Privacy notice

1. Data controller

Alessandro Bronda, Via Pistoia 26, 10144 Torino (TO), Italy, VAT no. IT12028510019.

Email: info@wildhorseshop.org · Certified email (PEC): alessandrobronda@ultracert.it

2. What data we process, why and for how long

Orders and payments

Name, email, phone, shipping and billing addresses, products bought, amounts, payment method and, for digital files, your consent to immediate delivery. Full card details stay with Stripe: we never see them. We need them to perform the contract (art. 6(1)(b) GDPR) and to meet tax and accounting obligations (art. 6(1)(c)). We keep them for 10 years, as required for accounting records.

Digital file downloads

Personal links, number and date of downloads: to deliver your files and prevent abuse (art. 6(1)(b) and 6(1)(f)). Kept with the order.

Withdrawal and support

Withdrawal request details and messages about your order, to handle them and show that we did (art. 6(1)(b) and 6(1)(c)). Kept with the order.

Contact form

Name, email, topic, order number if given and message, to reply to you (art. 6(1)(b) and 6(1)(f)). Kept for up to 24 months after the last exchange.

Newsletter

Email and language, only with your consent, confirmed through the link we email you (art. 6(1)(a)). Kept until you unsubscribe using the link in every newsletter; after that we only keep the address marked as “unsubscribed”, so that we don't write again. Unconfirmed sign-ups are deleted after 30 days.

“Notify me”

Email, language and product, to tell you once when it's back in stock (art. 6(1)(a)). The request is deleted after the notification and in any case after 12 months.

Website security

Technical data such as IP address and browser type, logged by our hosting providers to run the site and protect it from abuse (art. 6(1)(f)), for the time set by those providers.

3. Do you have to provide your data?

To buy, the data requested on the payment page is needed: without it we cannot conclude and deliver the order. Newsletter, “Notify me” and the contact form are optional.

4. Who receives the data

We use providers that process data on our behalf, under contracts requiring them to protect it, or as independent controllers for their own services:

• Stripe (Stripe Payments Europe Ltd., Ireland): payments. The services you choose at payment, such as PayPal, Klarna, Scalapay, Apple Pay or Google Pay, process data as independent controllers.
• Supabase: the shop's database, with data stored in the European Union.
• Cloudflare: storage of images and files, domain management and email forwarding.
• Netlify: website hosting.
• Resend: sending the shop's emails.
• Google (Gmail): the mailbox receiving messages sent to info@wildhorseshop.org.
• Carriers (Poste Italiane, BRT, GLS, DHL, SDA): name, address and phone for delivery.
• Accountant and advisers, for tax and legal compliance.
• Public authorities, only when required by law.

We do not sell your data or share it for marketing purposes.

5. Transfers outside the European Union

Some providers are companies based in the United States or affiliated with them. Transfers take place with the safeguards provided by the GDPR: the EU-US adequacy decision (Data Privacy Framework) for participating companies, or the standard contractual clauses approved by the European Commission.

6. Cookies

The site only uses technical tools needed to make it work: details are in the Cookie policy.

7. Automated decisions

We do not make decisions based solely on automated processing and we do not profile you.

8. Your rights

You can ask at any time to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. You can withdraw consent at any time, without affecting processing carried out before. Write to info@wildhorseshop.org or to the certified email alessandrobronda@ultracert.it: we reply within one month.

If you believe the processing breaks the law you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of your country.

9. Changes

If we change how we process data we will update this page and the date above.