PRIVACY AND PERSONAL DATA PROTECTION POLICY

Pursuant to Art. 13 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003 as amended.

This privacy policy describes how LVDUE S.r.l. (hereinafter, the "Company" or the "Data Controller") collects and processes the personal data of users and customers (hereinafter, the "User" or the "Customer") who browse the website, make purchases, or use the services offered.

Personal data will be processed in accordance with the principles of correctness, lawfulness, transparency, and protection of confidentiality, respecting the fundamental rights and freedoms of the data subjects.

1. Data Controller

LVDUE S.r.l.
Registered office: Via San Domenico 10, 80044 Ottaviano (NA) - Italy
Contact Email / Privacy Enquiries: info@Lavespadue.it

2. Types of Data Processed

The Company collects and processes the following types of personal data provided directly by the User or collected during navigation:

• Identification and contact data: First name, last name, email address, phone number, shipping and billing address, tax ID and/or VAT number.
• Payment and transaction data: Information relating to purchases made and payment methods (handled securely through third-party payment service providers).
• Browsing and technical data: IP address, browser type, access times, pages viewed, and other session identifiers.

3. Purposes and Legal Basis for Processing

Personal data are processed for the following purposes:

1. Contract execution and service provision: For managing purchase orders, shipping products, invoicing, customer support, and responding to enquiries.
   Legal basis: Performance of a contract or pre-contractual measures (Art. 6, par. 1, letter b GDPR).
2. Compliance with legal obligations: To comply with tax, accounting, administrative, or statutory obligations mandated by EU or national laws.
   Legal basis: Compliance with a legal obligation (Art. 6, par. 1, letter c GDPR).
3. Protection of rights and fraud prevention: To prevent fraudulent transactions, unlawful activities, and to protect the legal rights of the Company.
   Legal basis: Legitimate interest of the Data Controller (Art. 6, par. 1, letter f GDPR).
4. Commercial communications and Newsletter (optional): For sending promotional material, offers, and product updates, strictly subject to explicit User consent.
   Legal basis: Consent of the data subject (Art. 6, par. 1, letter a GDPR).

4. Nature of Data Provision

Providing identification, contact, and billing details is mandatory for concluding the contract and shipping products. Refusal to provide such data will make it impossible to process orders or deliver the requested services.

Providing data for marketing or newsletter purposes is optional, and withholding consent will not affect the User's ability to browse the website or place orders.

5. Data Processing Methods and Retention

Processing is carried out using electronic, automated, and manual tools, applying appropriate technical and organizational measures to prevent data loss, unlawful use, or unauthorized access.

Retention Period:

• Contractual and accounting data: Retained for 10 years from the date of the last purchase order in compliance with legal tax obligations.
• Browsing data: Retained for the strictly necessary time to ensure the technical functioning of the website.
• Marketing/Newsletter data: Retained until the User revokes consent or requests unsubscription.

6. Disclosure and Communication of Data

Personal data collected may be communicated to third parties necessary for fulfilling the purposes outlined above, such as:

• Couriers and logistics companies for product delivery;
• Banking institutions and payment gateways for transaction processing;
• Tax, legal, and administrative advisors of the Company;
• Technical service providers and web hosting vendors.

Personal data will never be publicly disseminated or sold to third parties for marketing or profiling purposes.

7. Data Subject Rights (Arts. 15–22 of the GDPR)

The User has the right to exercise their rights under the GDPR at any time. In particular, Users may request:

• Access to their personal data and receive a copy thereof;
• Rectification or updating of inaccurate data;
• Erasure ("right to be forgotten") where data are no longer necessary or required by law;
• Restriction of processing or objection to the processing;
• Data portability in a structured, commonly used, and machine-readable format;
• Withdrawal of consent previously given for marketing purposes.

Users also have the right to lodge a complaint with the relevant Data Protection Authority (www.garanteprivacy.it).

8. How to Exercise Your Rights & Contact Details