PRIVACY POLICY

1. Data controller

1.1 The controller of the personal data collected through the website torrini1369.com (the "Site") is Torrini 1369 s.r.l., with registered office at Piazza del Duomo 12/R, 50122 Florence, Italy — VAT No. IT 06111170483, Florence Companies Register (REA FI-601401), certified email (PEC) torrini1369@pec.it (the "Maison" or the "Controller").

1.2 For any request regarding the processing of personal data or the exercise of the rights set out in Section 12, data subjects may contact the Maison at info@torrini1369.com or by phone at +39 055 2302401.

1.3 The Maison has not appointed a Data Protection Officer (DPO), as the legal conditions requiring one do not apply.

2. Categories of data processed

2.1 Data provided directly by the Client:

• identification and contact details: first name, last name, email address, phone number, shipping and billing address;
• order-related data: selected Creation, configuration, size or length, any engraving text;
• payment data: handled by the payment service providers listed in Section 4 — the Maison does not store complete payment card details;
• the content of communications with the Maison: email, live chat, WhatsApp, phone;
• optional data provided in the course of the relationship with the Maison: preferences, personal occasions (e.g., anniversaries), bespoke requests.

2.2 Third-party data contained in engravings. The engraving text chosen by the Client may contain third-party personal data (names, initials, dates). The Client warrants that such data is provided lawfully; the Maison processes it exclusively to make the Creation and document the order.

2.3 Data collected automatically during browsing: technical data (IP address, browser and device type, pages visited, source of the visit) collected through cookies and similar technologies, as described in Section 11.

2.4 The Maison does not request or intentionally process special categories of data (Article 9 GDPR). Data subjects are invited not to include data of this nature in their communications with the Maison.

3. Purposes and legal bases of processing

Purpose Legal basis (GDPR)Order management: conclusion and performance of the contract, making of the Creation, payment, shipping, order assistance Art. 6(1)(b) — performance of the contract Documentation of individual production specifications (including the size agreed via live chat or email)Art. 6(1)(b) and 6(1)(f) — performance of the contract and legitimate interest in establishing evidenceTax, accounting, and legal complianceArt. 6(1)(c) — legal obligationPre-sales assistance and responses to inquiries (email, live chat, WhatsApp, phone)Art. 6(1)(b) — pre-contractual measures at the data subject's request Newsletter and promotional communications Art. 6(1)(a) — consent, with double opt-in subscription Communications regarding an uncompleted order (cart recovery)Art. 6(1)(f) — legitimate interest. Relational after-sales communications (assistance, anniversaries) to existing clients, concerning the Maison's creations and services. Art. 6(1)(f) — legitimate interest (Art. 130(4) of the Italian Privacy Code). Statistical analysis of Site usage Consent to measurement cookies (see Section 11)Advertising activities through third-party platformsConsent to marketing cookies (see Section 11)Defense of the Maison's rights in judicial or extrajudicial proceedingsArt. 6(1)(f) — legitimate interest

3.2 The provision of the data necessary for order management is indispensable for the conclusion of the contract; the provision of data for marketing purposes is always optional and revocable.

4. Recipients of the data

4.1 Personal data is processed by the Maison's authorized personnel and communicated, within the limits of their respective functions, to the following categories of recipients, acting as processors or independent controllers according to their respective roles:

• E-commerce platform: Shopify Inc. (Site hosting, order and client management);
• Payment service providers: Mollie B.V. (payment cards), PayPal (Europe) S.à r.l. et Cie, S.C.A.; for bank transfers, the Maison's banking institution;
• Carrier: DHL Express, for the delivery of Creations (contact details and shipping address);
• Live chat: Chatra (Roger Wilco LLC), for chat assistance on the Site;
• Email marketing: Klaviyo, Inc. and Shopify Email, for sending the newsletter and the communications referred to in Section 3;
• Measurement and advertising tools: Google (Google Analytics 4, Google Ads, Google Fonts, Google Maps) and Meta Platforms (Meta pixel), according to the consents expressed through the cookie banner;
• Internal management system: the Maison's management software for the administration of orders and clientele;
• The Maison's advisors (accounting, tax, legal), where necessary;
• Competent authorities, in the cases provided for by law.

4.2 An updated list of processors is available upon request at info@torrini1369.com.

5. Transfers outside the EU

5.1 Some of the providers listed in Section 4 are based or operate servers in the United States or other third countries. In such cases, the transfer takes place on the basis of an adequacy decision of the European Commission — including, for participating U.S. providers, the EU-U.S. Data Privacy Framework — or of the standard contractual clauses (SCCs) adopted by the Commission, supplemented where necessary by additional measures.

5.2 A copy of the applicable safeguards may be requested at info@torrini1369.com.

6. Retention periods

Category of dataRetention periodData relating to orders, contracts, and accounting and tax documentation10 years from the conclusion of the contractConversations (live chat, email) linked to an order, including those documenting the size or other individual production specifications10 years, together with the order documentationPre-sales conversations not followed by an order24 months from the last contactData for newsletter and marketing purposesUntil withdrawal of consent or objection; periodic review of inactive contactsBrowsing data and cookiesAccording to the duration of each cookie and the consents expressed through the banner (see Section 11)Data necessary for legal defenseFor the duration of the dispute and the applicable limitation periods

6.2 Once the periods indicated have elapsed, the data is deleted or anonymized.

7. Newsletter and promotional communications

7.1 Newsletter subscription takes place with a double opt-in mechanism: the subscription is finalized only after confirmation via the link received at the address provided.

7.2 Data subjects may withdraw their consent at any time via the unsubscribe link included in every email or by writing to info@torrini1369.com, without prejudice to the lawfulness of the processing carried out before the withdrawal.

7.3 The Maison may send its clients communications concerning creations and services similar to those purchased, pursuant to Article 130(4) of the Italian Privacy Code; clients may object at any time using the same methods described in point 7.2.

8. Live chat

8.1 The Site offers a live chat service for pre- and after-sales assistance. Conversations are retained according to the terms of Section 6; those in which individual production specifications (in particular the size) are agreed are retained together with the order documentation, as evidence of the agreed specifications.

9. WhatsApp

9.1 Upon the Client's request or initiative, the Maison may use WhatsApp for communications relating to orders, inquiries, and assistance. The service is provided by WhatsApp Ireland Ltd. (Meta group), which processes data according to its own privacy notice. The Maison uses WhatsApp for individual communications and not for mass promotional mailings.

10. Reviews and Site features

10.1 The Site may integrate features provided by third-party applications (reviews, wish lists). The data processed through such features is described in the privacy notices of the respective providers.

11. Cookies and similar technologies

11.1 The Site uses cookies and similar technologies for its operation and, subject to consent, for personalization, measurement, and marketing purposes.

11.2 On the first visit, a consent management banner allows the user to accept or decline non-essential cookies, divided by category (necessary, personalization, measurement, marketing). Non-essential cookies are installed only with the user's prior consent, which may be modified or withdrawn at any time through the banner settings accessible from the Site.

11.3 Cookies strictly necessary for the operation of the Site (session management, cart, security) do not require consent and cannot be disabled.

12. Rights of the data subject

12.1 Data subjects may exercise at any time the rights provided for by Articles 15–22 GDPR: access to their data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest (including objection to marketing, which is always possible), and withdrawal of consent.

12.2 Requests may be addressed to info@torrini1369.com. The Maison responds within one month of receipt, extendable in the cases provided for by law.

12.3 Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of their country of habitual residence.

13. United States residents

13.1 For residents of California and other states that recognize similar rights, the Maison specifies that: (a) the categories of data collected and the purposes are those described in Sections 2 and 3; (b) the Maison does not sell personal data; (c) the use of third-party advertising tools (Google Ads, Meta) may constitute "sharing" of personal data for cross-context behavioral advertising purposes under California law (CCPA/CPRA).

13.2 Residents of the states concerned may exercise their right to opt out of sharing — in addition to their rights of access, deletion, and correction — by declining or withdrawing marketing cookies through the Site's banner, or by writing to info@torrini1369.com with the subject line "Privacy Request". The Maison does not discriminate against data subjects who exercise their rights.

14. Minors

14.1 The Site and its services are intended exclusively for adults. The Maison does not knowingly collect personal data from individuals under 18 years of age; should it become aware of such processing, it will delete the data.

15. Security

15.1 The Maison adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, disclosure, or alteration, relying on providers that guarantee security standards compliant with the GDPR. Transactions on the Site take place over an encrypted connection; complete payment card details are not stored by the Maison.

16. Amendments and versions

16.1 The Maison may amend this notice at any time. The version in force is the one published on the Site, with an indication of the version number and the date of the last update; previous versions are archived by the Maison.