PRIVACY POLICY

PRIVACY POLICY 

Last updated: 03/06/2026

This policy ("Privacy Policy") is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and applicable Italian law (Legislative Decree 196/2003 as amended).


It applies to users who browse, register and/or purchase on the Vintage Bro website (the "Site"). This policy does not apply to third-party sites/services that may be accessed via links.

1) Data Controller

Ditta Paolo Musolino - VINTAGE BRO  
Registered and operational office: Via Flaminia, 86 – 00060 Castelnuovo di Porto (RM) – Italy
VAT no.: 17754831000 – REA: RM – 1740894
E-mail: info@vintagebro.it

2) DPO (Data Protection Officer)

The Data Controller has not appointed a DPO, as the mandatory conditions set out in Art. 37 GDPR are not met.

3) Types of data processed

3.1 Browsing data

During browsing, technical data such as: IP address, device/browser identifiers, pages visited, date/time of access, system parameters, security and diagnostic logs may be collected. This data is processed for operational and security purposes.

3.2 Data voluntarily provided by the user

Depending on the features used, we may process:

  • Registration/Account: name, surname, e-mail, telephone number (if provided), addresses, order history, preferences (e.g. wishlist if active).
  • Purchases: data necessary to fulfill the order (personal details, e-mail, telephone, shipping/billing address, order content, amounts, tax code if required).
  • Support/Contacts: data entered in communications (name, e-mail, telephone, message content).
  • Newsletter: e-mail and marketing preferences.

3.3 Payment data

Payment data (e.g. credit cards, PayPal, Klarna or other methods) are not managed directly by the Data Controller, but by the respective payment providers. The Data Controller normally only receives the outcome and/or technical identifiers of the transaction. For PayPal, please refer to their privacy policy.

3.4 Cookies and tracking tools (Analytics and Marketing)

The Site uses cookies and similar tools. In particular, if activated:

  • Google Analytics (measurement and statistics);
  • Meta Pixel (conversion measurement and marketing/remarketing activities);
  • TikTok Pixel (conversion measurement and marketing/remarketing activities).

The use of profiling/marketing cookies requires the user's consent and only after consent through the cookie banner. The information and consent rules are described in the Site's Cookie Policy and in the banner/cmp. 

 

4) Purpose of processing and legal bases

A) Operation, security and abuse prevention

technical management of the Site, security, logs, fraud prevention, system protection.
Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) and technical necessity. The Data Controller may carry out checks aimed at preventing fraud, abusive use of payment systems, identity theft, fraudulent chargebacks and other illegal activities that may cause damage to the company, customers or payment service providers. As part of fraud prevention activities and the protection of its rights, the Data Controller may store photographs and identification documentation of the marketed items, including details, serial numbers, labels, conditions and distinctive characteristics of the shipped products.

B) Account registration and management

account creation, personal area access, profile management, order history, preferences.
Legal basis: performance of a contract / pre-contractual measures (Art. 6(1)(b) GDPR).

C) Order fulfillment and online sales

checkout management, confirmations, shipping/delivery, operational and post-sale communications.
Legal basis: contract (Art. 6(1)(b) GDPR).

D) Legal and tax compliance

accounting, invoicing, legal obligations, authority requests.
Legal basis: legal obligation (Art. 6(1)(c) GDPR).

E) Customer support

responses to requests and complaints, customer care.
Legal basis: contract and/or legitimate interest (Art. 6(1)(b)/(f) GDPR, depending on the case).

F) Marketing (newsletter, promotions, new arrivals)

sending newsletters and promotional communications via Klaviyo, GetResponse or Mailchimp.
Legal basis: consent (Art. 6(1)(a) GDPR).

The user can withdraw consent at any time (see § 10).

G) Soft spam

If you purchase on the Site, we may send emails about products/services similar to those purchased, within the limits permitted by Italian law (Art. 130 Privacy Code) and the guidelines of the Garante, with the possibility of a simple and free opt-out in every communication. 

H) Statistics and measurement (Google Analytics)

traffic and performance analysis (also aggregated).
Legal basis: consent via cookie banner, unless configurations make analytics comparable to technical according to applicable guidelines.

I) Advertising/remarketing and conversion measurement (Meta Pixel / TikTok Pixel)

campaign measurement, conversion tracking, custom audience/remarketing.
Legal basis: consent via cookie banner (profiling/marketing).

5) Nature of data provision

The data necessary for order/account are essential: without them, we cannot provide the service (registration, purchase, delivery).

The data for newsletter/marketing are optional: if you do not give consent, you can still make purchases.

Consent for marketing cookies/trackers is optional: the Site can still be used even if you reject them (except for technical cookies).

If the user enters third-party data (e.g. gift recipient), they guarantee that they have the right to communicate it.

6) Processing methods and security

Data is processed using IT tools and, if necessary, paper-based ones, with logic consistent with the purposes and with adequate security measures (access controls, procedures, credential protection, etc.).

7) Shopify platform, location of processing and extra-EU transfers

The Site is based on Shopify, which operates with its own Data Processing Addendum (DPA).

The infrastructure and some providers may involve data processing and/or transfers to countries outside the EEA. In such cases, transfers occur with adequate safeguards provided by the GDPR (e.g., standard contractual clauses) and/or in the presence of adequacy decisions.

8) Newsletter (Klaviyo / GetResponse / Mailchimp or similar) and transfers

For newsletter management and promotional communications, we use platforms such as Klaviyo, Mailchimp or similar, which provide data processing agreements (DPA) and mechanisms for international transfers (e.g., SCC).

Klaviyo also indicates certification/adherence to the Data Privacy Framework (DPF) and the inclusion of SCC in its DPA.

9) Recipients of data (parties who may process it)

Data may be disclosed to:

  • personnel/collaborators authorised by the Data Controller;
  • IT providers (Shopify and related apps), hosting, maintenance;
  • couriers and logistics (shipping/delivery);
  • payment providers (e.g. PayPal, Klarna, card PSPs) according to their privacy policies; 

marketing/newsletter tools (Klaviyo/Mailchimp or similar); 

Google (Analytics) / Meta / TikTok only if the user gives consent via cookie/marketing banner, according to the Cookie Policy;

  • professionals (accountant, lawyer) and public authorities in foreseen cases.
  • For orders destined for non-EU countries, data strictly necessary for the execution of shipping and customs formalities (e.g. name, address, telephone number, e-mail, content of the shipment and its declared value) may be communicated to international couriers, freight forwarders, customs brokers, customs authorities and parties involved in the import procedures of the destination country.

Data is not disseminated to indeterminate subjects. An updated list of Data Processors pursuant to Art. 28 GDPR can be requested by writing to info@vintagebro.it.

10) Retention periods

Except as indicated in the Cookie Policy for cookies and trackers:

  • Orders, invoices, accounting: up to 10 years (or different term imposed by law).
  • Account: until the user requests deletion, unless it is necessary to retain data related to orders/legal obligations.
  • Customer support: up to 12 months from the closing request, unless there are disputes.
  • Newsletter/marketing: until consent is withdrawn and, in any case, for a reasonable period; as a practice, no more than 24 months in the absence of further interactions, unless consent/interest is renewed. 
  • Data for rights protection: for the time necessary to manage disputes/legal actions.

11) Data Subject Rights (Arts. 15–22 GDPR)

The user can exercise the rights of: access, rectification, erasure, restriction, objection, portability, as well as withdrawal of consent, by contacting info@vintagebro.it

 The Data Controller will respond within the terms provided by the GDPR.

Withdrawal of marketing consent

Consent can be withdrawn:

Complaint

It is always possible to lodge a complaint with the Italian Data Protection Authority.

12) Cookie management and consents (banner/cmp)

Consent to profiling/marketing cookies and trackers (Meta/TikTok and, as a rule, third-party Analytics) is managed via banner/CMP, in line with the Garante's guidelines (e.g., possibility to refuse, granular choice, non-invasive re-presentation, etc.).


Preferences can be changed at any time through the cookie management system indicated in the Cookie Policy.

13) Minors

The Site is not intended for minors who are not old enough to give valid consent under applicable law. If you believe that a minor has provided us with data, please contact us for its removal.

14) Transfers to the USA – Data Privacy Framework and other safeguards

For some providers, it may be necessary to transfer data to the United States. The EU has adopted an adequacy decision for the EU-U.S. Data Privacy Framework (DPF) (July 10, 2023) and has carried out subsequent reviews; furthermore, in 2025 the EU Court confirmed the validity of the framework in relevant litigation, increasing the legal certainty of transfers to certified organizations.


Where required or appropriate, providers also adopt Standard Contractual Clauses (SCCs).

15) Changes to this Privacy Policy

The Privacy Policy may be updated. In the event of significant changes, we will update the "Last updated" date and may post a notice on the Site.