Informativa sulla privacy

thornandburrow.shop respects the privacy of customers, website visitors and other individuals whose personal information we process.

This Privacy Policy explains how personal data may be collected, used, disclosed, stored and otherwise processed when individuals visit thornandburrow.shop, create or use an account, place an order, communicate with us or otherwise interact with our online store.

For privacy enquiries, contact:

Email: info@thornandburrow.shop

The operator of thornandburrow.shop acts as the controller of personal data processed for its own ecommerce purposes, subject to the allocation of responsibilities between us and individual service providers under applicable data-protection law.

Applicable Data Protection Framework

Where applicable, personal data is processed in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679, Italian data-protection legislation and other applicable privacy and electronic-communications requirements.

The GDPR provides individuals with rights including access, rectification, erasure, restriction, objection and portability.

Personal Data We May Collect

Depending on how a customer interacts with thornandburrow.shop, we may collect categories of personal data including:

Identity Information

Such as:

• Name;
• Billing name;
• Shipping recipient name; and
• Account identifiers.

Contact Information

Such as:

• Email address;
• Telephone number;
• Billing address; and
• Delivery address.

Order and Transaction Information

Such as:

• Products purchased;
• Order number;
• Order date;
• Purchase amount;
• Discounts;
• Shipping method;
• Delivery status;
• Return information;
• Refund information; and
• Customer-service history.

Payment-Related Information

Payments may be processed through payment service providers.

Depending on the payment method, relevant information may include transaction identifiers, payment status and limited payment-related details.

Complete card information may be processed directly by authorised payment providers rather than being stored by thornandburrow.shop.

Device and Technical Information

When customers visit our website, certain information may be collected automatically, including:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Website interaction data;
• Approximate location derived from technical information;
• Referral information;
• Cookie identifiers; and
• Other similar technical information.

Customer Communications

If customers contact us, we may process information contained in emails, support requests, complaints, return requests and other communications.

How We Use Personal Data

We may process personal data for purposes including:

• Providing and operating the website;
• Processing purchases;
• Administering payments;
• Confirming transactions;
• Fulfilling orders;
• Arranging delivery;
• Providing order tracking;
• Processing cancellations;
• Managing returns and refunds;
• Providing customer service;
• Maintaining customer accounts;
• Detecting and preventing fraud;
• Protecting website and transaction security;
• Maintaining accounting and business records;
• Meeting tax and regulatory requirements;
• Managing legal claims;
• Improving website performance;
• Understanding website usage;
• Providing marketing where lawfully permitted;
• Managing customer preferences; and
• Complying with legal obligations.

Legal Bases for Processing

Where GDPR applies, we process personal data only where an appropriate legal basis exists.

Depending on the processing activity, the legal basis may include:

Performance of a Contract

Processing may be necessary to:

• Process an order;
• Receive payment;
• Arrange shipment;
• Deliver products;
• Process returns;
• Provide refunds; or
• Otherwise perform our contractual obligations.

Legal Obligations

We may process information where necessary to comply with accounting, tax, consumer-protection, fraud-prevention or other applicable legal requirements.

Legitimate Interests

Where permitted, we may process personal data for legitimate business purposes such as:

• Preventing fraud;
• Protecting our website;
• Maintaining network and information security;
• Understanding and improving operations;
• Establishing or defending legal claims; and
• Providing effective customer support,

provided that such interests are not overridden by the rights and freedoms of the relevant individual.

Consent

Where consent is required, we may rely on consent for activities such as certain marketing communications or non-essential cookies and tracking technologies.

Individuals may withdraw consent at any time where consent is the legal basis, without affecting processing that was lawful before withdrawal.

Shopify and Ecommerce Service Providers

thornandburrow.shop may use Shopify technology and other service providers to operate our ecommerce business.

Personal data may therefore be processed by categories of recipients including:

• Ecommerce platform providers;
• Hosting providers;
• Payment processors;
• Fraud-prevention providers;
• Fulfilment providers;
• Warehousing providers;
• Shipping carriers;
• Customer-support providers;
• Analytics providers;
• Marketing providers;
• IT and security providers;
• Professional advisers; and
• Authorities where disclosure is legally required.

Service providers are expected to process information according to applicable contractual and legal obligations.

Payment Processing

Payment information may be submitted directly to payment processors.

Payment processors may process personal data in accordance with their own legal obligations and privacy practices.

Customers should review relevant information presented by the payment provider where appropriate.

Shipping and Fulfilment

To fulfil an order, we may disclose information necessary for delivery to appropriate fulfilment providers, warehouses, logistics providers and shipping carriers.

Such information may include:

• Recipient name;
• Delivery address;
• Telephone number;
• Email address where necessary;
• Order information; and
• Shipment information.

Only information reasonably necessary for fulfilment and delivery should be disclosed.

Cookies and Similar Technologies

thornandburrow.shop may use cookies and comparable technologies to operate website functions, remember preferences, maintain sessions, protect checkout security, understand website performance and, where permitted, support analytics or advertising.

Italian privacy guidance generally requires that non-technical cookies and tracking tools not be activated by default before the user has provided valid consent where such consent is required.

Accordingly, where legally required:

• Necessary technical cookies may operate without marketing consent;
• Non-essential analytics, advertising or profiling technologies will be subject to appropriate consent mechanisms;
• Users will be offered appropriate choices;
• Consent should be freely given, specific, informed and unambiguous; and
• Users should be able to change or withdraw relevant choices.

Marketing Communications

Where permitted by law, we may send customers information concerning products, services, promotions or store news.

Where consent is required, such communications will be sent on the basis of appropriate consent.

Customers may unsubscribe through an unsubscribe mechanism included in relevant marketing communications or by contacting:

info@thornandburrow.shop

Transactional communications concerning an existing purchase, account, return, security issue or legal matter are not necessarily marketing communications.

Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, accounting, tax, fraud-prevention, contractual or dispute-resolution obligations.

Retention periods may vary depending on:

• Type of information;
• Purpose of processing;
• Legal requirements;
• Contractual requirements;
• Potential disputes;
• Security considerations; and
• Applicable limitation periods.

When personal information is no longer required, it may be deleted, anonymised or otherwise handled in accordance with applicable law.

International Data Transfers

Some ecommerce, technology, payment, logistics or service providers may process information outside Italy or outside the European Economic Area.

Where GDPR restrictions on international transfers apply, appropriate transfer mechanisms and safeguards will be used where required, which may include adequacy decisions, approved contractual safeguards or another lawful transfer mechanism.

Data Security

We use reasonable technical and organisational measures intended to protect personal information against risks including:

• Unauthorised access;
• Unlawful disclosure;
• Accidental loss;
• Alteration;
• Destruction; and
• Misuse.

No internet transmission or electronic storage method can be guaranteed to be completely secure.

Customers are responsible for maintaining the confidentiality of passwords and other account credentials under their control.

Data Subject Rights

Subject to conditions and exceptions established by applicable law, individuals may have the right to:

• Obtain information concerning the processing of their data;
• Request access to personal data;
• Request correction of inaccurate personal data;
• Request completion of incomplete data;
• Request erasure in qualifying circumstances;
• Request restriction of processing;
• Object to certain processing;
• Object to direct marketing;
• Receive qualifying personal data in a portable format;
• Request transfer of qualifying data to another controller where applicable;
• Withdraw consent where processing relies upon consent; and
• Exercise applicable rights concerning automated decision-making.

These rights are recognised under the GDPR.

Exercising Privacy Rights

To exercise applicable privacy rights, contact:

info@thornandburrow.shop

We may request information reasonably necessary to verify identity and protect personal data from unauthorised disclosure.

Requests will be handled in accordance with applicable data-protection law.

Complaints

Individuals who believe their personal data has been handled in violation of applicable data-protection law may contact us first at:

info@thornandburrow.shop

Where applicable, individuals also have the right to lodge a complaint with an appropriate supervisory authority, including the Garante per la protezione dei dati personali in Italy.

This right does not prevent individuals from pursuing other remedies available under applicable law.

Children's Privacy

thornandburrow.shop is intended for customers capable of entering into online purchase transactions under applicable law.

We do not intentionally seek to collect unnecessary personal information from children.

If we become aware that personal data has been collected in circumstances where processing is not legally permitted, we will take appropriate measures.

Third-Party Websites

Our website may contain links to websites or services operated independently by third parties.

We are not responsible for the independent privacy practices of third-party websites merely because they are linked from thornandburrow.shop.

Customers should review the privacy information provided by relevant third parties.

Changes to This Privacy Policy

We may update this Privacy Policy when reasonably necessary to reflect:

• Changes to our services;
• New website functionality;
• Changes in service providers;
• Operational changes;
• Legal requirements; or
• Regulatory guidance.

The updated version will display an appropriate revision date.

Material changes will be communicated where required by law.

Privacy Contact

Questions, requests or complaints concerning privacy may be sent to:

thornandburrow.shop
Email: info@thornandburrow.shop