Privacy notice

Controller and contact

The controller is InCloud S.r.l., Via Unità d'Italia 135, 41058 Vignola (MO), Italy, VAT number, tax code and Companies Register number 04209270364, REA MO-451901, share capital EUR 3,000.00, PEC [email protected]. For privacy questions and rights requests, write to [email protected] with the subject Privacy request. The shop and support address is Via Caselline 633, 41058 Vignola (MO), Italy.

Data we use and where it comes from

We process the details you provide for an account, checkout, delivery, invoicing, support and your communication preferences; cart and order contents; payment and shipment references and statuses; session, verification and security records. For sign-ins and security events such as a temporary sign-in lock we also record the IP address, device type and an approximate location (country and, where available, city) taken from the headers of the network provider that serves us, never from an external geolocation service. We also process packing documentation, including parcel-preparation videos linked to an order where identification is necessary. Payment providers, delivery services and our service systems supply the corresponding transaction, delivery and security results.

For newsletter signup we ask for your email and consent. Where that email belongs to a verified active account, missing newsletter name details may be taken from that account. Providing information needed for an order or security verification is necessary to fulfil that request; optional marketing data are not a condition of buying or receiving support.

Purposes and legal bases

Account access, the steps you request before buying, orders, payment checks, delivery and customer assistance are processed to take steps at your request or perform a contract, under GDPR Article 6(1)(b). Accounting, tax records, consumer remedies and responses required by law rely on Article 6(1)(c).

Fraud prevention, service security, proportionate access logs and the establishment or defence of legal claims rely on our legitimate interests under Article 6(1)(f), balanced against your rights. These interests are protecting accounts and transactions, keeping the service reliable and resolving disputes. Packing documentation is used to check order preparation and delivery disputes; it is not published on customer pages. You may object on grounds relating to your situation.

Newsletters, optional promotional communications, repeated cart reminders and optional campaign-link observations rely on the relevant separate consent under Article 6(1)(a). Newsletter enrollment includes email confirmation. You can withdraw a consent in account preferences, through the applicable unsubscribe link or by contacting support, without affecting the lawfulness of earlier processing. A verified phone, purchase, accepted terms or cookie-notice acknowledgement is not marketing consent.

Recipients and international processing

Authorised personnel and service providers receive only data needed for their tasks: hosting and technical operations, payment processing, delivery, email and requested messaging, address suggestions and assistance. This includes the payment provider you select, such as PayPal or NOWPayments when offered, the carrier assigned to your shipment and LocationIQ for address suggestions requested through the shop. Professional advisers and competent authorities receive data where necessary for their functions or a legal obligation.

Address suggestions: © OpenStreetMap contributors, LocationIQ.

Payment providers and external services such as WhatsApp also explain their own processing in their privacy notices. Their services can involve processing outside the European Economic Area. Where a transfer falls under our responsibility, applicable GDPR transfer requirements apply, including an adequacy decision or appropriate safeguards where required. Contact [email protected] for the recipients, countries and safeguards applicable to your data and to request a copy of relevant safeguards.

To protect sign-in, registration and support ticket creation from automated abuse we use Google reCAPTCHA v3, provided by Google Ireland Limited. Only on these pages does the browser load Google's service, which processes technical device and interaction data, such as IP address, browser information and Google cookies, to estimate whether the request comes from a person; we receive only the result of the check. The legal basis is our legitimate interest in service security and abuse prevention under Article 6(1)(f) GDPR. Google's Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms) apply.

Retention periods and criteria

Account information and saved checkout details are kept while needed to provide the account and its requested services. Orders, payment references, withdrawal notices and related assistance are retained for fulfilment, applicable guarantee periods and the establishment or defence of claims. Accounting records and invoices required by law are retained for ten years from the relevant last accounting entry, and longer where a specific legal obligation or unresolved proceeding requires it. This does not mean that every account field is retained for ten years.

Operational support and communication records are kept according to whether the request or delivery is still open, whether its outcome must be demonstrated, and whether a legal obligation or dispute requires retention. Marketing stops when consent is withdrawn; evidence of preferences and a limited suppression record may remain as needed to honour the choice and demonstrate compliance. Backup retention depends on recovery needs and any applicable legal hold; deleting an account does not imply immediate removal from every backup.

Verification codes expire after 10 minutes; challenge and request-quota records are removed by scheduled cleanup after seven days. Ordinary authenticated access expires after 12 hours, or up to 90 days with Remember me; expired sessions are cleaned up. Login audit records are scheduled for removal after 30 days. A separate pseudonymous login-lock history can be retained for an active account until a fully successful sign-in clears the lock, the email changes or the account is deleted; it is not covered by the 30-day audit-log period. Guest carts expire after at most 30 days and are then cleaned up. Temporary encrypted checkout details are cleared by scheduled cleanup after 30 minutes.

Optional campaign-link records expire after 30 days and are removed by scheduled cleanup. Account exports are protected and available for up to 24 hours, with a single download. Account deletion requires eligibility and security checks and a minimum seven-day waiting period; unresolved orders, requests or legal obligations can require individual review or retention of necessary records. When you delete your account, or we delete it, we anonymise the profile and erase your phone number, password, two-step verification and sign-in sessions. We keep only the email address you used, encrypted, together with a pseudonymous identifier, to answer requests from judicial or police authorities (Article 6(1)(c) GDPR) and to prevent fraud and abuse by blocking a new registration with the same address (legitimate interest, Article 6(1)(f) and Article 17(3) GDPR). The address is accessible only to authorised staff, every access is logged, and it is kept for as long as these purposes require, reviewed periodically. You can object to this processing by writing to [email protected]. The accounting records of your orders are kept for the period required by law. These identifiers are personal data, not anonymous data.

Your rights and account controls

Under the conditions set by the GDPR, you can request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Write to [email protected]; we may request proportionate information to verify your identity. We reply without undue delay, normally within one month, and explain any lawful extension. You may complain to the Italian Data Protection Authority at www.garanteprivacy.it or another competent supervisory authority.

Authenticated account holders can request an export and account deletion using the account controls. This process does not replace your right to contact us, and operational holds do not remove our duty to assess a GDPR request. Payment and security checks can temporarily prevent a transaction or access; contact support to ask for a human review of a disputed outcome.

Communications, link observations and cookies

Service messages about account security, orders, payments, shipping and rights requests are separate from promotional communications. Newsletter subscription and optional campaign-link observations are separate choices. Link observations record requests, which may include repeated visits or automated security checks; they do not prove that an email was opened or read.

Optional campaign-link observations do not use tracking pixels, cookies, IP addresses or browser identifiers. Withdrawing that choice stops new observations; a still-valid link can continue to open its original destination. The Cookie Policy describes the browser storage used by the shop and how to remove it.

Third-party content embedded in the shop, currently the Google Maps map of the shop provided by Google Ireland Limited, loads only with your consent in the cookie preferences (Article 6(1)(a) and the rules on cookies) or when you load it with an explicit click. Google then receives your IP address and technical browser data as an independent controller and may process them outside the European Economic Area under its own safeguards. You can withdraw that consent at any time from Cookie preferences.