Privacy Policy

a) Email communications: name and email address provided voluntarily by the user when writing to info@thekiss.it. These are processed solely to respond to the request and, where applicable, to manage an order. The legal basis is the execution of pre-contractual measures at the user's request (art. 6(1)(b) GDPR).

b) Browsing data: IP addresses, browser type, pages visited and timestamps, collected automatically by the web server for security and statistical purposes. These data are not used to identify users and are deleted as soon as they are no longer needed.

c) Cookies: this site uses only technical cookies, strictly necessary for correct navigation. No analytical or profiling cookies are used. For more information see the Cookie Policy.

Email communications will be retained for the time strictly necessary to process the request and manage any order, and in any case for no longer than 12 months from the date of receipt, unless a longer retention period is required by law or contractual obligation. Browsing data are deleted within 30 days.

Orders are processed via Stripe Payment Links, a payment service provided by Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA). At the time of purchase, the user is redirected to a secure page hosted by Stripe, where the transaction takes place.

On that page, Stripe collects and processes the personal data necessary to complete the payment, including: name, email address, billing and shipping address, and payment method details. Payment card data are collected directly by Stripe and are subject to its own Privacy Policy, available at stripe.com/privacy.

The name and shipping address included in the order are also received by the Data Controller via email, solely for the purpose of fulfilling the shipment. This processing is based on the execution of a contract (art. 6(1)(b) GDPR).

Stripe acts as an independent data controller for the purposes of payment processing and fraud prevention. The Data Controller of this site does not store or have access to full payment card details.

Stripe is certified under the EU-U.S. Data Privacy Framework, ensuring GDPR compliance for data transfers to the United States. To exercise your rights in relation to data collected by Stripe, contact privacy@stripe.com.

Personal data will not be disclosed or sold to third parties. Data may be shared only with technical service providers acting as data processors (e.g. web hosting provider, Stripe for payment processing) and with couriers and shipping companies entrusted with the delivery of orders, to whom only the name and shipping address are disclosed, strictly for the purposes of operating the website and managing orders, and only when such sharing is necessary. Any transfer of data outside the EU/EEA will take place in compliance with the guarantees provided for by Chapter V of the GDPR.

Data are processed using electronic tools. Appropriate technical and organisational security measures are in place to protect personal data against unauthorised access, loss or destruction, in accordance with art. 32 GDPR. The provision of personal data via email is optional but necessary to receive a response to your request.

This site uses only technical cookies, strictly necessary for correct navigation. No analytical or profiling cookies are used. For full details please refer to the Cookie Policy.

Pursuant to arts. 15–22 of EU Regulation 2016/679, you have the right to:

Access — obtain confirmation of whether your data are being processed and receive a copy.
Rectification — request correction of inaccurate or incomplete data.
Erasure — request deletion of your data ("right to be forgotten"), where conditions apply.
Restriction — request that processing be limited in certain circumstances.
Portability — receive your data in a structured, commonly used format.
Objection — object to processing based on legitimate interest.
Withdrawal of consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, write to info@thekiss.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at www.garanteprivacy.it.