Information on Privacy - GDPR

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This privacy notice describes how E-COMIT S.r.l. processes the personal data of users who purchase or interact with the e-commerce website, using it primarily for the management of orders, payments, shipments and customer support and to comply with the legal obligations applicable within the European Union; subject to specific consent, the data may also be used for marketing purposes, newsletter distribution, promotional communications and remarketing activities, and may be shared, where necessary, with technical service providers, payment platforms, couriers and review collection systems; the data are retained for the time strictly necessary to achieve the purposes for which they were collected or until any withdrawal of consent, and the user may at any time exercise the rights provided for in Articles 15-22 of Regulation (EU) 2016/679 (GDPR) and lodge a complaint with the competent supervisory authority.

---

PRIVACY POLICY PURSUANT TO REGULATION (EU) 2016/679 ("GDPR")

1. DATA CONTROLLER

The Data Controller for personal data is E-COMIT S.r.l., acting through its pro-tempore legal representative, with registered office at Via G. Di Vittorio, 93-95 — Z.I. Terrafino — 50053 Empoli (FI), Italy, VAT No. IT06818930486, email: info@vernicispray.com, certified email (PEC): e-comit@pec.e-comit.it, phone: +39 0571530262.

The Data Controller determines the purposes and means of processing the personal data collected through the e-commerce website and related connected services.

• Controller: E-COMIT S.r.l.
• Registered office: Empoli (FI), Italy
• Contacts: info@vernicispray.com — PEC e-comit@pec.e-comit.it

2. CATEGORIES OF DATA PROCESSED

In the context of e-commerce activities and related services, the Data Controller processes various categories of personal data, including:

• Identification data: first name, last name, company name;
• Contact data: email address, phone number, shipping and billing address;
• Tax data: tax code, VAT number;
• Order-related data: purchased products, purchase history, returns;
• Payment data: information necessary to process payments (handled through certified providers);
• Browsing data: IP addresses, system logs, data collected through cookies and similar tools;
• Data relating to reviews and feedback.

Data may be collected directly from the data subject or through third parties duly authorized to do so.

• Source: user, IT systems, third-party platforms
• Type: ordinary data (no special categories of data pursuant to Art. 9 GDPR are processed)

3. PURPOSES AND LEGAL BASES FOR PROCESSING

3.1 Direct marketing, newsletters and promotional communications

Subject to specific consent expressed during registration or purchase, personal data may be processed for sending newsletters, commercial communications, promotions, personalized offers, invitations to initiatives, as well as for remarketing activities and behavioral advertising through third-party tools (e.g. Google Ads, Meta Ads).

Processing for marketing purposes is based on the data subject's consent pursuant to Art. 6(1)(a) GDPR. Consent is free, specific, informed and may be withdrawn at any time via an unsubscribe link or by a direct request to the Data Controller.

• Legal basis: consent (Art. 6(1)(a) GDPR)
• Activities included: newsletters, direct email marketing (DEM), promotions, remarketing
• Withdrawal: possible at any time

3.2 Performance of the sales contract

Personal data are processed to allow registration on the website, order management, payment processing, product shipment, returns management and customer support.

The legal basis is the performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR.

• Legal basis: contract performance
• Purpose: order management, shipping, support

3.3 Legal and tax compliance

Processing is carried out to comply with legal obligations provided for by Italian and European legislation and, where applicable, by the laws of the EU destination countries (e.g. intra-EU VAT rules, national consumer protection rules).

• Legal basis: legal obligation (Art. 6(1)(c) GDPR)
• Rules: EU and national tax, accounting and consumer protection laws

3.4 Fraud prevention and protection of rights

Data may be processed to prevent fraud, abuse, unlawful use of the website or to exercise or defend a right in court.

• Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Purpose: security, fraud prevention, legal defense

3.5 Collection of reviews and ratings through third-party platforms

In order to improve transparency and the reputation of the service, the Data Controller may transmit limited data (e.g. name, email, order reference) to independent review collection platforms (e.g. Trusted Shops, Trustpilot or similar), so that the user can provide a rating.

The legal basis is the Data Controller's legitimate interest in protecting its commercial reputation, or consent, where required by applicable law.

• Data shared: name, email, order reference
• Legal basis: legitimate interest or consent
• Purpose: collection of feedback and verified reviews

4. METHODS OF PROCESSING

Processing is carried out using IT and telematic tools, in accordance with principles of lawfulness, fairness, transparency, data minimization and security. Appropriate technical and organizational measures are adopted pursuant to Art. 32 GDPR.

• Tools: digital and automated
• Measures: technical and organizational security

5. DATA RETENTION

Data are retained for the time strictly necessary for the purposes indicated:

• Contractual data: up to 10 years (Italian and European tax obligations);
• Marketing data: until consent is withdrawn and in any case no longer than 24 months unless renewed;
• Fraud prevention data: according to timeframes proportionate to the risk.

6. RECIPIENTS AND EXTRA-EU TRANSFERS

Data may be disclosed to:

• Hosting providers and e-commerce platforms;
• Payment service providers (e.g. PSD2-certified PSPs);
• Couriers and logistics operators;
• Marketing and remarketing platforms (e.g. Google, Meta);
• Review platforms;
• Tax, legal and technical advisors.

Where data are transferred to non-EU countries, the transfer will take place in accordance with Arts. 44-49 GDPR (e.g. adequacy decisions, standard contractual clauses, EU-US Data Privacy Framework where applicable).

• Possible transfers: USA or other third countries
• Safeguards: SCCs, adequacy decisions, DPF

7. COOKIES AND TRACKING TECHNOLOGIES

The website uses technical, analytical and profiling cookies, including third-party cookies. Their use is governed by a specific Cookie Policy compliant with the ePrivacy Directive 2002/58/EC and the relevant national implementing rules (e.g. the Italian Data Protection Authority's measures).

• Types: technical, analytical, marketing
• Consent management: compliant banner

8. DATA SUBJECT RIGHTS

The data subject may exercise at any time the rights provided for by Arts. 15-22 GDPR: access, rectification, erasure, restriction, objection, portability, withdrawal of consent.

It is also possible to lodge a complaint with the competent Data Protection Supervisory Authority in the Member State of residence.

• Rights: Arts. 15-22 GDPR
• Complaint: competent national EU supervisory authority

9. NATURE OF DATA PROVISION

Providing data for contractual purposes is mandatory; failure to provide such data makes it impossible to place an order. Providing data for marketing purposes is optional.

• Mandatory: data necessary to place the order
• Optional: marketing

10. LEGAL REFERENCES

This notice is drafted pursuant to Regulation (EU) 2016/679 (GDPR), the Directive 2002/58/EC (ePrivacy), the applicable national implementing laws in the individual EU Member States, and the consumer and tax rules applicable to distance selling within the European Union.

• GDPR (EU Regulation 2016/679): Official text on EUR-Lex
• ePrivacy Directive 2002/58/EC: Official text on EUR-Lex