Privacy Policy
Last updated: 17 August 2026
1. Data Controller
The data controller is Cecco Trading SRLS, with registered office at Via Torretta di Siena 16, 80058 Torre Annunziata (NA), Italy, VAT No. 11133331212, certified email (PEC): [email protected].
2. Personal Data We Process
When a user submits a purchase request through the website, we may process the name, email address, selected size where applicable, requested products, product codes, quantities, order price and any information included in the free-text note.
The website does not request or collect body measurements. There is no customer account and the website does not collect card numbers, banking credentials or other payment details.
3. Purposes and Legal Bases
Personal data are processed to receive and manage requests and orders, verify availability and order information, respond to users, arrange payment and delivery, perform a contract or take pre-contractual steps requested by the data subject, comply with legal obligations, and establish, exercise or defend the Controller's rights.
Depending on the circumstances, the legal basis is performance of pre-contractual measures or a contract, compliance with a legal obligation, or the Controller's legitimate interest in protecting its rights and securing the service.
4. Mandatory Data
Name, email address and information necessary to process an order are required to handle the request. Failure to provide such information prevents the Company from processing the order or responding to the request.
5. Processing
The website does not maintain a customer database or user account. Data submitted through the forms are transmitted through the technical services required to receive and forward the communication and are subsequently handled by the Controller through its email systems.
6. Recipients and Processors
Data may be processed, to the extent necessary, by technology providers used by the website, including Cloudflare for infrastructure and network services, Resend for email transmission, Google for the email service used by the Controller, and Sanity for delivery of multimedia content. The relationships with these providers are governed in accordance with applicable law.
7. International Transfers
Some providers may process personal data outside the European Economic Area. Where a transfer to a third country occurs, the Controller relies on the transfer mechanism permitted by applicable law, such as an adequacy decision, an appropriate safeguard under Articles 46 or 47 GDPR or, where permitted, a derogation under Article 49 GDPR.
8. Retention
Order data and related commercial documentation are retained for as long as necessary to manage the relationship and thereafter for the period required by applicable civil, tax and accounting obligations and to protect the Controller's rights. Where no longer retention period is required by law, contractual and commercial documentation is ordinarily retained for a maximum of 10 years from the conclusion or last relevant activity of the relationship, subject to litigation or other legal obligations.
Technical data used solely for IP-based anti-abuse controls are retained only as necessary for those controls and, under the current implementation, for no longer than 24 hours.
9. Cart and Local Storage
The cart uses browser local storage to keep only products, sizes and quantities on the user's device. It does not contain the user's name, email address or other directly identifying information and is not transmitted to the server until an order is submitted. Users may delete it through browser settings.
10. Cookies, Analytics and Profiling
In its current configuration, the website does not use analytics or advertising cookies, profiling tools, advertising pixels, analytics systems or login accounts. No commercial profiling is carried out through the website.
11. Newsletter
The newsletter function is currently disabled. Any address entered in the newsletter field is not stored or transmitted until the function is activated. If activated, the required information and consent mechanisms will be implemented.
12. Data Subject Rights
Data subjects may exercise, where applicable, the rights of access, rectification, erasure, restriction, objection, portability and other rights provided by Articles 15-22 GDPR. Requests may be sent to [email protected].
Data subjects may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority.
13. Updates
This Privacy Policy may be amended following changes to processing activities, providers, the website or applicable law. The version published on the website will state the date of the latest update.