1. Data Controller

The Data Controller for the processing of your personal data is VEGA DI VANNACCI EMANUELE (the "Controller"), with registered office at Salita Sant Antonio 25, 16137 Genova (GE), Italia, P.IVA: 03073780995. This Privacy Policy is issued in accordance with EU Regulation 2016/679 (General Data Protection Regulation — "GDPR") and the Italian Privacy Code (Decreto Legislativo 30 giugno 2003, n. 196, as amended by Decreto Legislativo 10 agosto 2018, n. 101).

2. Information We Collect

VEGA Luxury Bags, operated by VEGA DI VANNACCI EMANUELE, collects personal data to provide and improve our services. We collect the following categories of personal data:

Identity Data: When you make a purchase or create an account, we collect your name, email address, phone number, shipping address, and billing information.

Transaction Data: We collect details about your purchases, including product details, order amounts, and payment method information.

Technical Data: We automatically collect information about how you interact with our website, including your IP address, browser type, pages visited, and time spent on our site.

3. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary for the performance of a contract, including order processing, delivery, and customer support.
• Legal obligation (Art. 6(1)(c)): Processing necessary to comply with Italian fiscal, tax, and accounting obligations.
• Legitimate interest (Art. 6(1)(f)): Processing necessary for fraud prevention, website security, and service improvement.
• Consent (Art. 6(1)(a)): Processing for marketing communications and non-essential cookies, based on your freely given consent.

4. How We Use Your Information

We use the information we collect to:

• Process and fulfill your orders
• Communicate with you about your orders and account
• Provide customer support
• Send promotional communications (only with your explicit consent)
• Improve our website and services
• Prevent fraud and ensure security
• Comply with Italian and EU legal obligations

5. Data Sharing and Transfers

We do not sell, trade, or rent your personal data to third parties. We may share your data with:

Data Processors: Third-party companies that process data on our behalf (e.g., payment processors, shipping carriers, email service providers), bound by data processing agreements in accordance with Art. 28 GDPR.

Legal Requirements: When required by Italian or EU law, regulation, or legal process, or to protect the rights, property, or safety of our company, customers, or others.

International Transfers: Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission, in accordance with Chapter V of the GDPR.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Transaction data is retained for 10 years in accordance with Italian fiscal and accounting obligations (Art. 2220 Codice Civile). Marketing data is retained until you withdraw your consent. Technical data is retained for a maximum of 24 months.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with Art. 32 GDPR. Payment information is encrypted using industry-standard SSL/TLS technology.

8. Cookies

Our website uses cookies and similar tracking technologies. In accordance with Art. 122 of the Italian Privacy Code and the guidelines of the Garante per la Protezione dei Dati Personali, we distinguish between technical cookies (which do not require consent) and profiling/analytics cookies (which require your explicit consent). You can manage your cookie preferences at any time through our cookie settings or your browser preferences.

9. Your Rights Under GDPR

Under the GDPR and Italian privacy law, you have the following rights regarding your personal data:

• Right of access (Art. 15): Obtain confirmation of whether your data is being processed and access a copy of your data.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): Request restriction of processing in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at www.garanteprivacy.it.

10. Children's Privacy

Our website is not intended for children under the age of 16 (in accordance with Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code). We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. Where changes are material, we will notify you via email or through a prominent notice on our website.

12. Contact Us

For questions about this Privacy Policy or to exercise your data protection rights, please contact us at:

VEGA DI VANNACCI EMANUELE
Salita Sant Antonio 25
16137 Genova (GE), Italia
P.IVA: 03073780995
Email: [email protected]
Phone: +39 010 123 4567