Privacy notice

Last updated: 2026-08-08

Document to be completed. The identification of the data controller has not been filled in yet.

The legal name, registered office and VAT number must be stated before the shop accepts orders: without them this notice satisfies neither art. 13 GDPR nor art. 7 of Legislative Decree 70/2003.

This document explains what personal data we collect when you visit the shop or buy from us, why we do it, who we share it with and what you can ask of us. It is written to be read: if anything is unclear, write to us and we will explain it.

Who processes your data

The data controller is whoever decides why and how your data is used. For this shop that is:

Orecchiette & Things S.r.l.s.
VAT no. 08981960720
Vicolo Sant'Agostino, 20 — 70122 Bari (BA)
info@orecchietteandthings.com
PEC orecchiette@pec.it

What we collect and why

Every processing operation has a precise purpose and a legal basis that makes it lawful. Both are below, along with how long we keep the data.

Browsing the site

We keep no browsing logs: we do not store the pages you visit or the time you visit them. Your IP address reaches the server because without it the reply would not know where to go back to; we use it only in memory and for a few minutes, to limit automated requests, and we write it down nowhere. The legal basis is our legitimate interest in keeping the service up and secure (art. 6(1)(f) GDPR). The only technical logs that exist are the ones the infrastructure provider produces to run the server, kept for as long as its own policies provide.

The catalogue is served through a component of ours in the middle: your browser only talks to us and never contacts Shopify directly, so your IP address is not passed on to them while you browse.

The basket

When you add a product we create a basket and keep its identifier on your device, so you find it again if you reload the page. The contents of the basket are held by Shopify on our behalf. The legal basis is taking steps at your request before entering into a contract (art. 6(1)(b)). An abandoned basket is removed by Shopify after a period of inactivity.

The order and the payment

Payment happens on the checkout hosted by Shopify, where you enter your name, delivery and billing address, email, any phone number and the details needed for payment. We need them to conclude and perform the contract (art. 6(1)(b)) and for the tax and accounting obligations that follow (art. 6(1)(c)). Card details never pass through us: they are handled directly by the payment service provider. We keep order documents for ten years, as art. 2220 of the Italian civil code requires.

Writing to us

If you send us an email we process your address and what you write in order to reply. The legal basis is responding to your request and, when it concerns an order, performing the contract. We keep the correspondence for as long as it takes to deal with the matter.

Cookies and tracking tools

We use technical cookies, which the law lets us set without consent because without them the service you asked for would not work. Everything else is subject to your consent, which you can give or take back at any time. The full list, with durations and recipients, is in the cookie policy.

Cookie policy

Who we share data with

We do not sell your data to anyone. We share it only with those we need in order to get you what you ordered, and only for that:

Shopify International Limited: The platform the shop runs on: catalogue, baskets, orders, customer records. It acts as a processor on our behalf, under an agreement that binds it to our instructions.
Infrastructure provider: Whoever hosts the server that builds these pages and keeps its technical logs.
Payment service providers: They collect the payment and process the transaction data as independent controllers, under their own notices and the anti-money-laundering obligations they are subject to.
Carriers and shippers: They receive the name, address and contact details needed to deliver the parcel.
Advisers and authorities: Accountants and lawyers where needed, and public authorities in the cases the law imposes on us.

Where the data goes

The data we entrust to Shopify is processed in the first instance by Shopify International Limited, established in Ireland. From there it may reach the Canadian parent company: Canada is a country the European Commission has recognised as adequate, so the transfer requires no further safeguards. For providers located outside the European Economic Area and not covered by an adequacy decision, transfers take place on the basis of the standard contractual clauses adopted by the European Commission. You can ask us for a copy of the safeguards in place by writing to the address above.

Your rights

Your data is yours to decide about. At any time you can ask us to:

tell you whether we process data about you and give you a copy of it (art. 15);
correct what is wrong or incomplete (art. 16);
erase the data, when we no longer have reason to keep it (art. 17);
restrict its use while we look into an objection of yours (art. 18);
receive it in a machine-readable format, or have it transferred to another provider (art. 20);
object to processing based on our legitimate interest (art. 21);
withdraw a consent already given, without affecting what was done before (art. 7(3)).

To exercise them just write to us at info@orecchietteandthings.com. We reply without undue delay and in any case within a month; if the request is complex we may take two months more, telling you why. We ask nothing for replying, except for manifestly unfounded or repetitive requests.

If you think we are getting it wrong

You can lodge a complaint with the supervisory authority (art. 77 GDPR). In Italy that is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garante@gpdp.it — certified mail protocollo@pec.gpdp.it. Your right to go to court remains unaffected.

Go to the authority's website(opens in a new window)

How we protect the data

The site is served only over an encrypted connection. The credentials for the platform stay on the server and never reach the browser. Payment happens in an environment certified to the card industry standards, which we do not operate. We apply request limits to contain abuse, and we keep the data we collect to the minimum the purpose requires.

Automated decisions

We do not take decisions about you based solely on automated processing, and we do not profile you to build predictions about your behaviour. The payment service provider may apply automated fraud checks to the individual transaction, under its own notice.

Minors

The shop addresses those who can enter into a contract and is not intended for minors. We do not knowingly collect data about minors; if you notice that it has happened, tell us and we will delete it.

Purchases and withdrawal

This document is only about personal data. The terms of sale, delivery times and the right of withdrawal — including the exceptions for goods liable to deteriorate rapidly and for sealed goods unsealed after delivery (art. 59 of Legislative Decree 206/2005) — are in the shop’s Terms of Service and Refund Policy, reachable from the foot of every page.

If we change this notice

If the way we process data changes, we update this page and the date at the top. When the change concerns cookies or the third parties involved, the banner comes back to ask you again what you want to do.