Privacy policy

1. Who processes your data

The data controller is TALA Società a Responsabilità Limitata Semplificata, registered office at Via del Parione 52R, 50123 Firenze (FI), Italia, VAT number 07570950480.

To exercise your rights or ask anything about this notice write to info@via925firenze.com. The company’s certified email address is talasrls1@pec-amministratore.it.

We have not appointed a Data Protection Officer: we do not fall within the cases where article 37 GDPR makes one mandatory.

2. What data we collect

When you create an account: first name, last name, email address, password (stored encrypted, unreadable even to us).

When you place an order: shipping and billing address, phone number, order contents, amount, payment status.

When you pay: no card data at all. Card numbers are entered in a secure frame belonging to Stripe or SumUp and go straight to them: they never pass through our servers and we do not see them. We only receive the payment outcome and a transaction code.

When you browse: IP address, browser and device type, pages visited. These keep the site working and protect it from abuse.

If you subscribe to the newsletter or notifications: your email address, or the technical identifier your browser assigns to your device to receive push notifications. That identifier does not contain your name and does not let us know who you are.

If you write to us: what you write, and the address to reply to.

If you use the live chat: the name and email address you enter, the messages you write, the page of the site you write from, the date and time of the messages and, if you choose to leave one, your rating and comment about the operator who helped you. If you are signed in, the conversation is linked to your account. Your browser only keeps a code that lets you find the conversation again when you change page: it contains neither your name nor your email.

3. Why we process it, and on what legal basis

To sell you what you ordered — managing the account, taking the order, collecting payment, shipping, answering support, handling returns and warranty. Legal basis: performance of the contract (art. 6.1.b GDPR). Without this data the order cannot happen.

To comply with the law — issuing and keeping invoices and tax documents. Legal basis: legal obligation (art. 6.1.c GDPR).

To protect the site — spotting unauthorised access attempts, limiting form abuse, keeping technical logs. Legal basis: legitimate interest in security (art. 6.1.f GDPR).

To understand how the site is used — visit statistics through Google Analytics. Legal basis: your consent (art. 6.1.a GDPR), collected through the banner and changeable at any time. If you do not give it, those statistics never start.

To answer your questions in the live chat — in a chat with a member of our store or, if nobody is online at that moment, by email to the address you left us. Legal basis: your request, before or during a purchase (art. 6.1.b GDPR). Rating the operator is optional: we use it to improve our service, on the basis of our legitimate interest (art. 6.1.f GDPR). Conversations are read only by the store staff who answer in the chat and by the administrator.

To send you newsletters and notifications — only if you signed up. Legal basis: your consent, revocable at any time with one click at the bottom of every email or by turning notifications off in your browser. To understand which newsletters interest you we count opens and clicks, and if you buy on the site within 12 months of a click the order is linked to the newsletter you came from. To do this we remember your last click on your account (if you are signed in) and, only if you accepted statistics cookies, in a cookie for 12 months. We use this only for statistics on our own campaigns, not to profile you, and we share it with no one.

4. Who else sees your data

We do not sell your data and we do not pass it to anyone for commercial purposes. We share it only with those we need in order to get your order to you, and each of them processes the data on our behalf as a processor (art. 28 GDPR):

• Stripe Payments Europe, Ltd. and SumUp Limited — to collect payments.
• The hosting provider — where the site and the database run.
• The email service — to deliver confirmation, verification and password reset messages.
• The courier — to whom we give your name, address and phone number so the parcel reaches you.
• Google Ireland Ltd. — for visit statistics, only if you gave consent.
• Our accountant — for tax obligations.

Data may be disclosed to the authorities where the law requires it.

5. Transfers outside the European Union

Some of the providers listed above belong to groups headquartered in the United States and may process data there too. Transfers take place on the basis of the standard contractual clauses approved by the European Commission and, where applicable, adherence to the EU-US Data Privacy Framework.

If you want a copy of the safeguards applied, ask at info@via925firenze.com.

6. How long we keep it

• Account data: as long as you keep the account open. If you close it, we delete the data — except what we are obliged to keep.
• Orders, invoices and tax documents: 10 years, as the law requires.
• Technical and security logs: 12 months at most.
• Newsletter and notification sign-ups: until you unsubscribe.
• Support messages: as long as needed to close the matter, and in any case no more than 24 months.
• Live chat conversations and messages left: 24 months from the last message, then they are deleted automatically. If you ask us, we delete them sooner.
• Visit statistics: 14 months.
• Last click from a newsletter: 12 months, then it is deleted.

7. Your rights

At any time you can ask us to:

• access the data we hold about you and get a copy;
• correct it, if it is wrong or incomplete;
• erase it, when there is no longer a reason to keep it;
• restrict processing, while we check a complaint of yours;
• take it elsewhere, in a machine-readable format;
• object to processing based on legitimate interest;
• withdraw consent where that is the basis — without affecting what was done before.

Write to info@via925firenze.com: we answer within one month. Some of these you can do yourself from your private area on the site.

If you believe we are handling your data improperly you may turn to the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or to the authority of the country where you live.

8. Automated decisions and profiling

We do not make automated decisions about you and we do not carry out profiling. Fraud checks on payments are performed by the payment provider as part of its own service.

9. Minors

The site is not aimed at people under 16 and we do not knowingly collect their data. If you notice that a minor has left us data, write to info@via925firenze.com and we will delete it.

10. Cookies

The cookies and other technologies used by the site are described on their own page: Cookie policy.