Privacy and cookies

For the processing related to purchases, the owner coincides with the professional subject who manages the sales contract. Its identification and contact data must be made available according to the applicable information obligations; if they are not visible in the flow you are using, request them through the privacy channel before providing additional data.

For personal data requests you can use the privacy channel or the Customer Service. If you want to know the full identification data of the owner before creating an account or making a purchase, you can request it through these channels.

Depending on the functions you use, we can process the following data categories:

• identification and contact data, such as name, surname, email, phone, country and account data;
• billing and shipping data, including addresses and information necessary for delivery;
• order data, purchased products, returns, refunds, customer credit and transaction history;
• technical references of payment and transaction status; the payment data managed directly by an external lender also follow the rules of the respective lender;
• messages, requests for assistance, complaints and communications with customer service;
• Saved preferences, wishlists and profile settings;
• data relating to newsletter registration, marketing preferences and consent proof when request;
• technical and safety data necessary for the operation of the service, such as IP address, log, device information, session and activities relevant to prevent abuse or accidents.

Contract execution and pre-contractual measures

We use the data you need to create and manage your account, process your cart and order, receive payment, prepare your shipment, manage delivery, returns, refunds and assistance.

Obligations of law

Some data must be stored or communicated for tax, accounting, administrative, customs, product safety or to respond to legitimate requests of the authorities.

Legitimate interest

When appropriate and after necessary balancing, we can process data for cybersecurity, fraud prevention and abuse, protection of our rights, service continuity, technical diagnostics and management of disputes.

Consent

When processing requires consent, for example for certain promotional communications or for unnecessary tracking tools, you can freely choose and revoke your consent at any time without prejudice to the lawfulness of the processing made before revocation.

The required fields are required to provide the required function or to fulfil an obligation. If they are not provided, we may not be able to create the account, conclude the order, deliver or respond properly to the request.

Optional data can be omitted without preventing the use of essential functions. Marketing preferences are not a condition to purchase.

When choosing a payment method managed by an external lender, the data required for the transaction is communicated or collected directly by the lender. Karmarando use the results and references necessary to register payment, reconcile order, manage any refunds and prevent fraud.

We do not declare that we retain the card data in full when the data is handled by the payment lender.

Delivery data can be communicated to carriers, logistics operators and subjects necessary for the execution of the shipment.For international shipments, additional data can be processed when really necessary for customs or import.

The address tips or completion functions are optional: the user can continue to fill or manually correct the fields. the required address part can be transmitted to that service to return the required suggestions.

When you request consent, we register the information you need to prove your choice and allow you to revoke it later.

The communications strictly necessary for accounts, order, security, payment, delivery or assistance are not promotional newsletters and may be sent when necessary to perform the service or fulfil obligations.

Technical cookies and tools strictly necessary can be used for session, authentication, security, cart, indispensable preferences and operation of the site without requiring consent when the legislation allows it.

Cookies or non-technical tools used for analytics that are not similar to technicians, profiling, advertising or tracking between services must not be activated before consent when required.

The consent, when used as a legal basis, must be revoked. The browser settings also allow you to delete or block cookies, even if the deactivation of technical ones can compromise some necessary functions.

Data can be processed by authorized personnel and suppliers who perform necessary activities at the service, such as hosting and infrastructure, email, payments, shipments, assistance, security, technical maintenance, management of addresses and professional services.

Suppliers only receive the data necessary for the task entrusted and operate, according to the applicable role, as processors, independent owners or other legitimate subjects.

We do not sell personal data databases as a business activity. Any communication to third parties is done for the purposes and legal basis described in this statement.

Some suppliers may operate or make data accessible outside the European Economic Area. When an international transfer is subject to the GDPR, it must be based on a mechanism provided by Chapter V of the Regulation, such as a decision of suitability or appropriate guarantees, including standard contractual clauses when applicable.

We do not apply a single retention period to all data. The duration depends on the purposes and obligations applicable.

• order, billing and tax documentation: for the period required by applicable tax, accounting and civil law;
• account data: as long as the account is active or necessary to provide the service, subject to retention and protection of rights;
• assistance, disputes and security: for the time being proportional to the management of the request, prevention of abuse and protection of any rights;
• newsletter and marketing: until the revocation or termination of the purpose, preserving when necessary proof of the choice made for obligations of accountability or defense;
• cookie: according to the duration of the specific cookie and the purpose for which it is used.

When the data is no longer necessary, it is deleted, anonymized or made unavailable according to the procedures applicable.

We adopt reasonable and proportionate technical and organizational measures to protect data and accounts from unauthorized access, loss, alteration or undue disclosure. Among the measures may include access controls, credentials protection, security event registration, updates, backup and segregation of privileges.

No system connected to the Internet can be declared securely, so the measures are reviewed and adapted to the risks and evolution of the infrastructure.

In the cases provided by the GDPR you can request access to your data, rectification, cancellation, restriction of processing and portability; you can object to the processing based on the legitimate interest and withdraw your consent when the processing is based on consent.

You can also lodge a complaint with the competent supervisory authority. The exercise of a right may require a reasonable verification of identity to prevent data being communicated or modified by an unauthorised person.

To exercise rights, use the privacy channel or the Customer Service.

Unless otherwise specified information provided in the context of a function, the normal use of e-commerce does not provide decisions based solely on an automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

Automatic security, anti-fraud, availability or technical validation controls can contribute to the management of a transaction without eliminating the rights provided by applicable legislation.

The sales service is not designed to allow minors to conclude orders. If we get to know data collected in a way that does not meet the applicable requirements, we take the necessary steps to manage them correctly.

This information may be updated when the site changes, treatments, suppliers, legal bases or applicable legislation.The date shown at the bottom of the page identifies the version published.

For substantial changes requiring a new choice or specific information, the procedures required by applicable legislation will be adopted.