Privacy Policy

This notice explains how personal data of visitors to this website are processed, in particular of those who send a reservation request or a message, pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR") and the Italian Privacy Code (Legislative Decree 196/2003 as amended).

Data controller

Vittoria Vintage dal 1971 di Ester Vittoria Gulisano (sole proprietorship), VAT no. 11019460010, REA TO-1181324, Via Monferrato, 14/D, 10131 Turin (Italy). Contacts: vittoriavintage@gmail.com, PEC vittoriavintage@pec.it, phone 339 523 5868.

What data we collect

• Forms (reserve a piece, waiting list, "notify me", message): name, phone number or email, preferred contact channel, when you plan to visit, your message and the piece you are interested in.
• Proof of consent: date and time of the request and the version of the texts accepted.
• Security: the IP address, kept for a maximum of 24 hours only to block abuse (e.g. automated requests).
• Browsing data: technical logs (IP address, browser, pages requested) processed by the hosting provider to deliver the site and protect it, kept for a few days.

Purposes and legal basis

• Replying to your request and setting aside the piece you asked for — Art. 6(1)(b) GDPR (steps taken at your request before a possible purchase).
• Site security and abuse prevention — Art. 6(1)(f) GDPR (legitimate interest).
• Legal obligations, where applicable — Art. 6(1)(c) GDPR.

Providing the data is necessary to reply to you. We do not use your data for marketing, we do not create profiles and we make no automated decisions. We do not sell or share data with third parties for commercial purposes. The service is not intended for children under 14.

WhatsApp, phone, email and social networks

If you contact us via WhatsApp, phone or email, we use your data only to reply. WhatsApp (Meta) processes messages as an independent controller under its own privacy policy. Links to Instagram, Facebook, Vestiaire Collective and Google Maps are simple links: nothing is loaded from those services until you click them, and from then on their own policies apply.

How long we keep data

Requests received through the site are kept for 12 months and then deleted, unless a longer period is required by law (e.g. tax records of a purchase made in store).

Service providers and transfers outside the EU

The data are processed by technical providers acting as data processors, only as needed to run the site:

• Vercel Inc. — website hosting
• Neon (Neon Inc.) — database of requests, hosted in the EU (Frankfurt)
• Resend (Plus Five Five Inc.) — email notifications to the owner
• Google (Gmail) — the owner's mailbox

Some providers are based in the United States: any transfer takes place under the EU–US Data Privacy Framework adequacy decision and/or the Standard Contractual Clauses approved by the European Commission.

Security

The site uses encrypted HTTPS connections; the reserved area is protected by a password, two-step verification and blocking of repeated attempts. In the event of a personal data breach, the controller follows the procedure of Articles 33–34 GDPR.

Your rights

You can at any time ask for access, rectification, erasure, restriction, portability of your data or object to their processing (Articles 15–22 GDPR) by writing to the contacts above. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Cookies

The public site does not use profiling or analytics cookies. Details in the Cookie Policy.

Changes

This notice may be updated; the date of the last update is shown at the top of the page.