Legal information
Privacy policy
Last updated: [DATA]
This policy explains how Furlova processes your personal data when you visit the website, buy a piece, write to us, request a valuation or join the Sunday Drop list, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.
1. Data controller
[NOME E COGNOME], sole trader “Furlova”, [INDIRIZZO], VAT number [PARTITA IVA], email [EMAIL], certified email (PEC) [PEC]. No Data Protection Officer has been appointed, as one is not required.
2. What data we process
- Orders and account: name, shipping and billing addresses, email, phone, tax code or VAT number where applicable, order history, account credentials if you create an account.
- Payments: transaction outcome and references. Card details are processed directly by the payment providers and never reach us.
- Concierge: name, email, phone, country, preferred contact channel, the content of your message and the piece you’re interested in.
- Valuation and consignment: name, contact details, country, information about the piece, its story and your expected price, and the photographs you send. Please photograph only the garment, avoiding faces and details of your home; if photos show other people, you confirm you have their consent. For consignment we also process the data needed for the contract and payment (e.g. IBAN).
- Sunday Drop list and newsletter: email address and language.
- Browsing data: IP address, date and time of requests and browser type, recorded in the server’s technical logs, and the technical cookies described in the cookie policy.
3. Why we process them, and on what basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing orders, payments, shipping, returns and guarantee claims | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and up to 10 years for tax and civil-law obligations |
| Tax and accounting obligations | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 2220 Italian Civil Code) |
| Replying to Concierge requests, reservations, video-call try-ons | Pre-contractual steps at your request (Art. 6(1)(b)) | Up to 24 months from last contact, unless an order follows |
| Valuing a piece and managing purchase or consignment | Pre-contractual steps and performance of a contract (Art. 6(1)(b)) | Photos and data from valuations not taken further: 12 months. Where an agreement is signed: 10 years |
| Sending the Sunday Drop preview and newsletter | Consent (Art. 6(1)(a)), which you may withdraw at any time | Until you unsubscribe |
| Website security, fraud and abuse prevention, protection of our rights | Legitimate interest (Art. 6(1)(f)) | Technical logs: per the hosting provider’s settings; data for disputes: as long as necessary |
Providing the data requested for orders and enquiries is necessary: without it we cannot proceed. Joining the list is optional.
4. Who we share them with
Data are processed by the controller and, on the controller’s behalf, by providers acting as processors (Art. 28 GDPR) or, where applicable, as independent controllers:
- Hosting: Hostinger (website servers and databases);
- Payments: the payment providers chosen at checkout (e.g. PayPal, card networks, bank), acting as independent controllers;
- Shipping: the couriers handling delivery or collection, who receive your name, address and phone number;
- Internal notifications: Telegram, used to alert the controller’s phone to new enquiries, with a summary of the data entered in the forms;
- Email: our email provider [NOME FORNITORE EMAIL] and, if enabled, newsletter provider [NOME FORNITORE NEWSLETTER];
- Advisers: our accountant and any legal advisers, for legal obligations;
- Authorities: where required by law.
We never sell or hand over your data to third parties for marketing purposes.
5. Transfers outside the European Union
Some providers (for example Telegram and certain payment or email providers) may process data outside the European Economic Area. In such cases the transfer relies on a European Commission adequacy decision or on Standard Contractual Clauses (Art. 46 GDPR). [To be checked for each provider.]
6. Your rights
At any time you may request access to your data, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interest, and withdraw consent without affecting the lawfulness of earlier processing (Arts. 15–22 GDPR). Write to [EMAIL]: we reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority in the country where you live or work.
7. Automated decisions and minors
We make no decisions based solely on automated processing, and we do no profiling. The website is not intended for anyone under 18.
8. Security and changes
We use appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS) and restricted access to the admin area. This policy may be updated; the current version is always published on this page.