Privacy notice

1. Data controller

For any privacy question you can write to info@stylesport2.it. We have not appointed a Data Protection Officer (DPO) because it is not mandatory for our activity: we answer directly.

2. What data we collect

• Order data: first name and surname, email, telephone, delivery address, country, notes, products purchased, amounts, chosen payment method and any invoicing details.
• Account data (if you create one): name, email, saved addresses and order history. The password is stored only in an irreversibly encrypted (hashed) form: not even we can read it.
• Payment data: we do not receive or store card details, which are handled entirely by PayPal. PayPal only tells us the outcome and the transaction code. For bank transfers, we receive from the bank the details of the person making the transfer.
• Messages and bookings: name, email, telephone and the content of what you write to us via the contact form, an appointment booking, a withdrawal request or by email.
• Technical browsing data: IP address, date and time, pages requested, browser type. These are needed for the website to work and stay secure and are not used to identify you, except to investigate abuse or offences.

We do not ask for special categories of data (health, opinions, etc.): please do not enter them in notes or messages.

3. Why we use it and on what legal basis

No marketing: we currently do not send newsletters or promotional messages. If we do so in the future, we will first ask for your specific consent, which you can always withdraw.

We do not take decisions based solely on automated processing and we do not carry out profiling.

Data marked as mandatory in the forms are needed to fulfil the order or answer the request: without them we cannot do so.

4. How we protect your data

We adopt appropriate technical and organisational measures (art. 32 GDPR) to protect data against unauthorised access, loss or alteration:

• Encrypted connection (HTTPS) across the whole website: the data you enter travel protected.
• Payments handled by PayPal, certified to the PCI DSS card security standard: card details never pass through our systems.
• Account passwords encrypted with an irreversible algorithm (bcrypt).
• Servers in the European Union (IONOS data centre in Germany), with restricted administrative access protected by cryptographic keys.
• Access to data restricted to the controller and authorised shop staff, only to the extent needed for their work.
• Encrypted backup copies, so that data can be recovered in the event of a failure.
• Limits on login attempts and anti-abuse checks on the website's forms.

No system is 100% secure. In the event of a personal data breach that may pose a risk to you, we will notify the Italian Data Protection Authority (Garante) within 72 hours and, if the risk is high, inform you directly (arts. 33-34 GDPR).

5. Who we share data with

Data are processed by us and shared only with those we need in order to provide the service:

• Couriers (for example BRT, DHL, Poste Italiane): name, address, telephone and email for delivery and shipping notifications.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), for payments: it processes data as an independent controller under its own privacy notice.
• Banks, for bank transfers and refunds.
• Technical providers that process data on our behalf as processors (art. 28 GDPR): IONOS SE (website servers, Germany), Aruba S.p.A. (email, Italy) and Openapi S.p.A. (sending and receiving electronic invoices through the Italian Exchange System / SDI, Italy).
• Accountant and advisers, for tax and accounting obligations; Agenzia delle Entrate / Sistema di Interscambio (Italian Revenue Agency / e-invoicing exchange system) for electronic invoices.
• Public and judicial authorities, only where required by law.

Data are not sold, transferred or disclosed to the public.

6. Transfers outside the European Union

We store data on servers in the European Union. Some external services that you choose to use (PayPal and, if you consent, Google Maps) may transfer data to the United States: they do so on the basis of the EU-US adequacy decision (EU-US Data Privacy Framework) or the standard contractual clauses approved by the European Commission, as stated in their privacy notices.

7. How long we keep it

• Orders, invoices and accounting documents: 10 years, as required by law (art. 2220 of the Italian Civil Code and tax rules).
• Customer account: for as long as it remains active; if you ask us to delete it we will do so, keeping only what the law requires us to retain (for example the data of invoiced orders).
• Messages and bookings: for the time needed to handle the request and, in any case, no longer than 24 months.
• Withdrawal, return and guarantee requests: together with the documents of the order they relate to.
• Technical browsing data (server logs): for a limited period, normally no longer than 12 months, unless they are needed to investigate abuse.

8. Your rights

At any time you can ask us, free of charge, for:

• access to your data and a copy of it (art. 15);
• rectification of inaccurate data (art. 16);
• erasure (art. 17), except for data the law requires us to keep;
• restriction of processing (art. 18);
• portability of the data you provided to us, in a readable format (art. 20);
• to object to processing based on our legitimate interest (art. 21);
• to withdraw your consent at any time, without affecting processing already carried out (for external content: «Cookies» button at the bottom left).

To exercise them, write to info@stylesport2.it or to the PEC address stylesport2@pec.it: we reply within one month. We may ask you for some information to verify your identity. If you have an account, you can also correct your data from the «My account» section.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live.

9. Cookies

The website uses only the technical tools needed for it to work; external content (Google map, PayPal instalment messages) is loaded only with your consent. Full details are in the Cookie policy.

10. Minors

The website is intended for adults. Anyone under 18 must not place orders or send us data without a parent or guardian.

11. Changes

We may update this notice, for example if the law or the website's services change. The updated version is always published here, with the date at the top; in the event of significant changes we will point this out on the website.