Legal
Privacy Policy
Voléfanka is an online shop operated by:
LA CASA DELLA STAMPA DI MITIC VEDRANA
Via Udine 38, 34135 Trieste (TS), Italy
Trieste Companies Register, REA no. 211078
VAT number: IT01387230327
Certified e-mail (PEC): lcdsdivedrana@pec.it
E-mail: contact@volefanka.com
This notice is given under articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, to everyone who browses, registers, orders or otherwise interacts with volefanka.com (the “Site”).
It covers only what we do with personal data through the Site. It does not cover third-party sites you may reach from links here — read their own notices for that.
1. Who is responsible
The data controller is LA CASA DELLA STAMPA DI MITIC VEDRANA, Via Udine 38, 34135 Trieste (TS), Italy, Trieste Companies Register, REA no. 211078, VAT number IT01387230327, PEC lcdsdivedrana@pec.it, e-mail contact@volefanka.com, telephone .
We have not appointed a Data Protection Officer, as the conditions in article 37 GDPR do not apply to us.
For anything to do with your personal data, or to exercise your rights, write to us at the addresses above.
2. What we collect
2.1 Account details
If you create an account: name, e-mail address, telephone number, delivery and billing address, username and password. Your password is not readable by us — keep it to yourself.
You can also order as a guest, in which case we ask only for what is needed to fulfil the order.
2.2 Order, payment and invoicing details
Items ordered, sizes, quantities, amounts, billing and delivery address, chosen payment method, order history, returns and refunds.
Payments are handled by specialist third-party providers. We never receive or store your full card details — those go directly to the payment provider under its own terms and privacy notice.
2.3 Delivery details
The recipient’s name, address, contact details, any delivery instructions and the carrier’s tracking data, shared with the carrier handling your parcel.
2.4 Customer service
Your contact details and whatever you write to us through the Site, by e-mail or through other support channels, including photographs you send to support a complaint, a return or a guarantee claim.
2.5 Newsletter
If you subscribe, your e-mail address and the record of your consent.
2.6 Technical and browsing data
Our systems record, as any web server does: IP address, device domain names, the URLs requested, the time of the request, the method used, the size of the response, the response status code, and details of your operating system, browser and computing environment.
We use this to keep the Site working, to keep it secure, to prevent abuse and fraud, and to diagnose faults.
2.7 Cookies
The Site uses cookies and similar technologies to work correctly, to hold your session and basket, to keep things secure, to remember preferences, to measure usage and — only where you have agreed — to enable third-party features. Strictly necessary cookies do not require consent. Anything else is set only after you agree. See our Cookie Policy.
2.8 What we do not collect
The Site is not intended for special category data under article 9 GDPR — health, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation. Please do not send us any. We also do not sell to children: the Site is for people aged 18 and over.
We do not offer custom printing and there is nothing on the Site for you to upload, so we hold no artwork, no image files and no name lists belonging to you or to anyone else.
3. Third parties whose details you give us
If you give us someone else’s details — for example when sending an order to a different address — you are responsible for having a lawful basis to do so and for telling that person how their data will be used, as article 13 GDPR requires.
4. Where the data comes from
- directly from you, when you create an account, place an order, subscribe or contact us;
- automatically as you browse, through our systems, logs, cookies and security tools;
- from third parties such as payment providers, carriers and technical suppliers, to the extent needed to complete your order and keep the platform secure.
5. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account. | Performance of a contract or pre-contractual steps taken at your request — art. 6(1)(b) GDPR. |
| Taking, preparing, despatching and delivering your order; handling returns and guarantee claims. | Performance of a contract — art. 6(1)(b) GDPR. |
| Taking payment, issuing refunds, issuing invoices and keeping accounting records. | Performance of a contract — art. 6(1)(b) — and compliance with tax and accounting obligations — art. 6(1)(c) GDPR. |
| Answering questions, support requests and complaints. | Pre-contractual and contractual steps — art. 6(1)(b) — and our legitimate interest in dealing with what you send us — art. 6(1)(f) GDPR. |
| Keeping the Site secure, preventing fraud, abuse and misuse. | Our legitimate interest in a secure and reliable platform — art. 6(1)(f) GDPR. |
| Strictly necessary cookies and tools. | Our legitimate interest in the technical operation of the Site — art. 6(1)(f) GDPR. Everything else is set only with your consent — art. 6(1)(a) GDPR. |
| Sending the newsletter and promotional messages. | Your consent — art. 6(1)(a) GDPR — or, for products similar to ones you have already bought, art. 130(4) of Legislative Decree 196/2003, with the right to object at any time. |
| Recording the consents and preferences you have expressed. | Our legitimate interest in being able to demonstrate that our processing is lawful — art. 6(1)(f) GDPR. |
| Complying with legal obligations and orders from public authorities. | Compliance with a legal obligation — art. 6(1)(c) GDPR. |
| Establishing, exercising or defending legal claims. | Our legitimate interest in defending our rights — art. 6(1)(f) GDPR. |
6. Legitimate interest
Where we rely on legitimate interest we first carry out a balancing exercise to check that our interest does not override your rights and freedoms. You may object at any time, on grounds relating to your particular situation, to any processing based on legitimate interest.
7. Do you have to give us your data?
Your name, contact, billing and delivery details are needed to make and perform the contract. Without them we cannot register an account, accept an order or deliver it. Tax details are needed to issue an invoice, as the law requires.
Giving us your details for the newsletter is optional and refusing does not stop you buying. Consent to non-essential cookies is optional and does not affect the essential functions of the Site.
8. How we handle it
We use manual, electronic and online tools, in ways strictly connected to the purposes above, respecting lawfulness, fairness, transparency, minimisation, accuracy, storage limitation, integrity and confidentiality.
We take appropriate technical and organisational measures against unauthorised access, loss, destruction, disclosure or alteration — including TLS encryption of connections, controlled access credentials and backups.
Your data is handled by people we have authorised and instructed, and by external suppliers appointed as processors under article 28 GDPR, only so far as their work requires.
9. Who we share it with
- our staff and authorised collaborators;
- hosting, cloud infrastructure, technical maintenance and IT security providers;
- payment providers, card schemes, checkout gateways and anti-fraud services;
- carriers and logistics operators delivering your parcel;
- printers and suppliers who produce the garments;
- providers of e-mail delivery, customer support and statistical analysis;
- legal, tax and accounting advisers;
- public and judicial authorities, where disclosure is required by law or needed to defend our rights.
Depending on the case these act as processors appointed under article 28 GDPR or as controllers in their own right. We do not publish your data and we do not sell it.
10. Transfers outside the EEA
As a rule your data stays within the European Economic Area. Where a particular supplier makes a transfer necessary, it happens only to recipients covered by a European Commission adequacy decision, by a recognised compliance framework, or by the Standard Contractual Clauses approved by the Commission with supplementary measures where needed — or under a derogation in article 49 GDPR. You may ask us which transfers are in place and for a copy of the safeguards.
11. How long we keep it
- account data — while the account is active and for up to 24 months after it is closed;
- orders, payments, invoices and accounting records — for the period required by Italian civil and tax law, normally 10 years;
- support requests not followed by an order — up to 24 months;
- browsing data, technical logs and security data — up to 12 months, unless needed to investigate an offence;
- newsletter and marketing data — until you withdraw consent or object, and in any case no more than 24 months after your last interaction;
- cookie data — as set out in the Cookie Policy;
- data needed to establish, exercise or defend a legal claim — for the duration of the dispute and until the limitation periods expire.
Afterwards the data is deleted, anonymised or aggregated so that it can no longer be traced back to you.
12. Marketing and e-mail tracking
We send the newsletter only if you have asked for it. Under article 130(4) of Legislative Decree 196/2003 we may also use the e-mail address you gave when buying to tell you about similar products, unless you object. You can object at any time, free of charge and without formality, using the unsubscribe link in any message or by writing to us.
Promotional e-mails may record whether a message was opened and which links were clicked, so we can tell whether they are worth sending. Where the law requires it, this is done only with your consent, which you can withdraw at any time without losing the messages themselves.
13. Profiling and automated decisions
Other than any tracking tools described in the Cookie Policy and enabled only with your consent, we do not profile you for marketing. We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you.
14. Your rights
Under articles 15 and following of the GDPR you may at any time:
- ask whether we hold data about you and get access to it;
- have inaccurate data corrected and incomplete data completed;
- have data erased, in the cases set out in article 17;
- have processing restricted, in the cases set out in article 18;
- receive your data in a structured, commonly used, machine-readable format and, where technically feasible, have it sent directly to another controller (article 20);
- object to processing based on legitimate interest (article 21);
- withdraw consent at any time, without affecting the lawfulness of what we did before you withdrew it;
- object at any time to direct marketing, including the newsletter.
Write to the addresses in clause 1. We reply within the period the law allows, normally one month.
15. Complaints
If you think we are handling your data in breach of the GDPR you may complain to the Italian Data Protection Authority — garanteprivacy.it — or to the supervisory authority of the country where you live or work or where you think the breach happened. You may also go to court.
16. Changes to this notice
We may change this notice at any time and will publish the new version on this page with the date it was last updated. Please check it from time to time. If a change is substantial or affects processing based on consent, we will say so clearly on the Site or by e-mail and, where necessary, ask for your consent again.