Privacy policy

Last updated: 30 June 2026

This notice is provided pursuant to arts. 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, "Codice Privacy") and describes how Vittorio Citro S.r.l. collects, uses, stores and protects the personal data of users of the vittoriocitro.it website and of its customers.

1. Data controller

The data controller is:
Vittorio Citro S.r.l.
Via Sasso 1, 84086 Roccapiemonte (SA), Italy
VAT No. / Tax Code: 05556330651 — REA SA-455471
Email: info@vittoriocitro.it — PEC (certified email): vittoriocitro@pec.it
Telephone: +39 081 1972 3599

For any matter relating to the processing of personal data and to exercise your rights, you can use the contact details above or the Privacy Centre available on the website.

2. Categories of personal data processed

Depending on how you interact with the website and services, we may process:

  • Identification and contact data: first name, surname, billing and shipping address, email, telephone number.
  • Payment data: data relating to the transaction and payment method. Full card details are processed directly by the payment providers and are not stored by us.
  • Account data: credentials, preferences, settings.
  • Order and transaction data: items viewed, added to the basket or wish list, purchased, returned or exchanged; order history.
  • Communications: content of communications with customer service, requests, complaints.
  • Browsing and device data: IP address, browser and device type, identifiers, data collected through cookies and similar technologies.
  • Usage data: interactions with the website and services.

We do not intentionally collect special categories of data (art. 9 GDPR). Please do not send us such data unless strictly necessary.

3. Sources of data

Data may be collected: directly from you (registration, orders, communications); automatically through the website, cookies and similar technologies; from our service providers and from partners or third parties who process it on our behalf.

4. Purposes and legal bases of processing

We process your personal data for the following purposes, each with its legal basis under art. 6 GDPR:

  • Performance of a contract (art. 6.1.b): managing and confirming orders, processing payments, shipping and delivery, handling returns, withdrawals, exchanges and refunds, creating and managing your account, customer service.
  • Legal obligation (art. 6.1.c): tax, accounting, invoicing and record-keeping obligations, as well as other obligations provided for by law.
  • Legitimate interest (art. 6.1.f): security of the website and systems, fraud prevention and detection (including checks on orders and cash on delivery), improvement of products and services, establishment, exercise or defence of legal claims, and direct marketing by email to existing customers concerning products or services similar to those already purchased (with the option to object at any time).
  • Consent (art. 6.1.a): sending the newsletter and marketing communications to non-customers or through additional channels, profiling for promotional purposes, use of non-technical cookies and technologies. Consent is optional, specific and may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5. Whether providing data is mandatory

Providing the data necessary for the performance of the contract and for compliance with legal obligations is mandatory: refusal makes it impossible to complete the order. Providing data for marketing and profiling purposes is optional, and any refusal does not affect your ability to make purchases.

6. Profiling and automated decision-making

We may analyse your preferences and purchases in order to offer you personalised recommendations and communications. We do not make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you within the meaning of art. 22 GDPR. You nevertheless have the right to object to profiling for marketing purposes.

7. Recipients and categories of recipients

Within the limits of the purposes indicated above, data may be disclosed to:

  • Shopify, as provider of the e-commerce platform and related services (hosting, checkout, management tools);
  • payment providers (e.g. Shopify Payments, PayPal, Scalapay, Klarna) for processing transactions;
  • couriers and logistics operators (e.g. GLS, BRT) for shipping and delivery;
  • returns management platform (e.g. ifReturns) for handling returns and exchanges;
  • email marketing and automation providers (e.g. Klaviyo) for communications you have consented to;
  • analytics and advertising providers (e.g. Google, Meta, TikTok, Pinterest), within the limits of the consent given through the cookie banner;
  • consultants and professionals (e.g. accountants, legal advisers) and competent authorities, where required by law.

Where these parties process data on our behalf, they are appointed as data processors pursuant to art. 28 GDPR. An up-to-date list of processors is available on request from the Controller's contact details.

8. Transfers outside the EU

Some providers (in particular Shopify and the analytics/advertising providers) may process data in countries outside the European Economic Area, including the United States. In such cases, the transfer is based on an adequacy decision (e.g. the EU-US Data Privacy Framework) or on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional measures.

9. Retention periods

  • Order, billing and accounting data: 10 years from the completion of the transaction (civil-law and tax obligations).
  • Account data: for the lifetime of the account and up to 24 months from the last activity, unless you request otherwise.
  • Marketing and newsletter data: until consent is withdrawn or erasure is requested, with periodic checks of continued interest.
  • Browsing data and cookies: according to the durations stated in the Cookie Policy.
  • Data processed for fraud prevention and the defence of legal claims: for the time necessary to protect our rights.

At the end of the periods indicated, data are deleted or anonymised, unless further legal obligations apply.

10. Processing methods and security

Data are processed using electronic and paper-based tools, adopting appropriate technical and organisational measures pursuant to art. 32 GDPR to ensure their confidentiality, integrity and availability and to prevent unauthorised access, loss or misuse. No system can, however, guarantee absolute security; please keep your login credentials safe.

11. Rights of the data subject

As a data subject you may exercise, within the limits and under the conditions laid down in arts. 15-22 GDPR, the following rights:

  • access to your personal data;
  • rectification of inaccurate or incomplete data;
  • erasure ("right to be forgotten");
  • restriction of processing;
  • data portability;
  • objection to processing based on legitimate interest and, in particular, to direct marketing and profiling;
  • withdrawal of consent, at any time, for processing based on it.

You can exercise your rights by contacting the Controller at the details given in point 1. We will respond within the time limits laid down by law, subject to verification of your identity where necessary. Exercising your rights is free of charge, except in the cases provided for by law.

12. Complaint to the supervisory authority

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome — www.gpdp.it), or with the supervisory authority of the EU Member State in which you live or work.

13. Children's data

Our services are not intended for minors and we do not knowingly collect data from minors without the consent of the holder of parental responsibility. In Italy, consent to processing in relation to information society services is valid from the age of 14. If you believe that a minor has provided us with data without the necessary consent, please contact us so that it can be deleted.

14. Cookies and similar technologies

The website uses cookies and similar technologies as described in the Cookie Policy, available on the website, where you can manage your preferences at any time through the relevant banner.

15. Relationship with Shopify

The website is built on the Shopify platform, which processes data relating to access to and use of its services in order to provide and improve them. In relation to certain advanced features, Shopify may also process data as an independent controller. For more information, you can consult Shopify's consumer privacy policy and its privacy portal.

16. Changes to this notice

We may update this notice to reflect legislative, organisational or technical changes. The updated version will be published on this page with the date of the last update.

17. Contact

For questions about this notice or to exercise your rights:
Vittorio Citro S.r.l. — Via Sasso 1, 84086 Roccapiemonte (SA)
Email: info@vittoriocitro.com — PEC (certified email): vittoriocitro@pec.it
Telephone: +39 081 1972 3599