What we hold, why, and for how long.
Privacy policy
Data controller
The controller is FASHION ABBIGLIAMENTO S.R.L., Via Gabriele Amico Valenti 24/38, 93100 Caltanissetta (CL), Italy. This policy is given under arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Codice Privacy (d.lgs. 196/2003 as amended).
- Privacy contact
- support@fashionabbigliamento.shop
- Telephone
- +39 328 614 9057
- Postal
- FASHION ABBIGLIAMENTO S.R.L., Via Gabriele Amico Valenti 24/38, 93100 Caltanissetta (CL), Italy
- Response time
- Within 30 days, as the GDPR requires
We have not appointed a Data Protection Officer: our processing does not meet the criteria in art. 37 GDPR. Privacy requests are handled by the same team that answers everything else.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone, delivery address | Fulfilling your order and contacting you about it | Performance of the contract — art. 6(1)(b) | 24 months from the order |
| Order contents and amounts | Fulfilment, accounting and tax obligations | Legal obligation — art. 6(1)(c) | 10 years (Italian tax law) |
| Enquiry form contents | Answering your question | Legitimate interest in replying — art. 6(1)(f) | 24 months |
| Email address, if you opt in | Occasional emails about colour and fabric changes | Consent — art. 6(1)(a) | Until you unsubscribe |
| Aggregated page counts | Deciding which styles stay in the catalogue | Consent via the cookie banner — art. 6(1)(a) | 14 months |
| Reorder code | Rebuilding a previous basket on request | Performance of the contract — art. 6(1)(b) | 36 months |
We do not collect special categories of data, we do not profile you, and we take no automated decisions producing legal effects. A reorder code is a random string that contains no personal data at all; binding it to an email address is optional and only used to re-issue it if you lose it.
We never see your card details. Card data is entered on the payment provider's PCI-DSS compliant page, transmitted encrypted directly to them, and is never received by or stored on our servers.
Orders you started but did not finish
If you complete the checkout details but do not complete payment, we keep those details so we can reach you if something went wrong with the payment and so the order can be completed later. The basis is our legitimate interest in completing a transaction you began. That record is deleted after 6 months, or immediately if you ask.
Who else processes it
Your data is shared only with the suppliers needed to deliver the service, each acting as a processor under art. 28 GDPR and bound by a written agreement:
- The hosting and database provider that runs this site and stores orders
- The payment provider that takes the payment (they receive the amount and your contact details; we receive no card data from them)
- The carrier that delivers the parcel (name, address and phone number, so they can reach you)
- The transactional email provider that sends order confirmations
- Our accountant, for the invoices Italian law requires us to keep
We do not sell personal data, do not share it with advertising networks, and do not use it for any purpose other than the ones listed above.
Where a processor is outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision. A current list of processors is available on request.
Your rights
Under arts. 15–22 GDPR you may ask us at any time to:
- Confirm what we hold about you and give you a copy (access)
- Correct anything inaccurate (rectification)
- Delete it, where we have no overriding legal obligation to keep it (erasure)
- Restrict how we use it while a dispute is resolved
- Send it to you or another controller in a machine-readable format (portability)
- Object to processing based on legitimate interest
- Withdraw consent at any time, without affecting what was lawful before
Write to support@fashionabbigliamento.shop. We answer within 30 days and charge nothing. If you are not satisfied you may complain to the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma — garanteprivacy.it) or to the supervisory authority of your own country.
Security
The whole site is served over HTTPS. Access to order data is limited to the people who need it, protected by individual accounts with multi-factor authentication, and logged. Backups are encrypted. If a breach ever occurs that is likely to result in a risk to your rights and freedoms, we will notify the Garante within 72 hours and tell you directly where the risk is high.
Children
This site is not directed at children and we do not knowingly collect personal data from anyone under 13. Purchases require legal capacity to contract. Where a person aged 13 to 17 wishes to buy, the order must be placed by a parent or guardian. If you believe we hold data about a child, write to us and we will delete it.
Changes
Where this policy changes materially we will say so on the site before the change takes effect and, where the law requires it, ask for consent again. The date of the last revision is shown beside this page's contents.