Privacy Policy

Last updated: August 2026

1. Who We Are (Data Controller)

Calmanesa (“we”, “us”, “our”) operates the online store at calmanesa.com. We are the data controller responsible for the personal data collected through this website. For any privacy-related questions or requests, you can reach us at calmanesa117@gmail.com.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Personal Data We Collect

We collect the following categories of personal data:

Order and account data: name, email address, shipping and billing address, phone number, and details of the products you purchase.
Payment data: payments are processed by our payment provider (Stripe). We never see or store your full card number — only a confirmation of payment and the last digits of your card.
Subscription data: if you choose a Subscribe & Save plan, we store your subscription preferences and billing schedule so recurring orders can be fulfilled.
Communication data: messages you send us via the contact form, email, or the live chat on our website.
Technical and usage data: device type, browser, approximate location (country/city level), pages visited, and interactions with the store — collected only if you accept analytics cookies.

3. Why We Use Your Data (Purposes and Legal Bases)

To process and deliver your orders, including payment, shipping, returns, and customer service — necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).
To manage subscriptions and recurring billing — performance of contract (Art. 6(1)(b) GDPR).
To send order-related emails such as confirmations, shipping updates, and delivery notices — performance of contract (Art. 6(1)(b) GDPR).
To comply with legal obligations, such as tax and accounting rules that require us to keep invoices and order records (Art. 6(1)(c) GDPR).
To prevent fraud and secure our store — our legitimate interest (Art. 6(1)(f) GDPR).
To analyse site usage and show relevant advertising (analytics and marketing cookies, including advertising pixels) — only with your consent (Art. 6(1)(a) GDPR), which you give or refuse via our cookie banner and can withdraw at any time.
To send marketing emails about products and offers — only with your consent, and every email includes an unsubscribe link.

4. Who We Share Your Data With

We never sell your personal data. We share it only with service providers (processors) who help us run the store, and only to the extent necessary:

Payment processing: Stripe, to securely handle card payments.
Shipping and delivery: postal and courier services, to deliver your orders.
Hosting and store infrastructure: the technical providers that host our website and order system.
Email delivery: providers that send our order confirmation and service emails.
Analytics and advertising: analytics services and advertising platforms (such as TikTok), only if you consented to the corresponding cookies.
Customer support: our live chat provider, if you use the chat on our website.

Each provider is contractually bound to protect your data and use it only on our instructions.

5. International Transfers

Some of our service providers are located outside the European Economic Area (for example, in the United States). Where that is the case, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework).

6. How Long We Keep Your Data

Order and invoice data: kept for as long as required by tax and accounting law (in Italy, generally 10 years).
Account data: kept until you delete your account or ask us to delete it.
Marketing consents: until you withdraw consent or unsubscribe.
Analytics data: kept in aggregated or pseudonymised form and deleted or anonymised within the periods set by the analytics provider.

7. Your Rights

Under the GDPR you have the right to:

Access the personal data we hold about you (Art. 15);
Rectify inaccurate or incomplete data (Art. 16);
Erase your data (“right to be forgotten”, Art. 17);
Restrict how we process your data (Art. 18);
Receive your data in a portable format (Art. 20);
Object to processing based on legitimate interest, including profiling (Art. 21);
Withdraw consent at any time, without affecting processing carried out before withdrawal (Art. 7);
Lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), or the authority of your country of residence.

To exercise any of these rights, email us at calmanesa117@gmail.com. We will respond within one month.

8. Cookies

When you first visit our store, a cookie banner asks for your consent before any non-essential cookies are set. Essential cookies (shopping cart, checkout, security) are always active because the store cannot function without them. Analytics and marketing cookies are used only if you accept them, and you can change your choice at any time via the “Manage Cookies” link in the footer. For full details, see our Cookie Policy.

9. Security

All traffic between your browser and our store is encrypted (HTTPS/TLS). Payment details are handled exclusively by our PCI-DSS-compliant payment provider. Access to personal data is limited to what is strictly necessary to operate the store.

10. Children

Our store is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page shows when it was last revised. Significant changes will be highlighted on this page.

12. Contact

For any questions about this Privacy Policy or how we handle your personal data, contact us at calmanesa117@gmail.com.