Privacy Policy

Data controller

FENS S.R.L.

Via Friuli 1, 06034 Foligno (PG), Italia

VAT number 03653330542 — Tax code 03653330542

Umbria Companies Register no. 03653330542 — REA PG-304659

Email: info@dirosetta.com — PEC: fens@pec.it

Categories of data processed

• Identification and contact data: first name, last name, email, shipping and billing address
• Order data: products purchased, amounts, order status, support correspondence
• Payment data: handled directly by the payment provider; we only receive the transaction outcome and the technical references needed for reconciliation, never the full card number
• Account data: credentials managed by the authentication provider, preferences, saved favourites
• Minimal technical data necessary for the operation and security of the site

Purposes and legal bases

• Account management — performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)
• Order management, shipping, returns and refunds — performance of the contract (Art. 6(1)(b))
• Payment processing — performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c))
• Customer support — performance of the contract (Art. 6(1)(b)) or legitimate interest in answering your requests (Art. 6(1)(f))
• Transactional emails strictly related to your order (confirmation, dispatch, payment outcome, password reset) — performance of the contract (Art. 6(1)(b)): these are not promotional messages and do not require consent
• Newsletter and promotional communications — solely on the basis of your freely given, revocable consent (Art. 6(1)(a))
• Administrative, accounting and tax obligations — legal obligation (Art. 6(1)(c))
• Site security and prevention of fraud and abuse — legitimate interest (Art. 6(1)(f))

Service emails and newsletter

We draw a clear distinction between two types of message. Emails necessary to perform your order (order confirmation, dispatch notice, payment outcome, return-related and account messages) are sent because they are essential to the contractual relationship. Marketing communications and the newsletter are sent only if you have given specific consent, which you may withdraw at any time via the unsubscribe link in every message or by writing to info@dirosetta.com.

Product availability alerts

When a piece is temporarily out of stock you can ask us to let you know when it returns. In that case we process your email address, your chosen language and the reference to the product or variant you asked about, together with the date of your request and the delivery outcome. The purpose is solely to send you one confirmation email and, once the piece becomes available again, the availability alert; the legal basis is your specific consent (Art. 6(1)(a)).

This request is separate from the newsletter: leaving your email for an availability alert does not sign you up to any promotional communication and does not change any consent you may have already given. You can cancel the request at any time via the link in the confirmation email, with no account needed, or by writing to info@dirosetta.com. We keep the data until the alert is sent or the request is cancelled, then retain only the technical trace needed to avoid repeated sends.

Recipients and processors

• Lovable Cloud / Supabase — hosting of the application, database, authentication and file storage
• Stripe — payment processing and related technical communications; Stripe acts as an independent controller for its own anti-fraud and regulatory obligations
• Brevo — delivery of transactional emails and, subject to consent, of the newsletter
• Sendcloud — platform used to prepare shipments and generate shipping labels
• Carriers and logistics operators — only the data needed for delivery
• Accounting and tax advisers and, where required, competent authorities, within the limits set by law

We use no providers other than those listed and we neither sell nor transfer your data to third parties for commercial purposes.

International transfers

Data is processed mainly within the European Economic Area. Some providers may also process data outside the European Union through their affiliates: in that case the transfer relies on a European Commission adequacy decision or on Standard Contractual Clauses, together with the supplementary measures adopted by the provider. You may request further details at info@dirosetta.com.

Retention periods

• Account data: for as long as the account exists; on deletion, data is removed or anonymised except where retention is required by law
• Accounting records and order documents: for the period required by Italian tax law, namely 10 years
• Newsletter data: until consent is withdrawn, after which we keep only what is needed to honour the unsubscribe request
• Support requests: support request data are kept for as long as necessary to handle the request and, afterwards, for the period reasonably necessary to protect the controller's rights and manage any disputes, unless a longer retention period is required by law
• Technical and security logs: technical and security logs are kept for the period strictly necessary to ensure the security, integrity and proper functioning of the services and, where necessary, to establish or defend legal rights, subject to any legal obligations

Provision of data

Providing the data needed to fulfil your order is mandatory: without it we cannot conclude or perform the contract. Providing data for the newsletter is optional, and declining has no effect on your purchase.

Site measurement and marketing

If you switch them on from the cookie banner, we use measurement tools and, where you agree, marketing tools, loaded solely through Google Tag Manager (Google Ireland Limited). The legal basis is your consent (Art. 6.1.a GDPR), which you can withdraw any time from the "Cookie preferences" link in the footer. We send these tools only browsing and order data (pages viewed, products consulted, order reference, amount and items): never your name, email, address or phone number. Your consent choice stays on your device for twelve months. Full detail lives in the Cookie Policy.

Automated decision-making

We carry out no profiling and no solely automated decisions producing legal effects concerning you. Anti-fraud checks performed by the payment provider serve transaction security.

Your rights

You may at any time exercise the rights under Articles 15–22 GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent, without affecting the lawfulness of prior processing.

To exercise them, write to info@dirosetta.com: we reply within one month, extendable in the cases allowed by the Regulation. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the supervisory authority of your country of residence.

Updates

This notice may be updated to reflect changes to our services or to the law. Updated versions are published on this page.