Privacy
1. Introduction
This privacy policy describes how Buried under Clothes collects, uses and shares personal data from users of the website 1 . The primary objective of this policy is to provide maximum transparency regarding the information that the site collects and how it is used, underlining Buried under Clothes' commitment to protecting the privacy of users and ensuring that personal data is treated securely and responsibly, in accordance with the General Data Protection Regulation (GDPR) and the Italian legislation on the protection of personal data 2 . The company recognizes the importance of users' privacy and is committed to processing personal data only in accordance with this policy and applicable data protection laws, with particular attention to the GDPR and national regulations 2 .
An e-commerce website with a compliant privacy policy not only improves the relationship with users, but also prevents potential sanctions from the Data Protection Authority 3 . Providing clear and precise information about how personal data is processed increases the level of trust of users, incentivizing them to interact and make purchases on the site. Therefore, this policy is written to provide users with a clear and concise understanding of Buried under Clothes' data management practices, strengthening trust and ensuring legal compliance.
2. Definitions
To ensure a clear and unambiguous understanding of this information, the definitions of some key terms used are reported below, in line with the GDPR 4 :
● Personal Data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person 4 . Under the GDPR, only natural persons can be considered as data subjects, while legal persons are excluded 5 .
● Interested party: The natural person to whom the personal data refers 4 .
● Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction 4 .
● Data Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In the context of this privacy policy, the Data Controller is Buried under Clothes.
● Data Controller: The natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller 4 .
● Profiling: Any form of automated processing of personal data consisting of the use of data... source to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements 4 . Where Buried under Clothes uses profiling to provide personalised recommendations or for marketing purposes, this will be clearly defined in this notice.
Using precise and GDPR-compliant definitions is essential to ensure that users fully understand their rights and how Buried under Clothes processes their personal data. Adopting this standard terminology helps to avoid ambiguity and promote greater transparency in the relationship between the company and its users.
3. Types of Personal Data Collected
Buried under Clothes collects different types of personal data from users in order to provide its services and improve the shopping experience. This data can be provided directly by the user or collected automatically while browsing the site 1 .
The personal data provided directly by users include:
● Contact information: First name, last name, email address and telephone number 6 .
● Shipping Address: Full address for delivery of orders 6 .
● Billing Information: Billing address and payment details, including credit card information or other information related to your chosen payment method 7 .
● Account login credentials: Email address and password used to register and log in to your user account 7 .
● Data relating to custom clothing orders: Designs chosen, sizes, colors, texts or images provided for the customization of the garments 6 .
In addition to the data you provide voluntarily, Buried under Clothes automatically collects some information relating to your use of the website 8 :
● Date and time of visit: Information about when the user visited the site 8 .
● Country of Origin: Approximate geographic location of the user 8 .
● Browsing behavior: Pages visited, time spent on the site, clicks made and other interactions with the website 8 .
● Device information: Device type (computer, tablet, smartphone) and its features 9 .
The collection of "purchase preferences" and personalization data 6 is particularly relevant for Buried under Clothes, as it is at the heart of the service offered. It is important to note that this information is used specifically to personalize the products requested by the user and may be treated separately from other personal data. The analysis of IP addresses and browsing behavior 8 may be used for profiling purposes, in order to improve the user experience and further personalize the offer. In this case, the methods and legal basis of such processing will be explained in this notice.
4. Purpose of Data Processing
Buried under Clothes processes users' personal data for various purposes, all aimed at providing an efficient and personalized service 6 :
● Processing and fulfilling your custom apparel orders: Using the data you provide to create and ship the custom products you request 7 . This purpose involves processing the designs, sizes, colors and texts you provide for customization.
● Customer communication: Answer questions, provide customer support, and communicate updates regarding orders, shipping, and any issues 7 .
● User account management: Create and manage user accounts, allowing them to access their order history, save preferences and manage their personal information 6 .
● Payment Processing: Securely handle payments for purchases made on the site 7 .
● Compliance with legal obligations: Comply with applicable tax, accounting and other legal provisions 7 .
● Fraud prevention and website security: Monitor activity on the site to identify and prevent fraudulent activity or unauthorized access, ensuring the security of the site and user data 7 .
● Website analytics and user experience improvement: Analyze browsing data to understand how users use the site, identify areas for improvement and optimize the shopping experience 6 .
● Personalising your user experience: Using data about your shopping preferences and browsing behaviour to personalise the content you see on the site and suggest products that may be of interest to you 7 . Where Buried under Clothes uses artificial intelligence (AI) to provide personalised recommendations, we will clearly explain how this personalisation works and the data used by the AI algorithms.
● Sending marketing communications (with consent): Sending newsletters, promotional offers and other marketing communications relating to products or services that may be of interest to you, only if you have given your explicit consent for such communications 10 .
The purpose of "processing and fulfilling custom clothing orders" involves specific processing of the customization data provided by the user. It is important to clarify that these designs or texts may be used during the production process and may be retained to facilitate any reorders or for internal analysis to improve the customization options offered. The specific purposes for retaining such data will be detailed in the section on the retention period.
5. Legal Basis for Data Processing
Buried under Clothes processes users' personal data on the basis of different legal bases provided for by the GDPR 3 :
● Performance of the contract: The processing of personal data is necessary for the performance of the purchase contract concluded between you and Buried under Clothes, in order to process and ship orders, manage accounts and process payments 3 . This legal basis applies in particular to the processing of customization data necessary for the production of the requested products.
● Compliance with legal obligations: The processing of personal data is necessary to comply with legal obligations to which Buried under Clothes is subject, such as tax and accounting regulations 3 .
● Consent: The processing of personal data for marketing purposes and for the use of specific cookies occurs only with the explicit consent of the user 3 . The consent mechanisms implemented by Buried under Clothes comply with the requirements of the GDPR, ensuring that consent is free, specific, informed and unambiguous 10 .
● Legitimate interest: The processing of personal data for the purposes of website analytics, improving user experience and preventing fraud is based on Buried under Clothes' legitimate interests in managing and improving its business, provided that such interests do not override your fundamental rights and freedoms 3 . In assessing legitimate interest, Buried under Clothes carries out a balancing of interests, as suggested by 17 , to ensure that the processing is proportionate and does not infringe your rights.
The legal basis for processing your personalisation data, other than to perform the contract to fulfil your order, may include our legitimate interest in retaining such designs to improve future personalisation options offered by Buried under Clothes. Alternatively, where designs uploaded by you are used in marketing materials showcasing past customer designs, we may ask for your explicit consent for such use. Buried under Clothes will endeavour to clearly state the specific legal basis for each stage of data processing, including for personalisation data.
6. Data Retention Period
Buried under Clothes retains users' personal data for a period of time no longer than is necessary for the purposes for which they were collected, in accordance with Article 5(1)(e) of the GDPR 7 . Specific retention periods vary depending on the category of data and the purposes of processing:
● Order data: Order data is retained for 10 years from the date of completion of the order, in order to comply with tax and accounting obligations and for any legal disputes 7 .
● Customer Service Communications: Customer Service communications are retained for as long as necessary to resolve your request and for a short period thereafter for record-keeping and service improvement purposes 7 .
● Marketing data: Data used for marketing purposes is retained until the user withdraws their consent 6 . The initial retention period for marketing data is established based on internal assessments, considering factors such as the life cycle of products and the frequency of repurchase by customers 10 .
● Account data: User account data is retained as long as the account is active and for a period thereafter for security reasons and to allow the account to be reactivated.
● Website analytics data: Data used for website analytics is retained for a period consistent with Buried under Clothes' analytics practices, for example, and no longer than 12-24 months.
● Personalization data: The designs and texts provided for personalization are retained for a period of 12 months in order to facilitate any reorders by the user and for internal analysis aimed at improving the personalization options offered.
Some data may be retained for longer periods if necessary to fulfil multiple legitimate purposes 7 . Buried under Clothes is committed to the principle of data minimisation, retaining data only for as long as is strictly necessary for the specified purposes and implementing processes to periodically review and delete data that is no longer necessary 7 .
7. Data Security Measures
Buried under Clothes takes appropriate technical and organizational security measures to protect users' personal data from unauthorized access, loss, destruction or improper use 2 . Such measures include:
● SSL/TLS encryption: The use of Secure Socket Layer (SSL) or Transport Layer Security (TLS) encryption to protect the transmission of personal data while browsing the website 2 .
● Secure storage: The storage of personal data on secure servers with access limited to authorised personnel only 2 .
● Technical and organizational measures: The implementation of technical and organizational measures aimed at preventing unauthorized access, loss or improper use of data 19 .
● Security audits and updates: Conducting regular security audits and updating systems and software to protect data from vulnerabilities 20 .
● Payment Information Protection: Taking steps to protect your payment information, such as complying with PCI DSS standards (if applicable) or using secure third-party payment service providers.
Given the potential sensitivity of data relating to customisation requests, Buried under Clothes is committed to maintaining robust security measures and reviewing them regularly, extending security considerations to the design upload and production stages. Where third party service providers (such as hosting, payment processing or marketing) have access to personal data, Buried under Clothes ensures that such providers also implement appropriate security measures and that contractual agreements include security obligations compliant with Article 28 of the GDPR 23 .
8. Transfer of Data to Third Parties
Buried under Clothes may share your personal data with certain categories of third parties for the purposes described in this notice 6 :
● Payment service providers: To securely handle payments for purchases.
● Couriers and shipping companies: For fulfilling orders and delivering products.
● Hosting service providers: For website and data storage.
● Analytics providers: To analyse website performance.
● Marketing platforms: For sending promotional communications (only with the user's consent).
● Legal or regulatory authorities: If required by law.
● Potential manufacturing partners: Third-party companies involved in the creation of custom apparel.
Where third parties process data on behalf of Buried under Clothes (for example, a web agency for the maintenance of the website 25 or production partners), they act as Data Processors. In such cases, Buried under Clothes ensures that a data processing agreement is in place, as required by Article 28 of the GDPR, specifying the purpose and duration of the processing 23 . Any involvement of third party production partners in the creation of customised clothing will be clearly indicated in this notice, specifying the purposes for sharing customisation data with them. Buried under Clothes is committed to selecting third party service providers who provide sufficient guarantees regarding the protection and security of data, verifying their compliance with the GDPR or equivalent standards.
9. Transfer of Data Outside the EU
Buried under Clothes may transfer personal data to countries outside the European Economic Area (EEA) 6 . In such cases, appropriate safeguards will be implemented to ensure a level of data protection compliant with the GDPR 28 . Such safeguards may include:
● Transfer to countries benefiting from an adequacy decision by the European Commission.
● The implementation of Standard Contractual Clauses (SCCs) approved by the European Commission with data recipients. Where possible, a link to the relevant SCCs will be provided.
● Obtaining explicit consent from the user for specific transfers.
Buried under Clothes is committed to conducting data transfers outside the EEA in accordance with the requirements of the GDPR and to regularly monitor legal developments regarding international data transfers, updating its transfer mechanisms and this privacy policy accordingly.
10. User Rights
Users have a number of rights in relation to their personal data under GDPR 3 :
● Right of access (Art. 15 GDPR): Users can request information about the personal data Buried under Clothes holds about them.
● Right to rectification (Art. 16 GDPR): Users can request the correction of inaccurate or incomplete personal data.
● Right to erasure (“right to be forgotten”) (Art. 17 GDPR): Users can request the erasure of their personal data in certain circumstances.
● Right to restriction of processing (Art. 18 GDPR): Users may request the restriction of the processing of their personal data in certain circumstances.
● Right to data portability (Art. 20 GDPR): Users can request to receive their personal data in a structured, commonly used and machine-readable format and to transmit them to another data controller.
● Right to object (Art. 21 GDPR): Users may object to the processing of their personal data in certain circumstances, including processing for direct marketing purposes.
● Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, users have the right to withdraw their consent at any time.
● Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Users have the right to lodge a complaint with the Data Protection Authority if they believe that their rights have been violated.
● Right not to be subject to automated decision-making, including profiling (Art. 22 GDPR): Where Buried under Clothes uses automated decision-making processes which produce legal effects or significantly affect you, you have the right to obtain human intervention.
To exercise their rights, users can send a request to the email address specified in the "Contact Information" section. Buried under Clothes undertakes to verify the identity of the requester 38 and to respond to requests within the terms set by the GDPR (generally within one month).
11. Cookie Policy
The Buried under Clothes website uses cookies to improve your experience and to collect information about how you use the site 7 . Cookies are small text files that are stored on your device while you are browsing.
The site uses the following categories of cookies:
● Strictly necessary cookies: These cookies are essential for the operation of the website and enable users to navigate and use its features, such as accessing secure areas. These cookies can be used without the user's consent 40 .
● Performance cookies: These cookies collect information about how users use the website, for example which pages they visit most often and if they receive error messages. These cookies help to improve the functioning of the site. If used without explicit consent, they are configured to prevent direct identification of users, for example by anonymizing IP addresses, in accordance with the guidelines of the Garante 48 .
● Functionality cookies: These cookies allow the website to remember user choices (such as language or region) and provide enhanced, more personalised features.
● Targeting or advertising cookies: These cookies are used to track users across websites. The intention is to display ads that are relevant and engaging for the individual user. The use of these cookies requires the explicit consent of the user, obtained via a GDPR 40 compliant cookie banner .
The Buried under Clothes website uses a cookie banner that allows users to provide granular consent to the use of cookies, to close the banner without consenting to the use of non-essential cookies, and to access this privacy policy 40 . Users can review and change their cookie preferences at any time via a link in the footer of the website 44 .
12. Contact Information
For any questions or concerns regarding this privacy policy or the processing of personal data, users may contact Buried under Clothes at:
Buried under Clothes
Villanova of Camposampiero, Via Caltana
buriedunderclothes@gmail.com
Designating a specific email address for privacy inquiries facilitates the efficient handling of user inquiries and demonstrates Buried under Clothes' commitment to promptly addressing privacy concerns. Buried under Clothes is committed to actively monitoring the contact information provided and responding to user inquiries within the timeframes specified by the GDPR (typically one month).
13. Updates to the Privacy Policy
Buried under Clothes reserves the right to update this privacy policy from time to time to reflect changes in legal requirements or our data practices. In the event of significant changes, users will be notified via a prominent notice on the website for a reasonable period of time or, for material changes, via email notification to registered users. Users are encouraged to review this privacy policy regularly, with the date of the last update clearly stated at the top of the document. Buried under Clothes may maintain a version history of the privacy policy for transparency, allowing users to see how the policy has evolved over time. Buried under Clothes is committed to regularly reviewing and updating its privacy policy to ensure its accuracy and to ensure it complies with the latest legal developments and our business practices.