Privacy Policy
Last updated: 25 September 2026
This policy explains which personal data we collect on elisabettasebastio.com, why, and what your rights are, in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679).
1. Data controller
Elisabetta Sebastio, Via lago di Piediluco 2, Taranto (TA), Italy – VAT number 03180780730
Email: elisabetta.sebastio@gmail.com
2. What data we process and why
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Managing orders, payment, delivery and after-sales assistance | Name, billing and shipping address, email, phone, order details, wedding or event date if you give it, notes you write to us | Performance of the contract (art. 6.1.b GDPR) | For the duration of the contract, then 10 years for tax and accounting records |
| Invoicing and legal obligations | Billing data and order data | Legal obligation (art. 6.1.c) | 10 years (art. 2220 Italian Civil Code) |
| Answering your requests (contact page, email, phone, WhatsApp, Instagram) | Name, contact details, content of your messages | Pre-contractual measures at your request, or legitimate interest in replying (art. 6.1.b and f) | Up to 24 months after the last contact, unless an order follows |
| Customer account, if you create one | Email, password (encrypted), addresses, order history | Contract (art. 6.1.b) | Until you delete the account |
| Newsletter | Email, name if given | Your consent (art. 6.1.a) | Until you unsubscribe (link in every email) |
| Statistics and advertising measurement | Cookies and similar identifiers, pages visited, device and browser data, approximate location, purchase events | Your consent through the cookie banner (art. 6.1.a) | As set out in the Cookie Policy |
| Blog comments | Name, email, IP address, comment | Legitimate interest / your consent (art. 6.1.f and a) | As long as the comment is published |
| Website security and operation | IP address, technical logs | Legitimate interest (art. 6.1.f) | For the time needed for security purposes |
Data marked as required at checkout are necessary to process your order; without them we cannot complete it. We do not make decisions about you based solely on automated processing.
3. Who we share data with
We never sell your data. We share it only with the providers we need to run the shop, which act as processors on our behalf or as independent controllers:
- Hosting: VHosting Solution S.r.l. (Italy), which hosts the website and its database.
- Payments: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), for PayPal and card payments; banks, for bank transfers.
- Couriers: UPS, DHL or FedEx, for delivery; for shipments outside the EU, also the customs authorities of the destination country.
- Newsletter: Sender (UAB “Sender.net”, Lithuania).
- Statistics and advertising, only with your consent: Google Ireland Ltd (Google Tag Manager, Google Analytics, Google Ads), Meta Platforms Ireland Ltd (Meta Pixel and Conversions API), through a server-side tagging service provided by Stape with servers in the EU.
- Messaging: WhatsApp Ireland Ltd and Meta Platforms Ireland Ltd (Instagram), if you choose to contact us there.
- Our accountant and, where required by law, public authorities.
4. Transfers outside the EU
Some providers (for example Google and Meta) may transfer data to the United States. These transfers rely on the EU–US Data Privacy Framework or, where it does not apply, on the European Commission’s Standard Contractual Clauses. For deliveries outside the EU, the data needed for shipping and customs are transferred to the destination country because this is necessary to perform the contract (art. 49.1.b GDPR).
5. Cookies
We use technical cookies needed for the website and the cart, and — only with your consent — statistics and marketing cookies. You can change your choices at any time from the cookie banner. Details are in the Cookie Policy.
6. Your rights
You can ask us at any time to access your data, correct it, delete it, restrict or object to its processing, or receive it in a portable format (arts. 15–22 GDPR). Where processing is based on consent, you can withdraw it at any time, without affecting what was done before. Write to elisabetta.sebastio@gmail.com: we reply within one month.
You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work.
7. Minors
Our shop is intended for adults. We do not knowingly collect data from children under 14.
8. Changes
We may update this policy when our services change. The date at the top shows the latest version.