Privacy

• Requests from the “Custom” form: name, email, phone (if you give it), colours and message, and the bag you started from. They are used only to reply to you and, if you wish, to make your bag: this processing is necessary for the pre-contractual steps you ask for (article 6, paragraph 1, letter b of the GDPR).
• Orders: name, email, amounts and payment references, which I receive from PayPal when you buy, and the mobile number and InPost locker you enter on the bag's page (with pickup in person only the mobile number, to arrange the day, time and place). They are used to ship or hand you the bag and manage the order (performance of the contract, article 6.1.b) and for tax obligations (legal obligation, article 6.1.c).
• Newsletter: your email (and your name, if you give it to me), where you subscribed from and the dates of subscription and confirmation, plus which newsletters I have sent you. They are used only to send you the newsletter with the new bags: the legal basis is your consent (article 6.1.a of the GDPR), which you give by ticking the box and confirm with the link in the email. You can withdraw it whenever you like with the unsubscribe link at the bottom of every newsletter, or by writing to me. The newsletters contain nothing that tells me whether you open them or what you click.

I write to you about new bags only if you subscribe to the newsletter. Otherwise I don't use your data for advertising and I don't sell it or pass it on to anyone, except to whoever is needed to deliver your bag (see below).

Payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., which processes the payment data as an independent controller: your card or PayPal account details never reach me. On the page of a bag that can be bought, the PayPal buttons are loaded from PayPal's servers, which at that moment use their own cookies and anti-fraud tools: you'll find the details in PayPal's privacy notice.

The site uses only technical cookies, essential for it to work: the session and the protection of the forms from abuse. No profiling, advertising or statistics cookies: that's why there is no cookie banner.

To know how many visits the site gets I use a statistics tool installed on a private server, not an external service: it uses no cookies, profiles no one and collects anonymous data, which I only see in aggregate form and share with no one. That's why your consent isn't needed.

• Requests: for as long as needed to reply to you and follow your bag, at most 24 months from our last contact.
• Orders: 10 years, the period after which the rights linked to the sale lapse (article 2946 of the Italian Civil Code) and during which the tax authorities may ask about the sales. I sell as a private person: I do not keep business accounts.
• Newsletter: as long as you stay subscribed. If you unsubscribe I keep only the address and the date, so I don't write to you again by mistake (you can ask me to delete those too). A subscription never confirmed deletes itself after 30 days.

Like every website, for security the server briefly logs technical data about visits (for example the IP address) and, to prevent abuse of the forms, keeps a fingerprint of it for a few minutes.

Only me and, when needed for technical management, the provider that hosts the site and its email: EV Network S.r.l., via Emilio Salgari 14/e, 31056 Roncade (TV), Italy, VAT no. 04417370261. EV Network processes the data only on my behalf and according to my instructions, as data processor (article 28 of the GDPR), and keeps it on servers in data centres in the European Union. The site's emails, newsletter included, are also sent from its mail server. For payments the data goes through PayPal, as explained above.

To ship your bag to the locker I give InPost your name, mobile number, email and the locker you chose: InPost uses them for the delivery and to send you the code to open the locker, as an independent controller, under its own privacy notice.

You can ask at any time to see your data, correct or delete it, restrict its use, object to the processing or receive it in a readable format (articles 15–22 of the GDPR) by writing to info@sivica.it. If you think your data is being handled wrongly you can contact the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).