Privacy Policy

1. Data Controller

2. Categories of Personal Data Processed

2.1 Data Provided Voluntarily

• Registration data: Name, surname, email, password (encrypted)
• Contact data: Shipping and billing address, phone number
• Payment data: Credit card details (managed via secure providers), order history
• Communication data: Messages sent via forms, email, chat
• Preferences: Preferred sizes, wishlist, communication preferences

2.2 Data Collected Automatically

• Navigation data: IP address, browser type, operating system, screen resolution
• Usage data: Pages visited, time spent, navigation path, referrer
• Technical data: Device identifiers, connection information
• Geolocation: Country and city of origin (based on IP)

2.3 Third‑party Data

• Social Media: Public data from your profiles when interacting with our content
• Payment Providers: Transaction confirmations from PayPal, Stripe, etc.
• Analytics: Aggregated data from Google Analytics, Facebook Pixel

3. Purposes and Legal Bases

3.1 Contract Performance (Art. 6.1.b GDPR)

• Order and sales management
• Payment processing
• Product shipping and delivery
• Returns and refunds management
• Customer assistance and technical support
• Invoice and tax documents issuance

3.2 Consent (Art. 6.1.a GDPR)

• Newsletter and promotional communications
• Personalized marketing and profiling
• Use of non‑essential cookies
• Social content sharing

3.3 Legitimate Interest (Art. 6.1.f GDPR)

• Site security and fraud prevention
• Statistical analysis and service improvement
• Complaints and dispute management
• Direct marketing for existing customers

3.4 Legal Obligations (Art. 6.1.c GDPR)

• Tax and accounting compliance
• Invoice retention
• Communications to competent authorities
• Anti‑money laundering and security checks

4. Processing Methods

Personal data is processed with automated tools for the time strictly necessary to achieve the purposes for which it was collected.

4.1 Security Measures

• Encryption: All sensitive data is encrypted (SSL/TLS)
• Limited access: Only authorized personnel can access data
• Secure backups: Encrypted and protected backups
• Monitoring: Intrusion detection systems
• Updates: Software always updated with security patches

4.2 International Transfers

Some data may be transferred to service providers located in third countries (e.g., USA) ensuring adequate protection through:

• EU adequacy decisions
• Standard Contractual Clauses (SCC)
• EU-US Data Privacy Framework, where applicable, and supplementary measures required by GDPR

5. Retention Period

6. Data Recipients

6.1 Categories of Recipients

Personal data may be communicated to the following categories:

6.2 Data Processors

Main processors appointed by Vessano include:

• Hosting Provider: Vercel or another technical provider used for website hosting
• Email Service: Resend or another technical provider used for transactional email delivery
• Payment Processor: Stripe, PayPal
• Analytics: Google LLC (Google Analytics)
• Shipping: National and international couriers

7. Data Subject Rights

Under GDPR you have the following rights:

7.1 How to Exercise Your Rights

To exercise your rights you can:

• Email: support@vessano.com
• Private Area: Access your account and change settings
• Online Form: Fill in the dedicated form
• WhatsApp: +39 379 175 5562

Response Times: We reply within 30 days (extendable to 60 for complex requests).

8. Cookies and Similar Technologies

Our site uses cookies and similar technologies. For details see the Cookie Policy.

8.1 Types of Cookies Used

• Essential Cookies: Necessary for site operation
• Performance Cookies: Analyze site usage
• Marketing Cookies: Personalized advertising (with consent)
• Third‑party Cookies: From integrated external services

9. Minors

Our services are not intended for minors under 16. We do not knowingly collect data from minors without parental or legal guardian consent.

If we become aware of collection without consent, we will proceed to immediate deletion.

10. Profiling and Automated Decisions

10.1 Profiling

We use profiling techniques to:

• Personalize the shopping experience
• Suggest products of interest
• Optimize marketing communications
• Prevent fraud and suspicious activity

10.2 Automated Decisions

We use automated systems for:

• Fraud detection in payments
• Automatic calculation of discounts and promotions
• Automatic inventory management

You can always request human intervention and contest these decisions.

11. Data Breach

If a personal data breach poses a high risk to rights and freedoms, we will:

• Notify the Supervisory Authority within 72 hours
• Inform concerned users without delay
• Document the breach and measures taken
• Implement corrective actions to prevent future breaches

12. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent Supervisory Authority:

13. Changes to This Policy

We may update this notice to reflect:

• Regulatory changes
• New services
• Technical improvements
• User feedback

Substantial changes will be communicated via:

• Informational banner on the site
• Email to registered users
• Notification in the private area

Please check this page regularly for updates.

14. Privacy Contacts

For questions regarding personal data processing:

15. Notice to California and United States Residents (CCPA / CPRA & US State Privacy Laws)

In compliance with the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and comprehensive data privacy statutes in other US states (including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA):

• No Sale of Personal Information: VESSANO S.R.L.S. does not sell, rent, or exchange personal data for monetary or financial compensation.
• Cross-Context Behavioral Advertising & Tracking Technologies: The deployment of third-party cookies or scripts for analytics and personalized marketing (e.g. Google Analytics, Meta Pixel) may constitute "sharing" under California law. Users can exercise their opt-out right at any time by declining cookies upon arrival or by updating preferences via the Cookie Preferences link located in the footer of every page.
• US Consumer Privacy Rights: US residents have the right to know the specific categories and pieces of personal information collected, request deletion or correction of inaccurate information, limit the use of sensitive personal information, and be free from discrimination for exercising these rights.
• Exercising Your Rights: To submit a verifiable consumer request, please contact us at support@vessano.com with the subject line "US Privacy Rights Request".