments, couriers for delivery, transactional email providers, the social services used for sign-in, and the artificial-intelligence service that helps us produce the catalogue, to which the atelier's garment photos may be transferred and which is based outside the European Economic Area. Any transfer outside the European Economic Area relies on appropriate safeguards (adequacy decisions or standard contractual clauses).
5. Retention
Your account until you ask for its deletion; order, administrative and tax data for the applicable statutory terms; marketing email until consent is withdrawn; security logs for a period proportionate to their purpose. Once expired, data is deleted or anonymised.
6. Your rights
You may at any time request access, rectification, erasure, restriction and portability of your data, object to processing and withdraw consent without affecting prior processing. You may also lodge a complaint with the Italian data protection authority (Garante).
7. Which data is required
Fields marked as mandatory are needed to create the account and conclude the contract: without them ordering is not possible. The phone number is optional; marketing consent is optional and refusing it does not prevent purchases.
8. Security and minors
We adopt technical and organisational measures proportionate to the risk, including encrypted connections and restricted access roles. The service is not intentionally directed at minors under 16.