Privacy Policy

1. Data controller

The data controller for personal data is:

For questions about personal data, contact the controller using the details above.

2. What data we collect

• Order and account data: first name, surname, delivery and billing address, email, telephone number, and where applicable VAT number/tax code for invoicing.
• Payment data: handled by the provider selected at checkout (Stripe and PayPal, depending on the available method). We do not store full card details or payment account credentials. We receive the outcome and transaction references needed to manage orders and refunds.
• Contact data: the content of the messages sent through the contact form, by email or via WhatsApp.
• Browsing data: technical information for security and operation; optional cookieless statistics and, only with separate consent, Google Analytics statistics described below. Product viewing history is not retained between visits.
• AI assistant: if you use it, the messages you write are processed by an artificial intelligence service provider based in the United States, in order to answer your questions (see section 6). We do not store conversations on our servers: they stay in your browser and are deleted when you close the tab. To limit abuse and the cost of the service we keep, instead of your IP address, a fingerprint of it (hash) with a usage count: it is deleted automatically no later than 48 hours after your last use. Do not enter sensitive information or payment details. You can always ask a person for assistance.
• Newsletter: email address, requested topics, language, source and dates of the request, confirmation and any withdrawal. The service also records deliveries, message opens and link clicks to measure newsletter performance; the management system displays aggregated campaign statistics.
• Welcome voucher: when you confirm your newsletter subscription we send you a personal code. So as not to issue a second voucher to the same person, we keep a fingerprint (hash) of your email address, calculated after removing variants such as the part after the “+” sign, together with the code and whether it has been used. The fingerprint does not contain the address. If you use the voucher in an order, the discount code usage register also keeps your email address, reduced in the same way: it prevents the voucher from being used a second time.
• Availability alerts: email, requested product and size, language, account identifier where applicable, request and confirmation dates, and technical delivery outcomes.
• Product reservations: name, email, requested sizes and quantities; phone, city and notes only if provided. We also keep the request status, agreed arrangements, any offer and the link to the order.

3. Purposes and legal bases

Order, delivery and billing data are required to perform the contract or meet legal obligations: without them we cannot complete your purchase. The newsletter and AI assistant are optional; you may buy without using them. The assistant suggests products and does not determine rights or refunds. Payment fraud checks are handled by the payment provider.

• Fulfilment of orders and management of the contractual relationship — legal basis: performance of a contract (Art. 6.1.b GDPR).
• Tax and accounting obligations (invoicing, retention of documents) — legal basis: legal obligation (Art. 6.1.c GDPR).
• Customer support and replies to enquiries — legal basis: performance of pre-contractual measures / legitimate interest (Art. 6.1.b/f GDPR).
• AI assistant, if you choose to use it — legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR), when you ask us about products, sizes, shipping, payments or returns with a view to a purchase; for other questions, and to protect the service from abuse, our legitimate interest (Art. 6.1.f GDPR) in offering quick help to those who ask for it and in keeping the service secure. Using it is optional and you start it: you can buy without using it and you can always write to a person. The assistant does not profile you and does not take decisions about you. You can object at any time (Art. 21 GDPR) by no longer using it or by writing to us.
• Newsletter — legal basis: consent (Art. 6(1)(a) GDPR), optional and withdrawable at any time. Consent includes measuring opens and clicks for each message, which we use to understand which content interests you; unsubscribing stops it. Subscription takes effect after confirmation using the emailed link. You can unsubscribe in your account preferences or using the link at the bottom of each newsletter.
• Welcome voucher — legal basis: legitimate interest (Art. 6.1.f GDPR) in offering the voucher only once per person and preventing its repeated use. We keep the bare minimum: a fingerprint of your address and, only if you use the voucher, the address in the usage register.
• Record of your unsubscription — legal basis: the obligation to respect your objection and to be able to demonstrate it (Arts. 6.1.c, 7.1 and 21.3 GDPR) and our legitimate interest in not writing to you again by mistake (Art. 6.1.f GDPR). We keep only the data needed for this.
• Site security and fraud prevention — legal basis: legitimate interest (Art. 6.1.f GDPR).
• Availability alerts — at your optional request and with your consent (Article 6(1)(a) GDPR), we send one email when your chosen size becomes available again. Guests must confirm their email address. This does not subscribe you to the newsletter. Cancel through the email link, the button shown after activation while signed in, or by contacting us.
• Product reservations: handling your request, contacting you about availability and delivery, and preparing a checkout link if needed. The legal basis is taking pre-contractual steps at your request (Art. 6(1)(b) GDPR). Name, email and quantities are required; phone, city and notes are optional. This processing does not include newsletter subscriptions or other promotional messages.

4. Methods and place of processing

Data is processed using IT tools and appropriate security measures. The databases and servers that run the shop are located in data centres in the European Union. Some providers also process data outside the European Union: they are listed in section 6, with the country and the safeguard used.

5. Recipients and external processors

Within the limits of the purposes indicated above, data may be disclosed to:

• Payment providers (Stripe and PayPal) — transactions, refunds and fraud prevention, according to the method selected at checkout and their respective privacy notices.
• Couriers — the recipient’s name, address and telephone number, for delivery and for despatch notifications.
• IT service providers — hosting, content delivery and store maintenance; they process data needed to operate the website and security logs.
• Email service providers — sending service communications and receiving support requests.
• Accountant and advisers, for tax and accounting obligations.
• Competent authorities, where required by law.
• AI assistant provider, based in the United States — processing messages and generating answers, only if you use the service. It processes the data on our behalf (see section 6 for the transfer).
• Newsletter providers — subscription management, message delivery, unsubscribing and measurement of deliveries, opens and clicks. They receive the email address, preferences and interaction data needed for the service.
• Electronic invoicing service and the Exchange System (SdI) of the Italian Revenue Agency — issuing, sending and storing invoices: they receive the billing details (name or company name, address, tax code or VAT number) and the order amounts.

Providers processing data on our behalf are appointed as processors under Article 28 GDPR. You may ask the controller for information about the recipients of your data. We do not sell personal data to third parties.

6. Transfers outside the EU

Some data is processed outside the European Union and the European Economic Area. This happens in the following cases, each with its own safeguard:

• AI assistant — the messages you write in the chat are processed by a provider based in the United States. Safeguard: standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), included in the contract with the provider.
• Hosting and IT services — the shop’s databases and servers are in the European Union; some of the companies that manage them, as well as those providing the image storage and the network that delivers the pages, are based in the United States and may process technical data (such as request logs) or access the data for technical support and security. Safeguard: EU-U.S. adequacy decision (Data Privacy Framework), in which these companies participate.
• Email — the shop’s mailbox and the sending of service emails (such as order confirmations) are managed by a provider based in the European Union, which may also use data centres and sub-processors outside the European Union. Safeguard: standard contractual clauses adopted by the European Commission, included in the contract with the provider.
• Payments — the contract for payments with Stripe and PayPal is concluded with companies established in the European Union, which may transfer data to companies in the same group or to providers outside the European Union, including in the United States. Safeguards: EU-U.S. adequacy decision (Data Privacy Framework), standard contractual clauses adopted by the European Commission or binding corporate rules approved by the European authorities, as indicated in the payment providers’ privacy notices.
• Optional statistics (only with your consent) — Google Ireland Limited may transfer the data collected with Google Analytics to Google LLC, in the United States. Safeguard: EU-U.S. adequacy decision (Data Privacy Framework), in which Google LLC participates.

You can ask us for information about these safeguards and for a copy of the standard contractual clauses by writing to info@tunnaliva.com.

Statistics · Google Analytics

Only with your consent, Google Ireland Limited receives public page visit data, IP address, browser information and cookie identifiers. We do not send emails, form data or your account pages. Advertising features are disabled. Google may transfer the data to Google LLC, in the United States, with the safeguard described in section 6.

The purpose is to measure visits to public pages and improve the website. The legal basis is your optional consent (GDPR Article 6(1)(a)), which you can withdraw through Cookie preferences. We do not use Google Signals, advertising personalization, account identifiers or automatic form measurement. The service is not loaded before consent and stays disabled in personal areas, checkout and pages whose address contains parameters or fragments.

Cookie preferences

Google privacy and data processing

7. Retention period

• Order and invoicing data: for as long as required by tax obligations (generally 10 years).
• Account data: for as long as the account remains active.
• Contact messages: for as long as necessary to handle the enquiry.
• Reservations: we keep your request while handling availability, the offer and related follow-up. For closed requests without an order, the review and deletion criterion is 24 months from the last update. Data linked to an order instead follows the retention periods for orders and tax documents.
• Newsletter subscription requests that were never confirmed: the criterion is 30 days from the request, but for now we do not delete them automatically; you can ask us to delete them at any time (section 9).
• Newsletter consent: we keep the subscription request, the confirmation, the language, the chosen topics and the version of the privacy policy accepted for as long as you remain subscribed. After you unsubscribe we keep them together with the record of the unsubscription, as evidence of the consent you had given us.
• Newsletter unsubscription: we keep your email address with the date, method and topics of the unsubscription for as long as the shop sends newsletters. This is so that we do not write to you again, even if the address is entered again in the website form, and so that we can show that we respected your choice.
• Welcome voucher: we keep the fingerprint of the email address, the personal code and whether it has been used, with the email address if you used the voucher, for as long as the shop offers the welcome voucher, even after you unsubscribe. They serve to avoid issuing a second voucher to the same person and to prevent it from being used twice.
• Unfinished carts, with the data entered at checkout: the criterion is 90 days from the last update, but for now we do not delete them automatically; you can ask us to delete them at any time (section 9). Carts that became orders or are linked to a payment or to other data we must keep are kept longer, for the time required by tax obligations.
• Withdrawal notices and order documents: we keep them for the time required by tax rules (generally 10 years) and to protect the parties’ rights.
• Availability alerts: unconfirmed requests expire after 48 hours; active requests end after notification, cancellation or a maximum of 180 days. Email addresses and request references are deleted from the alert system within 30 days of closure. Delivered messages remain in your mailbox according to your settings.

8. Your rights

As a data subject you may exercise at any time the rights provided for by Articles 15–22 GDPR: access, rectification, erasure, restriction, portability, objection to processing and withdrawal of consent. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali.

9. How to exercise your rights

Write to info@tunnaliva.com: we will reply within the time limits laid down by law.

We respond without undue delay, normally within one month of your request. For complex requests, this may be extended by two further months: we explain the reasons within the first month. Requests are normally free of charge. Erasure does not cover data we must retain to meet legal obligations or protect legal rights; we may request only information necessary to verify your identity.

10. Changes to this policy

We may update this policy over time. The version in force is always published on this page, together with the date of the last update.