We collect only the data we need to ship your oil and to comply with the law. We do no profiling, we do not sell data and we do not send advertising.
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”). It concerns visitors to the website and buyers of TOSVERO products.
1. Data controller
- Controller
- Andrea Lorenzini (TOSVERO brand)
- Address
- Via della Rimaggina 7, 50012 Bagno a Ripoli (FI), Italia
- info@tosvero.it
We have not appointed a Data Protection Officer (DPO), as this is not mandatory for a business like ours. For any question about your data, write to us using the contact details above.
2. What data we process
Data you give us when you order
- first name, last name, email, phone number;
- shipping address (street, postcode, city, province) and any delivery notes;
- if the order is a gift: the recipient's name and address and the text of the card;
- the content of the order (products, quantities, amounts) and the payment method chosen.
Communication data
When you send us the order or write to us on WhatsApp or by email, we receive the content of the message and your account details (phone number or email address, profile name).
Payment data
If you pay with the payment link, card details are collected and processed only by the payment service provider: we receive only the payment outcome, the amount and the essential identifying details of the transaction. If you pay by bank transfer, we receive the details provided by the bank (payer's name, IBAN, payment reference).
Technical browsing data
Like any website, the server hosting the site (Aruba S.p.A.) automatically records some technical data (IP address, date and time of the request, page requested, browser type) in system logs, to keep the service running and secure. We do not use this data to identify you and we do not use analytics or tracking tools.
Data saved on your device
The cart, the size you chose and the details you enter at checkout are saved only in your browser's memory (local storage), so that you do not lose them if you reload the page. They are not sent to us until you send the order. Details and a button to delete them are in the Cookie policy.
3. Why we process it and on what legal basis
| Purpose | Legal basis | How long |
|---|---|---|
| Answering your requests and assessing the order offer | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | Up to 12 months from the last contact, if no order is concluded |
| Handling the order: confirmation, payment, shipping, support, withdrawal and warranty | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and the 2-year legal warranty |
| Meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) | 10 years (Art. 2220 of the Italian Civil Code) |
| Delivering a gift to the recipient you indicate | Our legitimate interest in making the delivery you requested (Art. 6(1)(f) GDPR) | As for order data |
| Protecting our rights in case of disputes | Legitimate interest (Art. 6(1)(f) GDPR) | For the duration of any dispute and until the rights become time-barred |
| Website security and operation (technical logs) | Legitimate interest (Art. 6(1)(f) GDPR) | As set by the hosting provider, normally a few days or weeks |
We do not use your data to send you newsletters or advertising. If we ever wish to do so, we will first ask for your specific, separate consent.
4. Do you have to provide your data?
No, but the details marked as required at checkout are needed to conclude and ship the order: without them we cannot accept it. Delivery notes and the gift card text are optional.
5. Who we share data with
Data is processed by us and, only as far as necessary, by:
- couriers and shipping services, for delivery (name, address, phone);
- payment service providers and banks, for collecting payments and any refunds;
- our accountant or tax adviser, for accounting obligations;
- technical service providers (website hosting, email service), acting as data processors;
- WhatsApp (Meta Platforms), if you choose to send us the order or write to us on WhatsApp: in that case Meta processes data as an independent controller under its own privacy policy;
- public authorities, where required by law.
We do not sell or transfer your data to third parties for commercial purposes and we do not publish it.
6. Transfers outside the European Union
We process data in the European Union. Some providers (for example WhatsApp/Meta or the payment service provider) may also process data in the United States or other non-EU countries. In those cases the transfer is based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for participating companies) or on the standard contractual clauses approved by the Commission (Art. 46 GDPR).
7. If you order a gift
If you give us another person's details as the recipient, please do so only if you are entitled to and let them know. We use that data solely for the delivery, under the terms described in this notice.
8. Your rights
At any time you can ask us, by writing to info@tosvero.it, for:
- access to your data and a copy of it (Art. 15);
- correction of inaccurate or incomplete data (Art. 16);
- erasure, unless the law requires us to keep it, as with tax records (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you gave us (Art. 20);
- to object to processing based on our legitimate interest (Art. 21).
We reply within one month of the request. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.
9. Other information
We do not take decisions based solely on automated processing, including profiling. The website is not intended for people under 18 and we do not knowingly collect data from minors. We protect data with appropriate technical and organisational measures and limit access to the people who need to handle orders.
10. Changes
We may update this notice. The version in force is always published on this page, with the date of the latest update at the top.