Privacy Policy

1. Data Controller

P.R.P. di Nesca M.Lucia & C. S.A.S.
Corso Roma, 37 — 73039 Tricase (LE) — Italy
Email: prpshop.it@gmail.com
Tel: +39 0833544824

2. Data processed, purposes and legal bases

Order management and contractual relationship

Personal data provided at the time of purchase (name, surname, shipping and billing address, email address, telephone number, payment data) are processed for the execution of the sales contract: order management, invoicing, shipping and after-sales support. Legal basis: performance of a contract (Art. 6.1.b GDPR).

Tax and accounting obligations

Billing data are retained to comply with Italian tax and accounting obligations. Legal basis: legal obligation (Art. 6.1.c GDPR). Retention period: 10 years from the invoice date.

Transactional communications

The email address is used to send order confirmations, shipping information and communications necessary for contract management. Legal basis: performance of a contract.

Management of withdrawal declarations

When the Customer exercises the right of withdrawal through the online function provided for by Art. 54-bis of the Italian Consumer Code, the following are recorded: first and last name, email address, order reference, products subject to withdrawal, any optional message, date and time of submission, IP address and browser user-agent. The processing of the IP address and user-agent serves the need to document the authenticity and timeliness of the declaration, which produces legal effects. Legal basis: performance of a contract (Art. 6.1.b GDPR) and legal obligation (Art. 6.1.c GDPR). Retention period: 10 years from the date of the declaration.

Website measurement and analytics

With the user's consent, we collect anonymous statistical data on website usage through Google Analytics 4 and Microsoft Clarity. Legal basis: consent (Art. 6.1.a GDPR). Consent may be withdrawn at any time via the cookie preferences panel.

Advertising and remarketing

With the user's consent, we use Google Ads and Google Conversion Linker to measure advertising campaigns and show relevant advertisements. Legal basis: consent (Art. 6.1.a GDPR).

3. Processing methods and security

Data are processed using electronic tools and appropriate security measures to prevent unauthorised access, loss or alteration. Payment data are not stored by the website: transactions are managed by PayPal, which has its own certified security systems.

4. Data retention

  • Order and billing data: 10 years (tax obligation).
  • Withdrawal declarations and related technical authentication data (IP, user-agent, timestamp): 10 years.
  • Contact data for support: until the request is resolved and for 2 subsequent years.
  • Analytics data: in accordance with Google Analytics (max 14 months) and Microsoft Clarity retention policies.
  • Cookie preferences: 182 days from the date of choice.

5. Recipients and data transfers

Data may be shared with:

  • Couriers and shipping companies — for product delivery.
  • Accountants and tax advisors — for accounting and tax compliance.
  • Google LLC — for Analytics, Ads and Tag Manager (USA; transfer covered by Standard Contractual Clauses).
  • Microsoft Corporation — for Microsoft Clarity (USA; transfer covered by Standard Contractual Clauses).
  • PayPal — for payment processing.

Data are not sold to third parties or shared for unauthorised marketing purposes.

6. Data subjects' rights

Under the GDPR, users have the right to:

  • Access — obtain confirmation of processing and a copy of the data;
  • Rectification — correct inaccurate or incomplete data;
  • Erasure — request deletion of data (subject to legal retention obligations);
  • Restriction — limit processing in certain circumstances;
  • Portability — receive data in a structured, machine-readable format;
  • Objection — object to processing for marketing purposes;
  • Withdrawal of consent — at any time, for consent-based processing.

Requests may be sent to prpshop.it@gmail.com. The Data Controller will respond within 30 days. If the response is unsatisfactory, users may lodge a complaint with the Italian Data Protection Authority (Garante).

7. Cookies and tracking technologies

The website uses technical cookies and, with the user's consent, analytics and marketing cookies. For detailed information on the cookies used, their purposes and how to manage consent, please read the Cookie Policy.

8. Legal references

  • Regulation (EU) 2016/679 — GDPR
  • Italian Privacy Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018)
  • Swiss Federal Act on Data Protection — nLPD (for users in Switzerland)
  • Brazilian General Data Protection Law — LGPD, Law no. 13.709/2018 (for users in Brazil)
  • CCPA/CPRA (for users in California)

9. Updates

This Privacy Policy may be updated. The date of the last amendment is shown below. Users are advised to consult it periodically.

Last updated: July 2026