Informativa sulla privacy

This Privacy Policy explains how Quorivella ("we", "us", "our") collects and processes personal data when you visit https://quorivella.shop (the "Site") or place an order, and what rights you have. It is written for customers in Italy and the European Union and is intended to comply with the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the Italian Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018), and the applicable e-commerce and telecommunications rules.

1. Controller and contact

• Controller: Quorivella
• Website: https://quorivella.shop
• Email: hello@quorivella.shop
• Data protection contact: hello@quorivella.shop (marked "Data Protection")

We have not appointed a data protection officer, because the processing we carry out does not meet the thresholds of Article 37 GDPR. Privacy questions are handled by our customer care team.

2. Data we process

Data you provide

• identity and contact data: name, email address, delivery and billing address, telephone number;
• order data: products ordered, order value, order number, delivery instructions, returns and refunds;
• payment data: we do not receive or store full card numbers. Our payment providers transmit only the result of the transaction, the card brand, the last four digits, and the billing postal code;
• account data: login details, order history, saved preferences;
• communication data: emails, chat messages, contact-form entries, and any attachments;
• review and content data you choose to publish.

Data collected automatically

• device and connection data: IP address, device type, operating system, browser, language, screen size;
• usage data: pages viewed, products viewed, search terms, referring URL, session duration;
• cookie and pixel identifiers;
• fraud signals, such as mismatches between billing and delivery data.

Data from third parties

• payment providers and fraud-prevention services (transaction results, risk indicators);
• carriers and fulfilment partners (tracking events, delivery confirmations);
• analytics and advertising providers (campaign and audience data);
• address validation and identity-verification services.

3. Purposes and legal bases

Purpose	Data	Legal basis (Art. 6 GDPR)
Concluding and performing the contract: payment, dispatch, delivery, returns, refunds	Contact, order, payment, address data	Art. 6(1)(b) — contract
Customer service and complaint handling	Contact, order, communication data	Art. 6(1)(b) and (f) — contract, legitimate interests
Fraud prevention and site security	Device, usage, order, fraud signals	Art. 6(1)(f) — legitimate interests
Statutory record-keeping, tax and accounting	Order, payment, invoice data	Art. 6(1)(c) — legal obligation
Analytics and improvement of the Site	Usage, device, cookie data	Art. 6(1)(f) — legitimate interests, or Art. 6(1)(a) consent where required
Marketing emails and advertising	Contact, cookie, usage data	Art. 6(1)(a) — consent (Art. 6(1)(f) only where permitted for existing customers)
Personalisation	Cookie, usage data	Art. 6(1)(a) — consent

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object at any time using the contact details in section 1.

4. Cookies and similar technologies

We use cookies, pixels, and local storage for four purposes: strictly necessary functions (cart, checkout, security), functional preferences (language, currency, region), analytics, and advertising.

Non-essential cookies are set only after you consent, in accordance with the Italian Data Protection Code and the Garante's Guidelines on cookies and other tracking technologies of 10 June 2021. You can withdraw or change your consent at any time through the cookie banner or the cookie settings link in the Site footer, with effect for the future. You can also block or delete cookies in your browser; blocking strictly necessary cookies may prevent checkout from working.

We do not use cookie walls that condition access to the Site on consent to non-essential cookies, and rejecting non-essential cookies does not restrict your ability to order.

5. Recipients

We disclose personal data only where necessary and only to recipients bound by data processing agreements under Article 28 GDPR:

• our ecommerce platform and hosting provider;
• payment service providers and fraud-prevention services;
• carriers, fulfilment centres, and logistics partners;
• email, SMS, chat, and helpdesk providers;
• analytics and advertising providers, subject to your consent;
• review platforms;
• IT, security, and backup providers;
• professional advisers (lawyers, tax advisers, auditors);
• competent authorities, courts, and law-enforcement bodies where we are legally obliged or where necessary to establish, exercise, or defend legal claims;
• a successor entity in the event of a merger, acquisition, or transfer of assets.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising beyond the cookie-based disclosures covered by your consent, which you may withdraw at any time.

6. Transfers outside the EEA

Some of our service providers process data outside the European Economic Area, in particular in the United States. Where data is transferred to a country without an adequacy decision, the transfer is based on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) together with supplementary measures, or on another lawful transfer mechanism. You may request a copy of the safeguards by emailing hello@quorivella.shop.

7. Retention

• order, invoice, and payment records: 10 years, in line with statutory retention obligations;
• account data: for the duration of the account, then 12 months;
• customer service correspondence: 36 months;
• marketing contact data: until you withdraw consent, then up to 24 months for suppression purposes;
• analytics data: up to 14 months in identifiable form;
• security and fraud logs: 12 months;
• cookie consent records: 12 months.

After these periods, data is deleted or anonymised.

8. Your rights

You have the right to:

• access your personal data (Article 15 GDPR);
• rectify inaccurate or incomplete data (Article 16);
• erase data (Article 17), subject to statutory retention duties;
• restrict processing (Article 18);
• data portability — receive your data in a structured, commonly used, machine-readable format (Article 20);
• object to processing based on legitimate interests, including profiling (Article 21);
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3));
• not be subject to a decision based solely on automated processing that produces legal effects concerning you (Article 22); we do not carry out such decision-making;
• lodge a complaint with a supervisory authority (Article 77).

To exercise a right, email hello@quorivella.shop with the subject "Privacy Request". We respond within one month of receiving a verifiable request; where the request is complex, we may extend that period by two further months and will tell you within the first month. We may ask for information needed to verify your identity, such as your order number and the email address used for the order.

9. Complaints

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy, www.garanteprivacy.it, or with the supervisory authority of the Member State where you habitually reside or work, or where the alleged infringement occurred (Article 77 GDPR). We would appreciate the chance to address your concern first.

You may also seek a judicial remedy against us or against the supervisory authority (Articles 78 and 79 GDPR).

10. Marketing

We send marketing emails only with your consent, or — where legally permitted — to existing customers about similar products, in which case you may object at any time. Every marketing email contains an unsubscribe link. Withdrawing marketing consent does not affect transactional messages about your order, which are necessary to perform the contract.

If you consent to text messages, you can withdraw that consent at any time by replying STOP. Message and data rates may apply.

11. Children

The Site is not directed to children. Where consent is the legal basis for information society services, we require the consent of a parent or guardian for children under 16 years of age, in line with Article 8 GDPR and the Italian Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018). If you believe a child has provided us with personal data, contact us and we will delete it.

12. Security

We use TLS encryption in transit, access controls, logging, and PCI-DSS-compliant payment providers so that card data never passes through our servers. No system is entirely secure; if a personal data breach is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority within 72 hours where required by Article 34 GDPR.

13. Third-party links

The Site may link to third-party websites that we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them.

14. Changes

We may update this policy to reflect changes in our processing or the law. The current version is always available on this page, with the date of the last update. Where a change materially affects how we use data already collected, we will provide additional notice.

15. Contact

• Store: Quorivella
• Website: https://quorivella.shop
• Email: hello@quorivella.shop