Privacy Policy

1. Data controller

The data controller is STONE SRL, with registered office at Via Diaz 36, 81034 Napoli, Italia, VAT number 11126051215.

For any question concerning this policy or the processing of your personal data, you can write to [email protected].

2. Personal data we collect

We process the data you provide directly, the data generated by your use of the store and the data required to fulfil your orders:

• identification and contact data: first and last name, email address, telephone number, shipping and billing address;
• account data: access credentials, order history, wish list, newsletter and back-in-stock alert preferences;
• order and payment data: products purchased, amounts, payment status and transaction identifiers. Card numbers never reach our servers, as they are handled directly by the payment provider;
• navigation data: IP address, device and browser type, pages viewed and the approximate location derived from the IP address, collected through technical cookies and, with your consent, analytical cookies;
• communications: the messages you send us through the contact form, your merchandise return requests and support exchanges.

3. Purposes and legal bases

Each processing operation rests on one of the legal bases provided for by Article 6 GDPR:

• conclusion and performance of the sales contract — sale of goods, payment, shipping, invoicing, customer service and management of returns (Article 6(1)(b) GDPR);
• compliance with legal obligations — accounting and tax records, anti-fraud controls, management of the legal guarantee (Article 6(1)(c) GDPR);
• legitimate interest — protection against fraudulent transactions, defence of our rights in the event of a dispute, keeping the website secure (Article 6(1)(f) GDPR);
• consent — newsletter subscription, marketing communications, personalised commercial offers and non-essential analytical cookies (Article 6(1)(a) GDPR). You may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

4. Cookies and other tracking technologies

The website uses technical cookies, which are necessary for navigation, for keeping the cart contents and for authentication, and therefore do not require consent.

Analytical and profiling cookies, if enabled, are installed only after you give your consent through the banner shown on your first visit. You can change or withdraw your preferences at any time and you can also manage or delete cookies from your browser settings; disabling technical cookies may prevent parts of the store from working.

5. Recipients and data processors

Your data are not sold or transferred to third parties for their own marketing purposes. They may be communicated to parties that process them on our behalf, appointed as data processors under Article 28 GDPR, or that act as autonomous controllers:

• payment service providers, for the authorisation and execution of transactions;
• carriers and logistics partners, for the delivery of your orders and the management of returns;
• hosting, email and IT service providers, for the operation and maintenance of the website;
• analytics and marketing platforms, only where you have given your consent;
• professional advisors, accountants and tax consultants, and public authorities where required by law.

6. Transfers outside the European Union

Some service providers may be established outside the European Economic Area. In that case the transfer takes place only towards countries covered by an adequacy decision of the European Commission or, failing that, on the basis of the standard contractual clauses approved by the European Commission and, where necessary, with additional technical and organisational safeguards.

7. How long we keep the data

We keep your data for as long as your account is active and, once the relationship ends or the account is closed, for the periods necessary to comply with legal obligations. In particular:

• account and order data: for the duration of the relationship and thereafter for the statutory limitation periods;
• invoices and accounting records: 10 years, as required by tax law;
• data of visitors who do not have an account: for the period strictly necessary for the purposes described above;
• contact form messages and customer service exchanges: 24 months from the last exchange;
• newsletter and marketing data: until consent is withdrawn, and in any case after 24 months of inactivity;
• security and anti-fraud logs: 12 months.

8. Your rights

At any time you may exercise the rights set out in Articles 15 to 22 GDPR and in Articles 7 and 17 of Legislative Decree 196/2003:

• access your personal data and obtain a copy of them (Article 15 GDPR);
• be informed about the purposes, the categories of data and the recipients of the processing (Article 13 and 14 GDPR);
• obtain the rectification of inaccurate or incomplete data (Article 16 GDPR);
• obtain the erasure of your data where the conditions of Article 17 GDPR are met;
• obtain the restriction of processing or object to it on grounds relating to your particular situation (Articles 18 and 21 GDPR);
• receive your data in a structured, commonly used and machine-readable format, and transmit them to another controller (Article 20 GDPR);
• withdraw consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal (Article 7 GDPR);
• opt out at any time from receiving commercial communications, through the unsubscribe link included in every newsletter or by writing to us.

9. How to exercise your rights

To exercise your rights, write to [email protected] stating your request and the data needed to identify you. We will reply within one month, extendable by two further months in the cases provided for by the regulation.

If you believe that the processing of your personal data infringes the regulation, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where you habitually reside or work.

10. Minors

The store is not addressed to minors under 18 years of age. If a minor has provided personal data without the consent of the holder of parental responsibility, the data will be erased upon request, once the request has been verified.

11. Security of the data

Data are processed through automated and manual tools, adopting technical and organisational measures appropriate to the risk, such as encryption of traffic (HTTPS), access control and least-privilege authorisations, logging of sensitive operations and periodic review of the service providers. Payment data are transmitted in encrypted form and processed directly by the payment provider, without passing through our systems.

12. Changes to this policy

This policy may be updated to reflect changes in the services offered, in the suppliers used or in the applicable legislation. The updated version is published on this page, together with the date of the last revision. Where the changes are substantial, we will inform registered users through the account area or by email.